Merge master into haskell-updates

2022-07-11 00:13:06 +00:00 · 2022-07-11 00:13:06 +00:00 · 2b02f44395
commit 2b02f44395
parent de243bc796 0dc7730340
145 changed files with 2107 additions and 2040 deletions
--- a/.github/workflows/update-terraform-providers.yml
+++ b/.github/workflows/update-terraform-providers.yml
@ -2,7 +2,7 @@ name: "Update terraform-providers"

 on:
  schedule:
-    - cron: "14 3 * * 1"
+    - cron: "14 3 * * 0"
  workflow_dispatch:

 permissions:
--- a/doc/languages-frameworks/vim.section.md
+++ b/doc/languages-frameworks/vim.section.md
@ -5,11 +5,9 @@ and additional libraries.

 Loading can be deferred; see examples.

-At the moment we support three different methods for managing plugins:
+At the moment we support two different methods for managing plugins:

 - Vim packages (*recommended*)
- VAM (=vim-addon-manager)
- Pathogen
 - vim-plug

 ## Custom configuration {#custom-configuration}
@ -213,100 +211,6 @@ neovim.override {
 }
 ```

-## Managing plugins with VAM {#managing-plugins-with-vam}
-
-### Handling dependencies of Vim plugins {#handling-dependencies-of-vim-plugins}
-
-VAM introduced .json files supporting dependencies without versioning
-assuming that "using latest version" is ok most of the time.
-
-### Example {#example}
-
-First create a vim-scripts file having one plugin name per line. Example:
-
-```vim
-"tlib"
-{'name': 'vim-addon-sql'}
-{'filetype_regex': '\%(vim)$', 'names': ['reload', 'vim-dev-plugin']}
-```
-
-A discrete vim-scripts file can be read by VAM as well like this:
-
-```vim
-call vam#Scripts(expand('~/.vim-scripts'), {})
-```
-
-Create a default.nix file:
-
-```nix
-{ nixpkgs ? import <nixpkgs> {}, compiler ? "ghc7102" }:
-nixpkgs.vim_configurable.customize { name = "vim"; vimrcConfig.vam.pluginDictionaries = [ "vim-addon-vim2nix" ]; }
-```
-
-Create a generate.vim file:
-
-```vim
-ActivateAddons vim-addon-vim2nix
-let vim_scripts = "vim-scripts"
-call nix#ExportPluginsForNix({
-\  'path_to_nixpkgs': eval('{"'.substitute(substitute(substitute($NIX_PATH, ':', ',', 'g'), '=',':', 'g'), '\([:,]\)', '"\1"',"g").'"}')["nixpkgs"],
-\  'cache_file': '/tmp/vim2nix-cache',
-\  'try_catch': 0,
-\  'plugin_dictionaries': ["vim-addon-manager"]+map(readfile(vim_scripts), 'eval(v:val)')
-\ })
-```
-
-Then run
-
-```bash
-nix-shell -p vimUtils.vim_with_vim2nix --command "vim -c 'source generate.vim'"
-```
-
-You should get a Vim buffer with the nix derivations (output1) and vam.pluginDictionaries (output2).
-You can add your Vim to your system's configuration file like this and start it by "vim-my":
-
-```nix
-my-vim =
-  let plugins = let inherit (vimUtils) buildVimPluginFrom2Nix; in {
-    copy paste output1 here
-  }; in vim_configurable.customize {
-    name = "vim-my";
-
-    vimrcConfig.vam.knownPlugins = plugins; # optional
-    vimrcConfig.vam.pluginDictionaries = [
-       copy paste output2 here
-    ];
-
-  };
-```
-
-Sample output1:
-
-```nix
-"reload" = buildVimPluginFrom2Nix { # created by nix#NixDerivation
-  name = "reload";
-  src = fetchgit {
-    url = "https://github.com/xolox/vim-reload";
-    rev = "0a601a668727f5b675cb1ddc19f6861f3f7ab9e1";
-    sha256 = "0vb832l9yxj919f5hfg6qj6bn9ni57gnjd3bj7zpq7d4iv2s4wdh";
-  };
-  dependencies = ["nim-misc"];
-
-};
-[...]
-```
-
-Sample output2:
-
-```nix
-[
-  ''vim-addon-manager''
-  ''tlib''
-  { "name" = ''vim-addon-sql''; }
-  { "filetype_regex" = ''\%(vim)$$''; "names" = [ ''reload'' ''vim-dev-plugin'' ]; }
-]
-```
-
 ## Adding new plugins to nixpkgs {#adding-new-plugins-to-nixpkgs}

 Nix expressions for Vim plugins are stored in [pkgs/applications/editors/vim/plugins](https://github.com/NixOS/nixpkgs/tree/master/pkgs/applications/editors/vim/plugins). For the vast majority of plugins, Nix expressions are automatically generated by running [`./update.py`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/update.py). This creates a [generated.nix](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/generated.nix) file based on the plugins listed in [vim-plugin-names](https://github.com/NixOS/nixpkgs/blob/master/pkgs/applications/editors/vim/plugins/vim-plugin-names). Plugins are listed in alphabetical order in `vim-plugin-names` using the format `[github username]/[repository]@[gitref]`. For example https://github.com/scrooloose/nerdtree becomes `scrooloose/nerdtree`.
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@ -156,6 +156,13 @@
          <link linkend="opt-services.expressvpn.enable">services.expressvpn</link>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://www.grafana.com/oss/tempo/">Grafana
+          Tempo</link>, a distributed tracing store. Available as
+          <link linkend="opt-services.tempo.enable">services.tempo</link>.
+        </para>
+      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="sec-release-22.11-incompatibilities">
@ -250,6 +257,16 @@
          maintainer to update the package.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The <literal>services.graphite.api</literal> and
+          <literal>services.graphite.beacon</literal> NixOS options, and
+          the <literal>python3.pkgs.graphite_api</literal>,
+          <literal>python3.pkgs.graphite_beacon</literal> and
+          <literal>python3.pkgs.influxgraph</literal> packages, have
+          been removed due to lack of upstream maintenance.
+        </para>
+      </listitem>
      <listitem>
        <para>
          (Neo)Vim can not be configured with
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@ -64,6 +64,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [expressvpn](https://www.expressvpn.com), the CLI client for ExpressVPN. Available as [services.expressvpn](#opt-services.expressvpn.enable).

+- [Grafana Tempo](https://www.grafana.com/oss/tempo/), a distributed tracing store. Available as [services.tempo](#opt-services.tempo.enable).
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

 ## Backward Incompatibilities {#sec-release-22.11-incompatibilities}
@ -97,6 +99,11 @@ In addition to numerous new and upgraded packages, this release has the followin

 - riak package removed along with `services.riak` module, due to lack of maintainer to update the package.

+- The `services.graphite.api` and `services.graphite.beacon` NixOS options, and
+  the `python3.pkgs.graphite_api`, `python3.pkgs.graphite_beacon` and
+  `python3.pkgs.influxgraph` packages, have been removed due to lack of upstream
+  maintenance.
+
 - (Neo)Vim can not be configured with `configure.pathogen` anymore to reduce maintainance burden.
 Use `configure.packages` instead.

--- a/nixos/modules/config/qt5.nix
+++ b/nixos/modules/config/qt5.nix
@ -10,11 +10,13 @@ let
  isQtStyle = cfg.platformTheme == "gtk2" && !(builtins.elem cfg.style ["adwaita" "adwaita-dark"]);
  isQt5ct = cfg.platformTheme == "qt5ct";
  isLxqt = cfg.platformTheme == "lxqt";
+  isKde = cfg.platformTheme == "kde";

  packages = if isQGnome then [ pkgs.qgnomeplatform pkgs.adwaita-qt ]
    else if isQtStyle then [ pkgs.libsForQt5.qtstyleplugins ]
    else if isQt5ct then [ pkgs.libsForQt5.qt5ct ]
    else if isLxqt then [ pkgs.lxqt.lxqt-qtplugin pkgs.lxqt.lxqt-config ]
+    else if isKde then [ pkgs.libsForQt5.plasma-integration pkgs.libsForQt5.systemsettings ]
    else throw "`qt5.platformTheme` ${cfg.platformTheme} and `qt5.style` ${cfg.style} are not compatible.";

 in
@ -33,6 +35,7 @@ in
          "gnome"
          "lxqt"
          "qt5ct"
+          "kde"
        ];
        example = "gnome";
        relatedPackages = [
@ -40,6 +43,7 @@ in
          ["libsForQt5" "qtstyleplugins"]
          ["libsForQt5" "qt5ct"]
          ["lxqt" "lxqt-qtplugin"]
+          ["libsForQt5" "plasma-integration"]
        ];
        description = ''
          Selects the platform theme to use for Qt5 applications.</para>
@ -71,6 +75,10 @@ in
                application.
              </para></listitem>
            </varlistentry>
+            <varlistentry>
+              <term><literal>kde</literal></term>
+              <listitem><para>Use Qt settings from Plasma.</para></listitem>
+            </varlistentry>
          </variablelist>
        '';
      };
@ -119,7 +127,7 @@ in

    environment.variables.QT_QPA_PLATFORMTHEME = cfg.platformTheme;

-    environment.variables.QT_STYLE_OVERRIDE = mkIf (! (isQt5ct || isLxqt)) cfg.style;
+    environment.variables.QT_STYLE_OVERRIDE = mkIf (! (isQt5ct || isLxqt || isKde)) cfg.style;

    environment.systemPackages = packages;

--- a/nixos/modules/config/resolvconf.nix
+++ b/nixos/modules/config/resolvconf.nix
@ -50,7 +50,20 @@ in
        default = !(config.environment.etc ? "resolv.conf");
        defaultText = literalExpression ''!(config.environment.etc ? "resolv.conf")'';
        description = ''
-          DNS configuration is managed by resolvconf.
+          Whether DNS configuration is managed by resolvconf.
+        '';
+      };
+
+      package = mkOption {
+        type = types.package;
+        default = pkgs.openresolv;
+        defaultText = literalExpression "pkgs.openresolv";
+        description = ''
+          The package that provides the system-wide resolvconf command. Defaults to <literal>openresolv</literal>
+          if this module is enabled. Otherwise, can be used by other modules (for example <option>services.resolved</option>) to
+          provide a compatibility layer.
+
+          This option generally shouldn't be set by the user.
        '';
      };

@ -119,10 +132,12 @@ in
            exit 1
          ''
        else configText;
+
+      environment.systemPackages = [ cfg.package ];
    }

    (mkIf cfg.enable {
-      environment.systemPackages = [ pkgs.openresolv ];
+      networking.resolvconf.package = pkgs.openresolv;

      systemd.services.resolvconf = {
        description = "resolvconf update";
@ -134,7 +149,7 @@ in

        serviceConfig = {
          Type = "oneshot";
-          ExecStart = "${pkgs.openresolv}/bin/resolvconf -u";
+          ExecStart = "${cfg.package}/bin/resolvconf -u";
          RemainAfterExit = true;
        };
      };
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@ -24,7 +24,7 @@ let
  primeEnabled = syncCfg.enable || offloadCfg.enable;
  nvidiaPersistencedEnabled =  cfg.nvidiaPersistenced;
  nvidiaSettings = cfg.nvidiaSettings;
-  busIDType = types.strMatching "([[:print:]]+\:[0-9]{1,3}\:[0-9]{1,2}\:[0-9])?";
+  busIDType = types.strMatching "([[:print:]]+[\:\@][0-9]{1,3}\:[0-9]{1,2}\:[0-9])?";
 in

 {
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -1033,6 +1033,7 @@
  ./services/torrent/peerflix.nix
  ./services/torrent/rtorrent.nix
  ./services/torrent/transmission.nix
+  ./services/tracing/tempo.nix
  ./services/ttys/getty.nix
  ./services/ttys/gpm.nix
  ./services/ttys/kmscon.nix
--- a/nixos/modules/services/backup/zrepl.nix
+++ b/nixos/modules/services/backup/zrepl.nix
@ -13,6 +13,13 @@ in
    services.zrepl = {
      enable = mkEnableOption "zrepl";

+      package = mkOption {
+        type = types.package;
+        default = pkgs.zrepl;
+        defaultText = literalExpression "pkgs.zrepl";
+        description = "Which package to use for zrepl";
+      };
+
      settings = mkOption {
        default = { };
        description = ''
@ -30,14 +37,14 @@ in
  ### Implementation ###

  config = mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.zrepl ];
+    environment.systemPackages = [ cfg.package ];

    # zrepl looks for its config in this location by default. This
    # allows the use of e.g. `zrepl signal wakeup <job>` without having
    # to specify the storepath of the config.
    environment.etc."zrepl/zrepl.yml".source = configFile;

-    systemd.packages = [ pkgs.zrepl ];
+    systemd.packages = [ cfg.package ];

    # Note that pkgs.zrepl copies and adapts the upstream systemd unit, and
    # the fields defined here only override certain fields from that unit.
--- a/nixos/modules/services/continuous-integration/hydra/default.nix
+++ b/nixos/modules/services/continuous-integration/hydra/default.nix
@ -298,6 +298,7 @@ in
        environment = env // {
          HYDRA_DBI = "${env.HYDRA_DBI};application_name=hydra-init";
        };
+        path = [ pkgs.util-linux ];
        preStart = ''
          mkdir -p ${baseDir}
          chown hydra:hydra ${baseDir}
@ -318,11 +319,11 @@ in

          ${optionalString haveLocalDB ''
            if ! [ -e ${baseDir}/.db-created ]; then
-              ${pkgs.sudo}/bin/sudo -u ${config.services.postgresql.superUser} ${config.services.postgresql.package}/bin/createuser hydra
-              ${pkgs.sudo}/bin/sudo -u ${config.services.postgresql.superUser} ${config.services.postgresql.package}/bin/createdb -O hydra hydra
+              runuser -u ${config.services.postgresql.superUser} ${config.services.postgresql.package}/bin/createuser hydra
+              runuser -u ${config.services.postgresql.superUser} ${config.services.postgresql.package}/bin/createdb -O hydra hydra
              touch ${baseDir}/.db-created
            fi
-            echo "create extension if not exists pg_trgm" | ${pkgs.sudo}/bin/sudo -u ${config.services.postgresql.superUser} -- ${config.services.postgresql.package}/bin/psql hydra
+            echo "create extension if not exists pg_trgm" | runuser -u ${config.services.postgresql.superUser} -- ${config.services.postgresql.package}/bin/psql hydra
          ''}

          if [ ! -e ${cfg.gcRootsDir} ]; then
--- a/nixos/modules/services/monitoring/graphite.nix
+++ b/nixos/modules/services/monitoring/graphite.nix
@ -24,16 +24,6 @@ let
    + cfg.web.extraConfig
  );

-  graphiteApiConfig = pkgs.writeText "graphite-api.yaml" ''
-    search_index: ${dataDir}/index
-    ${optionalString (config.time.timeZone != null) "time_zone: ${config.time.timeZone}"}
-    ${optionalString (cfg.api.finders != []) "finders:"}
-    ${concatMapStringsSep "\n" (f: "  - " + f.moduleName) cfg.api.finders}
-    ${optionalString (cfg.api.functions != []) "functions:"}
-    ${concatMapStringsSep "\n" (f: "  - " + f) cfg.api.functions}
-    ${cfg.api.extraConfig}
-  '';
-
  seyrenConfig = {
    SEYREN_URL = cfg.seyren.seyrenUrl;
    MONGO_URL = cfg.seyren.mongoUrl;
@ -72,6 +62,8 @@ let
 in {

  imports = [
+    (mkRemovedOptionModule ["services" "graphite" "api"] "")
+    (mkRemovedOptionModule ["services" "graphite" "beacon"] "")
    (mkRemovedOptionModule ["services" "graphite" "pager"] "")
  ];

@ -115,88 +107,6 @@ in {
      };
    };

-    api = {
-      enable = mkOption {
-        description = ''
-          Whether to enable graphite api. Graphite api is lightweight alternative
-          to graphite web, with api and without dashboard. It's advised to use
-          grafana as alternative dashboard and influxdb as alternative to
-          graphite carbon.
-
-          For more information visit
-          <link xlink:href="https://graphite-api.readthedocs.org/en/latest/"/>
-        '';
-        default = false;
-        type = types.bool;
-      };
-
-      finders = mkOption {
-        description = "List of finder plugins to load.";
-        default = [];
-        example = literalExpression "[ pkgs.python3Packages.influxgraph ]";
-        type = types.listOf types.package;
-      };
-
-      functions = mkOption {
-        description = "List of functions to load.";
-        default = [
-          "graphite_api.functions.SeriesFunctions"
-          "graphite_api.functions.PieFunctions"
-        ];
-        type = types.listOf types.str;
-      };
-
-      listenAddress = mkOption {
-        description = "Graphite web service listen address.";
-        default = "127.0.0.1";
-        type = types.str;
-      };
-
-      port = mkOption {
-        description = "Graphite api service port.";
-        default = 8080;
-        type = types.int;
-      };
-
-      package = mkOption {
-        description = "Package to use for graphite api.";
-        default = pkgs.python3Packages.graphite_api;
-        defaultText = literalExpression "pkgs.python3Packages.graphite_api";
-        type = types.package;
-      };
-
-      extraConfig = mkOption {
-        description = "Extra configuration for graphite api.";
-        default = ''
-          whisper:
-            directories:
-                - ${dataDir}/whisper
-        '';
-        defaultText = literalExpression ''
-          '''
-            whisper:
-              directories:
-                - ''${config.${opt.dataDir}}/whisper
-          '''
-        '';
-        example = ''
-          allowed_origins:
-            - dashboard.example.com
-          cheat_times: true
-          influxdb:
-            host: localhost
-            port: 8086
-            user: influxdb
-            pass: influxdb
-            db: metrics
-          cache:
-            CACHE_TYPE: 'filesystem'
-            CACHE_DIR: '/tmp/graphite-api-cache'
-        '';
-        type = types.lines;
-      };
-    };
-
    carbon = {
      config = mkOption {
        description = "Content of carbon configuration file.";
@ -354,16 +264,6 @@ in {
        '';
      };
    };
-
-    beacon = {
-      enable = mkEnableOption "graphite beacon";
-
-      config = mkOption {
-        description = "Graphite beacon configuration.";
-        default = {};
-        type = types.attrs;
-      };
-    };
  };

  ###### implementation
@ -489,44 +389,6 @@ in {
      environment.systemPackages = [ pkgs.python3Packages.graphite-web ];
    }))

-    (mkIf cfg.api.enable {
-      systemd.services.graphiteApi = {
-        description = "Graphite Api Interface";
-        wantedBy = [ "multi-user.target" ];
-        after = [ "network.target" ];
-        environment = {
-          PYTHONPATH = let
-              aenv = pkgs.python3.buildEnv.override {
-                extraLibs = [ cfg.api.package pkgs.cairo pkgs.python3Packages.cffi ] ++ cfg.api.finders;
-              };
-            in "${aenv}/${pkgs.python3.sitePackages}";
-          GRAPHITE_API_CONFIG = graphiteApiConfig;
-          LD_LIBRARY_PATH = "${pkgs.cairo.out}/lib";
-        };
-        serviceConfig = {
-          ExecStart = ''
-            ${pkgs.python3Packages.waitress}/bin/waitress-serve \
-            --host=${cfg.api.listenAddress} --port=${toString cfg.api.port} \
-            graphite_api.app:app
-          '';
-          User = "graphite";
-          Group = "graphite";
-          PermissionsStartOnly = true;
-        };
-        preStart = ''
-          if ! test -e ${dataDir}/db-created; then
-            mkdir -p ${dataDir}/cache/
-            chmod 0700 ${dataDir}/cache/
-
-            chown graphite:graphite ${cfg.dataDir}
-            chown -R graphite:graphite ${cfg.dataDir}/cache
-
-            touch ${dataDir}/db-created
-          fi
-        '';
-      };
-    })
-
    (mkIf cfg.seyren.enable {
      systemd.services.seyren = {
        description = "Graphite Alerting Dashboard";
@ -550,25 +412,9 @@ in {
      services.mongodb.enable = mkDefault true;
    })

-    (mkIf cfg.beacon.enable {
-      systemd.services.graphite-beacon = {
-        description = "Grpahite Beacon Alerting Daemon";
-        wantedBy = [ "multi-user.target" ];
-        serviceConfig = {
-          ExecStart = ''
-            ${pkgs.python3Packages.graphite_beacon}/bin/graphite-beacon \
-              --config=${pkgs.writeText "graphite-beacon.json" (builtins.toJSON cfg.beacon.config)}
-          '';
-          User = "graphite";
-          Group = "graphite";
-        };
-      };
-    })
-
    (mkIf (
      cfg.carbon.enableCache || cfg.carbon.enableAggregator || cfg.carbon.enableRelay ||
-      cfg.web.enable || cfg.api.enable ||
-      cfg.seyren.enable || cfg.beacon.enable
+      cfg.web.enable || cfg.seyren.enable
     ) {
      users.users.graphite = {
        uid = config.ids.uids.graphite;
--- a/nixos/modules/services/monitoring/prometheus/exporters/node.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/node.nix
@ -44,6 +44,8 @@ in
      ];
      # The timex collector needs to access clock APIs
      ProtectClock = any (collector: collector == "timex") cfg.disabledCollectors;
+      # Allow space monitoring under /home
+      ProtectHome = true;
    };
  };
 }
--- a/nixos/modules/services/networking/dhcpcd.nix
+++ b/nixos/modules/services/networking/dhcpcd.nix
@ -215,7 +215,7 @@ in
        # dhcpcd.  So do a "systemctl restart" instead.
        stopIfChanged = false;

-        path = [ dhcpcd pkgs.nettools pkgs.openresolv ];
+        path = [ dhcpcd pkgs.nettools config.networking.resolvconf.package ];

        unitConfig.ConditionCapability = "CAP_NET_ADMIN";

--- a/nixos/modules/services/networking/tailscale.nix
+++ b/nixos/modules/services/networking/tailscale.nix
@ -47,7 +47,7 @@ in {
    systemd.services.tailscaled = {
      wantedBy = [ "multi-user.target" ];
      path = [
-        pkgs.openresolv # for configuring DNS in some configs
+        config.networking.resolvconf.package # for configuring DNS in some configs
        pkgs.procps     # for collecting running services (opt-in feature)
        pkgs.glibc      # for `getent` to look up user shells
      ];
--- a/nixos/modules/services/networking/wg-quick.nix
+++ b/nixos/modules/services/networking/wg-quick.nix
@ -273,7 +273,7 @@ let
        after = [ "network.target" "network-online.target" ];
        wantedBy = optional values.autostart "multi-user.target";
        environment.DEVICE = name;
-        path = [ pkgs.kmod pkgs.wireguard-tools ];
+        path = [ pkgs.kmod pkgs.wireguard-tools config.networking.resolvconf.package ];

        serviceConfig = {
          Type = "oneshot";
@ -332,5 +332,11 @@ in {
    # breaks the wg-quick routing because wireguard packets leave with a fwmark from wireguard.
    networking.firewall.checkReversePath = false;
    systemd.services = mapAttrs' generateUnit cfg.interfaces;
+
+    # Prevent networkd from clearing the rules set by wg-quick when restarted (e.g. when waking up from suspend).
+    systemd.network.config.networkConfig.ManageForeignRoutingPolicyRules = mkDefault false;
+
+    # WireGuard interfaces should be ignored in determining whether the network is online.
+    systemd.network.wait-online.ignoredInterfaces = builtins.attrNames cfg.interfaces;
  };
 }
--- a/nixos/modules/services/tracing/tempo.nix
+++ b/nixos/modules/services/tracing/tempo.nix
@ -0,0 +1,68 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib) mkEnableOption mkIf mkOption types;
+
+  cfg = config.services.tempo;
+
+  settingsFormat = pkgs.formats.yaml {};
+in {
+  options.services.tempo = {
+    enable = mkEnableOption "Grafana Tempo";
+
+    settings = mkOption {
+      type = settingsFormat.type;
+      default = {};
+      description = ''
+        Specify the configuration for Tempo in Nix.
+
+        See https://grafana.com/docs/tempo/latest/configuration/ for available options.
+      '';
+    };
+
+    configFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Specify a path to a configuration file that Tempo should use.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # for tempo-cli and friends
+    environment.systemPackages = [ pkgs.tempo ];
+
+    assertions = [{
+      assertion = (
+        (cfg.settings == {}) != (cfg.configFile == null)
+      );
+      message  = ''
+        Please specify a configuration for Tempo with either
+        'services.tempo.settings' or
+        'services.tempo.configFile'.
+      '';
+    }];
+
+    systemd.services.tempo = {
+      description = "Grafana Tempo Service Daemon";
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = let
+        conf = if cfg.configFile == null
+               then settingsFormat.generate "config.yaml" cfg.settings
+               else cfg.configFile;
+      in
+      {
+        ExecStart = "${pkgs.tempo}/bin/tempo --config.file=${conf}";
+        DynamicUser = true;
+        Restart = "always";
+        ProtectSystem = "full";
+        DevicePolicy = "closed";
+        NoNewPrivileges = true;
+        WorkingDirectory = "/var/lib/tempo";
+        StateDirectory = "tempo";
+      };
+    };
+  };
+}
--- a/nixos/modules/services/web-apps/hedgedoc.nix
+++ b/nixos/modules/services/web-apps/hedgedoc.nix
@ -13,17 +13,22 @@ let
    then "hedgedoc"
    else "codimd";

+  settingsFormat = pkgs.formats.json {};
+
  prettyJSON = conf:
    pkgs.runCommandLocal "hedgedoc-config.json" {
      nativeBuildInputs = [ pkgs.jq ];
    } ''
-      echo '${builtins.toJSON conf}' | jq \
-        '{production:del(.[]|nulls)|del(.[][]?|nulls)}' > $out
+      jq '{production:del(.[]|nulls)|del(.[][]?|nulls)}' \
+        < ${settingsFormat.generate "hedgedoc-ugly.json" cfg.settings} \
+        > $out
    '';
 in
 {
  imports = [
    (mkRenamedOptionModule [ "services" "codimd" ] [ "services" "hedgedoc" ])
+    (mkRenamedOptionModule
+      [ "services" "hedgedoc" "configuration" ] [ "services" "hedgedoc" "settings" ])
  ];

  options.services.hedgedoc = {
@ -45,7 +50,7 @@ in
      '';
    };

-    configuration = {
+    settings = let options = {
      debug = mkEnableOption "debug mode";
      domain = mkOption {
        type = types.nullOr types.str;
@ -960,6 +965,16 @@ in
        default = null;
        description = "Configure the SAML integration.";
      };
+    }; in lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+        inherit options;
+      };
+      description = ''
+        HedgeDoc configuration, see
+        <link xlink:href="https://docs.hedgedoc.org/configuration/"/>
+        for documentation.
+      '';
    };

    environmentFile = mkOption {
@ -1000,12 +1015,13 @@ in
        Package that provides HedgeDoc.
      '';
    };
+
  };

  config = mkIf cfg.enable {
    assertions = [
-      { assertion = cfg.configuration.db == {} -> (
-          cfg.configuration.dbURL != "" && cfg.configuration.dbURL != null
+      { assertion = cfg.settings.db == {} -> (
+          cfg.settings.dbURL != "" && cfg.settings.dbURL != null
        );
        message = "Database configuration for HedgeDoc missing."; }
    ];
@ -1026,12 +1042,12 @@ in
      preStart = ''
        ${pkgs.envsubst}/bin/envsubst \
          -o ${cfg.workDir}/config.json \
-          -i ${prettyJSON cfg.configuration}
-        mkdir -p ${cfg.configuration.uploadsPath}
+          -i ${prettyJSON cfg.settings}
+        mkdir -p ${cfg.settings.uploadsPath}
      '';
      serviceConfig = {
        WorkingDirectory = cfg.workDir;
-        StateDirectory = [ cfg.workDir cfg.configuration.uploadsPath ];
+        StateDirectory = [ cfg.workDir cfg.settings.uploadsPath ];
        ExecStart = "${cfg.package}/bin/hedgedoc";
        EnvironmentFile = mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
        Environment = [
--- a/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix
+++ b/nixos/modules/system/boot/loader/raspberrypi/raspberrypi.nix
@ -86,7 +86,7 @@ in
        type = types.nullOr types.lines;
        description = ''
          Extra options that will be appended to <literal>/boot/config.txt</literal> file.
-          For possible values, see: https://www.raspberrypi.org/documentation/configuration/config-txt/
+          For possible values, see: https://www.raspberrypi.com/documentation/computers/config_txt.html
        '';
      };
    };
--- a/nixos/modules/system/boot/resolved.nix
+++ b/nixos/modules/system/boot/resolved.nix
@ -1,4 +1,4 @@
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:

 with lib;
 let
@ -178,6 +178,8 @@ in
    # If networkmanager is enabled, ask it to interface with resolved.
    networking.networkmanager.dns = "systemd-resolved";

+    networking.resolvconf.package = pkgs.systemd;
+
  };

 }
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -278,6 +278,7 @@ in {
  libreddit = handleTest ./libreddit.nix {};
  libresprite = handleTest ./libresprite.nix {};
  libreswan = handleTest ./libreswan.nix {};
+  librewolf = handleTest ./firefox.nix { firefoxPackage = pkgs.librewolf; };
  lidarr = handleTest ./lidarr.nix {};
  lightdm = handleTest ./lightdm.nix {};
  limesurvey = handleTest ./limesurvey.nix {};
--- a/nixos/tests/firefox.nix
+++ b/nixos/tests/firefox.nix
@ -1,5 +1,14 @@
-import ./make-test-python.nix ({ pkgs, firefoxPackage, ... }: {
-  name = "firefox";
+import ./make-test-python.nix ({ pkgs, firefoxPackage, ... }:
+let firefoxPackage' = firefoxPackage.override (args: {
+      extraPrefsFiles = (args.extraPrefsFiles or []) ++ [
+        # make sure that autoplay is enabled by default for the audio test
+        (builtins.toString (builtins.toFile "autoplay-pref.js" ''defaultPref("media.autoplay.default",0);''))
+      ];
+  });
+
+in
+{
+  name = firefoxPackage'.unwrapped.binaryName;
  meta = with pkgs.lib.maintainers; {
    maintainers = [ eelco shlevy ];
  };
@ -9,7 +18,7 @@ import ./make-test-python.nix ({ pkgs, firefoxPackage, ... }: {

    { imports = [ ./common/x11.nix ];
      environment.systemPackages = [
-        firefoxPackage
+        firefoxPackage'
        pkgs.xdotool
      ];

@ -88,7 +97,7 @@ import ./make-test-python.nix ({ pkgs, firefoxPackage, ... }: {

      with subtest("Wait until Firefox has finished loading the Valgrind docs page"):
          machine.execute(
-              "xterm -e 'firefox file://${pkgs.valgrind.doc}/share/doc/valgrind/html/index.html' >&2 &"
+              "xterm -e '${firefoxPackage'.unwrapped.binaryName} file://${pkgs.valgrind.doc}/share/doc/valgrind/html/index.html' >&2 &"
          )
          machine.wait_for_window("Valgrind")
          machine.sleep(40)
@ -96,7 +105,7 @@ import ./make-test-python.nix ({ pkgs, firefoxPackage, ... }: {
      with subtest("Check whether Firefox can play sound"):
          with record_audio(machine):
              machine.succeed(
-                  "firefox file://${pkgs.sound-theme-freedesktop}/share/sounds/freedesktop/stereo/phone-incoming-call.oga >&2 &"
+                  "${firefoxPackage'.unwrapped.binaryName} file://${pkgs.sound-theme-freedesktop}/share/sounds/freedesktop/stereo/phone-incoming-call.oga >&2 &"
              )
              wait_for_sound(machine)
          machine.copy_from_vm("/tmp/record.wav")
--- a/nixos/tests/graphite.nix
+++ b/nixos/tests/graphite.nix
@ -12,14 +12,8 @@ import ./make-test-python.nix ({ pkgs, ... } :
              SECRET_KEY = "abcd";
            '';
          };
-          api = {
-            enable = true;
-            port = 8082;
-            finders = [ ];
-          };
          carbon.enableCache = true;
          seyren.enable = false;  # Implicitely requires openssl-1.0.2u which is marked insecure
-          beacon.enable = true;
        };
      };
  };
@ -28,21 +22,15 @@ import ./make-test-python.nix ({ pkgs, ... } :
    start_all()
    one.wait_for_unit("default.target")
    one.wait_for_unit("graphiteWeb.service")
-    one.wait_for_unit("graphiteApi.service")
-    one.wait_for_unit("graphite-beacon.service")
    one.wait_for_unit("carbonCache.service")
    # The services above are of type "simple". systemd considers them active immediately
    # even if they're still in preStart (which takes quite long for graphiteWeb).
    # Wait for ports to open so we're sure the services are up and listening.
    one.wait_for_open_port(8080)
-    one.wait_for_open_port(8082)
    one.wait_for_open_port(2003)
    one.succeed('echo "foo 1 `date +%s`" | nc -N localhost 2003')
    one.wait_until_succeeds(
        "curl 'http://localhost:8080/metrics/find/?query=foo&format=treejson' --silent | grep foo >&2"
    )
-    one.wait_until_succeeds(
-        "curl 'http://localhost:8082/metrics/find/?query=foo&format=treejson' --silent | grep foo >&2"
-    )
  '';
 })
--- a/nixos/tests/hardened.nix
+++ b/nixos/tests/hardened.nix
@ -12,6 +12,11 @@ import ./make-test-python.nix ({ pkgs, ... } : {
      imports = [ ../modules/profiles/hardened.nix ];
      environment.memoryAllocator.provider = "graphene-hardened";
      nix.settings.sandbox = false;
+      nixpkgs.overlays = [
+        (final: super: {
+          dhcpcd = super.dhcpcd.override { enablePrivSep = false; };
+        })
+      ];
      virtualisation.emptyDiskImages = [ 4096 ];
      boot.initrd.postDeviceCommands = ''
        ${pkgs.dosfstools}/bin/mkfs.vfat -n EFISYS /dev/vdb
@ -85,8 +90,8 @@ import ./make-test-python.nix ({ pkgs, ... } : {

      # Test Nix dæmon usage
      with subtest("nix-daemon cannot be used by all users"):
-          machine.fail("su -l nobody -s /bin/sh -c 'nix ping-store'")
-          machine.succeed("su -l alice -c 'nix ping-store'")
+          machine.fail("su -l nobody -s /bin/sh -c 'nix --extra-experimental-features nix-command ping-store'")
+          machine.succeed("su -l alice -c 'nix --extra-experimental-features nix-command ping-store'")


      # Test kernel image protection
--- a/nixos/tests/hedgedoc.nix
+++ b/nixos/tests/hedgedoc.nix
@ -11,7 +11,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
      services = {
        hedgedoc = {
          enable = true;
-          configuration.dbURL = "sqlite:///var/lib/hedgedoc/hedgedoc.db";
+          settings.dbURL = "sqlite:///var/lib/hedgedoc/hedgedoc.db";
        };
      };
    };
@ -21,7 +21,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
      services = {
        hedgedoc = {
          enable = true;
-          configuration.dbURL = "postgres://hedgedoc:\${DB_PASSWORD}@localhost:5432/hedgedocdb";
+          settings.dbURL = "postgres://hedgedoc:\${DB_PASSWORD}@localhost:5432/hedgedocdb";

          /*
           * Do not use pkgs.writeText for secrets as
--- a/nixos/tests/wireguard/wg-quick.nix
+++ b/nixos/tests/wireguard/wg-quick.nix
@ -29,6 +29,8 @@ import ../make-test-python.nix ({ pkgs, lib, ... }:

              inherit (wg-snakeoil-keys.peer1) publicKey;
            };
+
+            dns = [ "10.23.42.2" "fc00::2" "wg0" ];
          };
        };
      };
@ -38,6 +40,7 @@ import ../make-test-python.nix ({ pkgs, lib, ... }:
        ip6 = "fd00::2";
        extraConfig = {
          boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+          networking.useNetworkd = true;
          networking.wg-quick.interfaces.wg0 = {
            address = [ "10.23.42.2/32" "fc00::2/128" ];
            inherit (wg-snakeoil-keys.peer1) privateKey;
@ -49,6 +52,8 @@ import ../make-test-python.nix ({ pkgs, lib, ... }:

              inherit (wg-snakeoil-keys.peer0) publicKey;
            };
+
+            dns = [ "10.23.42.1" "fc00::1" "wg0" ];
          };
        };
      };
--- a/pkgs/applications/audio/bschaffl/default.nix
+++ b/pkgs/applications/audio/bschaffl/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "bschaffl";
-  version = "1.4.8";
+  version = "1.4.10";

  src = fetchFromGitHub {
    owner = "sjaehn";
    repo = pname;
    rev = version;
-    sha256 = "sha256-zczDqJdUAN2oSyIRt9m3OnwOWXlwL4Yod8UMCXs5zM0=";
+    sha256 = "sha256-zfhPYH4eUNWHV27ZtX2IIvobyPdKs5yGr/ryJRQa6as=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/audio/faust/faust2.nix
+++ b/pkgs/applications/audio/faust/faust2.nix
@ -20,13 +20,13 @@ with lib.strings;

 let

-  version = "2.40.0";
+  version = "2.41.1";

  src = fetchFromGitHub {
    owner = "grame-cncm";
    repo = "faust";
    rev = version;
-    sha256 = "sha256-IsrLaoMDwrDPxtqCXIy/7tZCdogTUkJ00obSco9SR/A=";
+    sha256 = "sha256-x0nBWyILrNJijs7CIvRrgYG6vgB3UlxLj9i7E4cHr9I=";
    fetchSubmodules = true;
  };

@ -58,9 +58,10 @@ let
      cd build
    '';

-    cmakeFlags = ''
-      -C ../backends/all.cmake -C  ../targets/all.cmake ..
-    '';
+    cmakeFlags = [
+      "-C../backends/all.cmake"
+      "-C../targets/all.cmake"
+    ];

    postInstall = ''
      # syntax error when eval'd directly
--- a/pkgs/applications/audio/faust/faustlive.nix
+++ b/pkgs/applications/audio/faust/faustlive.nix
@ -5,12 +5,12 @@

 stdenv.mkDerivation rec {
  pname = "faustlive";
-  version = "2.5.10";
+  version = "2.5.11";
  src = fetchFromGitHub {
    owner = "grame-cncm";
    repo = "faustlive";
    rev = version;
-    sha256 = "sha256-yLpIJr6A+NIX9RSGfQXT0O0USuRr0Ni9aUA+mbk31/o=";
+    sha256 = "sha256-ldn6st3/iIABjEfAwodOnPrI97DygWbnYmvMktlOgrk=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/audio/termusic/default.nix
+++ b/pkgs/applications/audio/termusic/default.nix
@ -7,14 +7,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "termusic";
-  version = "0.6.16";
+  version = "0.6.17";

  src = fetchCrate {
    inherit pname version;
-    sha256 = "sha256-2xPm4DahTv3+T92qMYuistfPTlZaJUushP0yrgHYqco=";
+    sha256 = "sha256-diZl+izb55EFQaL6soLVNrFhoi7AOFkFnVcAU2XlI+c=";
  };

-  cargoHash = "sha256-oPRW1x/hXhT8LBW3Z3jMBoal5zC6jKKOTo/RrDwgeJU=";
+  cargoHash = "sha256-VW+tMnjuVnf/PsBAoMnOxbyNna1UpGB/5V52XSzBJr8=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ alsa-lib ];
--- a/pkgs/applications/blockchains/erigon.nix
+++ b/pkgs/applications/blockchains/erigon.nix
@ -2,17 +2,17 @@

 buildGoModule rec {
  pname = "erigon";
-  version = "2022.07.01";
+  version = "2022.07.02";

  src = fetchFromGitHub {
    owner = "ledgerwatch";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-UoK6pPGVeIrubM6vdZBQCE+lgcFthOxZXviyLD86wxg=";
+    sha256 = "sha256-/aT8E60dCk5spj5l5Zw/8FL1LfzXWYi7agiLflLYI5c=";
    fetchSubmodules = true;
  };

-  vendorSha256 = "sha256-lIukjt/QtidijB1KmWQBlSFZqdh1PwhZNP2U73/beiU=";
+  vendorSha256 = "sha256-NBWK0wsUbv4bFbmW3xGaQ7LCgmgfRF5zbc/awm8ZZZY=";
  proxyVendor = true;

  # Build errors in mdbx when format hardening is enabled:
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -10,16 +10,16 @@ let
    inherit tiling_wm;
  };
  stableVersion = {
-    version = "2021.2.1.14"; # "Android Studio Chipmunk (2021.2.1)"
-    sha256Hash = "1cy7ngm160w819ikrd459kg6lnk1k16jjnjm3d0aksmlws5b12z9";
+    version = "2021.2.1.15"; # "Android Studio Chipmunk (2021.2.1)"
+    sha256Hash = "ABjg38DdKSFwBRb3osRDN3xVd4jaf7CkUkPstDAHRb4=";
  };
  betaVersion = {
-    version = "2021.2.1.11"; # "Android Studio Chipmunk (2021.2.1) Beta 4"
-    sha256Hash = "0in8x6v957y9hsnz5ak845pdpvgvnvlm0s6r9y8f27zkm947vbjd";
+    version = "2021.3.1.14"; # "Android Studio Dolphin (2021.3.1) Beta 5"
+    sha256Hash = "k1Qt54u45rwHsQNz9TVqnFB65kBKtfFZ3OknpfutKPI=";
  };
  latestVersion = { # canary & dev
-    version = "2021.3.1.9"; # "Android Studio Dolphin (2021.3.1) Canary 9"
-    sha256Hash = "0nx26xwy67mnbkz37m3nw354siv152sa6zx94pxrvbnxxgppigfb";
+    version = "2022.1.1.8"; # "Android Studio Electric Eel (2022.1.1) Canary 8"
+    sha256Hash = "0bZXx4YpMztLAnwuBaSaNT3GJNfYnqCDanwR+Q7qyUc=";
  };
 in {
  # Attributes are named by their corresponding release channels
--- a/pkgs/applications/editors/notepad-next/default.nix
+++ b/pkgs/applications/editors/notepad-next/default.nix
@ -2,13 +2,13 @@

 mkDerivation rec {
  pname = "notepad-next";
-  version = "0.5.2";
+  version = "0.5.3";

  src = fetchFromGitHub {
    owner = "dail8859";
    repo = "NotepadNext";
    rev = "v${version}";
-    sha256 = "sha256-LyUV85wW6FGlkV0qSIfkLMHpXXj1qvRnGZuYy8ASwZ8=";
+    sha256 = "sha256-9VbtSpWiSVNRydqpTJ0Zd2/9mXy18Drl6q61BHZ0zrs=";
    # External dependencies - https://github.com/dail8859/NotepadNext/issues/135
    fetchSubmodules = true;
  };
--- a/pkgs/applications/editors/vim/plugins/vim-utils.nix
+++ b/pkgs/applications/editors/vim/plugins/vim-utils.nix
@ -33,24 +33,6 @@ vim-with-plugins in PATH:
      # To automatically load a plugin when opening a filetype, add vimrc lines like:
      # autocmd FileType php :packadd phpCompletion
    };
-
-    # plugins can also be managed by VAM
-    vimrcConfig.vam.knownPlugins = pkgs.vimPlugins; # optional
-    vimrcConfig.vam.pluginDictionaries = [
-      # load always
-      { name = "youcompleteme"; }
-      { names = ["youcompleteme" "foo"]; }
-
-      # only load when opening a .php file
-      { name = "phpCompletion"; ft_regex = "^php\$"; }
-      { name = "phpCompletion"; filename_regex = "^.php\$"; }
-
-      # provide plugin which can be loaded manually:
-      { name = "phpCompletion"; tag = "lazy"; }
-
-      # full documentation at github.com/MarcWeber/vim-addon-manager
-    ];
-
  };

 WHAT IS A VIM PLUGIN?
@ -278,7 +260,7 @@ let

        plugins = findDependenciesRecursively (map (pluginToDrv knownPlugins) pathogen.pluginNames);

-        pathogenPackages.pathogen = lib.warn "'pathogen' attribute is deprecated. Use 'packages' instead in your vim configuration" {
+        pathogenPackages.pathogen = {
          start = plugins;
        };
      in
@ -313,71 +295,26 @@ let
         yet

      */
-      vamImpl = lib.optionalString (vam != null)
-      (let
+      vamImpl =
+      let
        knownPlugins = vam.knownPlugins or vimPlugins;

        # plugins specified by the user
        specifiedPlugins = map (pluginToDrv knownPlugins) (lib.concatMap vamDictToNames vam.pluginDictionaries);
        # plugins with dependencies
        plugins = findDependenciesRecursively specifiedPlugins;
-
-        # Convert scalars, lists, and attrs, to VimL equivalents
-        toVimL = x:
-          if builtins.isString x then "'${lib.replaceStrings [ "\n" "'" ] [ "\n\\ " "''" ] x}'"
-          else if builtins.isAttrs x && builtins ? out then toVimL x # a derivation
-          else if builtins.isAttrs x then "{${lib.concatStringsSep ", " (lib.mapAttrsToList (n: v: "${toVimL n}: ${toVimL v}") x)}}"
-          else if builtins.isList x then "[${lib.concatMapStringsSep ", " toVimL x}]"
-          else if builtins.isInt x || builtins.isFloat x then builtins.toString x
-          else if builtins.isBool x then (if x then "1" else "0")
-          else throw "turning ${lib.generators.toPretty {} x} into a VimL thing not implemented yet";
-
-      in assert builtins.hasAttr "vim-addon-manager" knownPlugins;
-      ''
-        filetype indent plugin on | syn on
-
-        let g:nix_plugin_locations = {}
-        ${lib.concatMapStrings (plugin: ''
-          let g:nix_plugin_locations['${plugin.pname}'] = "${plugin.rtp}"
-        '') plugins}
-        let g:nix_plugin_locations['vim-addon-manager'] = "${knownPlugins.vim-addon-manager.rtp}"
-
-        let g:vim_addon_manager = {}
-
-        if exists('g:nix_plugin_locations')
-          " nix managed config
-
-          " override default function making VAM aware of plugin locations:
-          fun! NixPluginLocation(name)
-            let path = get(g:nix_plugin_locations, a:name, "")
-            return path == "" ? vam#DefaultPluginDirFromName(a:name) : path
-          endfun
-          let g:vim_addon_manager.plugin_dir_by_name = 'NixPluginLocation'
-          " tell Vim about VAM:
-          let &rtp.=(empty(&rtp)?"":','). g:nix_plugin_locations['vim-addon-manager']
-        else
-          " standalone config
-
-          let &rtp.=(empty(&rtp)?"":',').c.plugin_root_dir.'/vim-addon-manager'
-          if !isdirectory(c.plugin_root_dir.'/vim-addon-manager/autoload')
-            " checkout VAM
-            execute '!git clone --depth=1 https://github.com/MarcWeber/vim-addon-manager '
-                \       shellescape(c.plugin_root_dir.'/vim-addon-manager', 1)
-          endif
-        endif
-
-        " tell vam which plugins to load, and when:
-        let l = []
-        ${lib.concatMapStrings (p: "call add(l, ${toVimL p})\n") vam.pluginDictionaries}
-        call vam#Scripts(l, {})
-      '');
+        vamPackages.vam =  {
+          start = plugins;
+        };
+      in
+        nativeImpl vamPackages;

      entries = [
        beforePlugins
-        vamImpl
      ]
+      ++ lib.optional (vam != null) (lib.warn "'vam' attribute is deprecated. Use 'packages' instead in your vim configuration" vamImpl)
      ++ lib.optional (packages != null && packages != []) (nativeImpl packages)
-      ++ lib.optional (pathogen != null) pathogenImpl
+      ++ lib.optional (pathogen != null) (lib.warn "'pathogen' attribute is deprecated. Use 'packages' instead in your vim configuration" pathogenImpl)
      ++ lib.optional (plug != null) plugImpl
      ++ [ customRC ];

@ -468,37 +405,6 @@ rec {

  vimWithRC = throw "vimWithRC was removed, please use vim.customize instead";

-  pluginnames2Nix = {name, namefiles} : vim_configurable.customize {
-    inherit name;
-    vimrcConfig.vam.knownPlugins = vimPlugins;
-    vimrcConfig.vam.pluginDictionaries = ["vim2nix"];
-    vimrcConfig.customRC = ''
-      " Yes - this is impure and will create the cache file and checkout vim-pi
-      " into ~/.vim/vim-addons
-      let g:vim_addon_manager.plugin_root_dir = "/tmp/vim2nix-".$USER
-      if !isdirectory(g:vim_addon_manager.plugin_root_dir)
-        call mkdir(g:vim_addon_manager.plugin_root_dir)
-      else
-        echom repeat("=", 80)
-        echom "WARNING: reusing cache directory :".g:vim_addon_manager.plugin_root_dir
-        echom repeat("=", 80)
-      endif
-      let opts = {}
-      let opts.nix_prefetch_git = "${nix-prefetch-git}/bin/nix-prefetch-git"
-      let opts.nix_prefetch_hg  = "${nix-prefetch-hg}/bin/nix-prefetch-hg"
-      let opts.cache_file = g:vim_addon_manager.plugin_root_dir.'/cache'
-      let opts.plugin_dictionaries = []
-      ${lib.concatMapStrings (file: "let opts.plugin_dictionaries += map(readfile(\"${file}\"), 'eval(v:val)')\n") namefiles }
-
-      " uncomment for debugging failures
-      " let opts.try_catch = 0
-
-      " add more files
-      " let opts.plugin_dictionaries += map(.. other file )
-      call nix#ExportPluginsForNix(opts)
-    '';
-  };
-
  vimGenDocHook = callPackage ({ vim }:
    makeSetupHook {
      name = "vim-gen-doc-hook";
--- a/pkgs/applications/misc/sigal/default.nix
+++ b/pkgs/applications/misc/sigal/default.nix
@ -36,12 +36,15 @@ python3.pkgs.buildPythonApplication rec {
    pytestCheckHook
  ]);

+  disabledTests = lib.optionals stdenv.isDarwin [
+    "test_nonmedia_files"
+  ];
+
  makeWrapperArgs = [
    "--prefix PATH : ${lib.makeBinPath [ ffmpeg ]}"
  ];

  meta = with lib; {
-    broken = stdenv.isDarwin;
    description = "Yet another simple static gallery generator";
    homepage = "http://sigal.saimon.org/";
    license = licenses.mit;
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -45,9 +45,9 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "103.0.5060.53",
-    "sha256": "00di0nw6h3kb0qp2wp3ny3zsar1ayn1lyx5zr28dl1h5cwaaxjqf",
-    "sha256bin64": "19wxd4jl6fyjpcpy2331ckz6dgzrfj52wvdkp0kb18n0sym17fyn",
+    "version": "103.0.5060.114",
+    "sha256": "0rarcd2q1ggl10cw3vwjk7j9aka7i129a0qv8qr7751vy083as3p",
+    "sha256bin64": "1qxbnnnq0miizazprwynvxxvgaaw9dd9y7bssybvmga3g2c00fk9",
    "deps": {
      "gn": {
        "version": "2022-05-11",
@ -56,8 +56,8 @@
        "sha256": "03dqfrdpf5xxl64dby3qmbwpzdq2gsa8g7xl438py3a629rgxg63"
      },
      "ungoogled-patches": {
-        "rev": "103.0.5060.53-1",
-        "sha256": "1g5ciwzrhg9g13gvhrwqf19djk9jhj1d6nx2f6a8d5ch1mhi2z8s"
+        "rev": "103.0.5060.114-1",
+        "sha256": "11i7d480q21vcd9p14rc7rb408xwlg2nkj88dq0sfj2rz60lzy0a"
      }
    }
  }
--- a/pkgs/applications/networking/browsers/librewolf/default.nix
+++ b/pkgs/applications/networking/browsers/librewolf/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, callPackage, buildMozillaMach }:
+{ stdenv, lib, callPackage, buildMozillaMach, nixosTests }:

 let
  librewolf-src = callPackage ./librewolf.nix { };
@ -22,6 +22,7 @@ in
    maxSilent = 14400; # 4h, double the default of 7200s (c.f. #129212, #129115)
    license = lib.licenses.mpl20;
  };
+  tests = [ nixosTests.librewolf ];
  updateScript = callPackage ./update.nix {
    attrPath = "librewolf-unwrapped";
  };
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@ -60,6 +60,7 @@ let
  special-providers =
    {
      brightbox = automated-providers.brightbox.override { mkProviderGoModule = buildGo118Module; };
+      hcloud = automated-providers.hcloud.override { mkProviderGoModule = buildGo118Module; };
      # mkisofs needed to create ISOs holding cloud-init data,
      # and wrapped to terraform via deecb4c1aab780047d79978c636eeb879dd68630
      libvirt = automated-providers.libvirt.overrideAttrs (_: { propagatedBuildInputs = [ cdrtools ]; });
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -12,10 +12,10 @@
    "owner": "vancluever",
    "provider-source-address": "registry.terraform.io/vancluever/acme",
    "repo": "terraform-provider-acme",
-    "rev": "v2.9.0",
-    "sha256": "sha256-ptWoKXuV6jcDu2v1oOcW11VjXOgf/jUG1kpFGcNLHtw=",
-    "vendorSha256": "sha256-sU8g+mjn14H9f3LwomcNJ7ho8LpYjCEevv4++6KPzow=",
-    "version": "2.9.0"
+    "rev": "v2.10.0",
+    "sha256": "sha256-nafJJ2Gr2jA09mjh8hozdDgl67h+10D35KtqjTUPgBE=",
+    "vendorSha256": "sha256-lNI0u8DCBl4mGVecRfAqieCooyJlqK+Z4eixPFFyBuU=",
+    "version": "2.10.0"
  },
  "age": {
    "owner": "clementblaise",
@ -76,10 +76,10 @@
    "owner": "auth0",
    "provider-source-address": "registry.terraform.io/auth0/auth0",
    "repo": "terraform-provider-auth0",
-    "rev": "v0.31.0",
-    "sha256": "sha256-Huv+eL/5RiI2A1X8RLU9LbIWMjb5yuuslV4CaP/kFiQ=",
-    "vendorSha256": "sha256-kTR8kSirqhY1GdKLzeFIPt6QNJ4wq2ESUT5ShQUhvRI=",
-    "version": "0.31.0"
+    "rev": "v0.32.0",
+    "sha256": "sha256-zy5brS1KsQM8JZahcmIsBdUS389OoQ53d4OGHpF6zwo=",
+    "vendorSha256": "sha256-xQEgoYPXt3ivgOMk+yQMS0SlPhDJ5qCVsI12LMU6ZcI=",
+    "version": "0.32.0"
  },
  "avi": {
    "owner": "vmware",
@ -103,28 +103,28 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/aws",
    "repo": "terraform-provider-aws",
-    "rev": "v4.21.0",
-    "sha256": "sha256-XqUJGcKQh2QfKjiIcJ02ZUZ+pKUZAaYErIdVRCKLAKM=",
-    "vendorSha256": "sha256-KimkmnSGgynmxS3VcmNP4d+B6j1xy4+OZXkoG2iIS/w=",
-    "version": "4.21.0"
+    "rev": "v4.22.0",
+    "sha256": "sha256-F+YzXIKkF/eGUY3l8MjeP+8GqS37e1N9b+fmNCkdeMM=",
+    "vendorSha256": "sha256-kz0bPsfLCekRj/ZGCBT+eFRMRkV+Dc69RkyBbFaztd0=",
+    "version": "4.22.0"
  },
  "azuread": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/azuread",
    "repo": "terraform-provider-azuread",
-    "rev": "v2.25.0",
-    "sha256": "sha256-+9h9rdbnqIul+V/fhrsNEq/cX24i05i2LBqIk6g9mRE=",
+    "rev": "v2.26.0",
+    "sha256": "sha256-M61kkeBRLb0fDPH1FZH5koFRZqCVfTlEXJ8N0Amc8ac=",
    "vendorSha256": null,
-    "version": "2.25.0"
+    "version": "2.26.0"
  },
  "azurerm": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/azurerm",
    "repo": "terraform-provider-azurerm",
-    "rev": "v3.12.0",
-    "sha256": "sha256-P/KFdDGDUJofsOEnPUJ3rAdZHoJw8YF3ReQFdSsMUj4=",
+    "rev": "v3.13.0",
+    "sha256": "sha256-ptEsCgJsB++RYtc+SekUPoV9ONRfGCCoPGM6alwQ/wY=",
    "vendorSha256": null,
-    "version": "3.12.0"
+    "version": "3.13.0"
  },
  "azurestack": {
    "owner": "hashicorp",
@ -140,10 +140,10 @@
    "owner": "baidubce",
    "provider-source-address": "registry.terraform.io/baidubce/baiducloud",
    "repo": "terraform-provider-baiducloud",
-    "rev": "v1.12.9",
-    "sha256": "sha256-RKkTKRipmTqAfCGWzibrIsTrckwvEKCQmPhNjCXmFR4=",
-    "vendorSha256": "sha256-pA2dAC8AasWLTlC+SddS4kWT16FqcyBrtdVMV9k/FtE=",
-    "version": "1.12.9"
+    "rev": "v1.13.0",
+    "sha256": "sha256-C/dvFwtqOJAXgk5CNr06cehOiVZ2c4Zcqcb+g/k0iPY=",
+    "vendorSha256": "sha256-GZZKJkK9ug6iUhaAXxR2nKfQQ96MHiYv/hsaB5O9Oig=",
+    "version": "1.13.0"
  },
  "bigip": {
    "owner": "F5Networks",
@ -185,10 +185,10 @@
    "owner": "checkly",
    "provider-source-address": "registry.terraform.io/checkly/checkly",
    "repo": "terraform-provider-checkly",
-    "rev": "v1.6.0",
-    "sha256": "sha256-zmA6fVpXW4HOJaZzmv5K6cbmO2vM3yGWsa9TSYY4obY=",
+    "rev": "v1.6.1",
+    "sha256": "sha256-vzYOieW4KdYcaPSSa6j57GsPAAIdwmWu5hIBCCmnstM=",
    "vendorSha256": "sha256-VnYRDBneQ+bUzISJM9DJdBEBmjA1WOXPo+kaYBW4w4U=",
-    "version": "1.6.0"
+    "version": "1.6.1"
  },
  "checkpoint": {
    "deleteVendor": true,
@ -367,10 +367,10 @@
    "owner": "equinix",
    "provider-source-address": "registry.terraform.io/equinix/equinix",
    "repo": "terraform-provider-equinix",
-    "rev": "v1.6.0",
-    "sha256": "sha256-wvx0dZS38i5B7Jpaaa9iuv93PyzNAaKCxxU8OxklOhE=",
-    "vendorSha256": "sha256-tWMmwCFWwRvsFC/Bu4Eax+uopxN3ijRP9qr35bcg6qQ=",
-    "version": "1.6.0"
+    "rev": "v1.6.1",
+    "sha256": "sha256-QktIBtSz7UZoU6+z/sjpU4bZhc+Cw1BptO6hW19uJoU=",
+    "vendorSha256": "sha256-G1lDfygJnuJaQ4ms2/R6oynZCJAtIwx7xoU6Bec3CfQ=",
+    "version": "1.6.1"
  },
  "exoscale": {
    "owner": "exoscale",
@ -394,10 +394,10 @@
    "owner": "fastly",
    "provider-source-address": "registry.terraform.io/fastly/fastly",
    "repo": "terraform-provider-fastly",
-    "rev": "v2.1.0",
-    "sha256": "sha256-d6hi8b8KdCBHvb3pRR5UB+jC81aVYnj1RgzOI6wO6jA=",
+    "rev": "v2.2.0",
+    "sha256": "sha256-x5Rl4JW59kuAoX0pSpCpto3dcvyEhvZlocg8fv2R6Jw=",
    "vendorSha256": null,
-    "version": "2.1.0"
+    "version": "2.2.0"
  },
  "flexibleengine": {
    "owner": "FlexibleEngineCloud",
@ -439,10 +439,10 @@
    "owner": "gitlabhq",
    "provider-source-address": "registry.terraform.io/gitlabhq/gitlab",
    "repo": "terraform-provider-gitlab",
-    "rev": "v3.15.1",
-    "sha256": "sha256-10dxre+HwpXZ//+PfQvAa3bipHCaJ4+dgaMXiTkSS04=",
-    "vendorSha256": "sha256-uc29HXlsMRn/MuXlOfYIr49NtfN1goL4y22EX3farBU=",
-    "version": "3.15.1"
+    "rev": "v3.16.0",
+    "sha256": "sha256-RG1d0B6SdT3c9zIHtOZUZBHOdi7azc9uJe0aDdY5c/U=",
+    "vendorSha256": "sha256-5OXllLq5VjFpay2vVEXczqvSmgLeAQ66fXqYf+eDJOI=",
+    "version": "3.16.0"
  },
  "google": {
    "owner": "hashicorp",
@ -495,10 +495,10 @@
    "owner": "hetznercloud",
    "provider-source-address": "registry.terraform.io/hetznercloud/hcloud",
    "repo": "terraform-provider-hcloud",
-    "rev": "v1.34.1",
-    "sha256": "sha256-+Duv9D4yG2bS9xGJIfA86nSpPk6TFuGjk8CZp5dUigU=",
-    "vendorSha256": "sha256-fFQte/gp/PY/cdTS6ehoqgNYvCqRj88cOLGzf5bxn+U=",
-    "version": "1.34.1"
+    "rev": "v1.34.3",
+    "sha256": "sha256-3p7pdpBxrbKZx6di39GQb2DOS2ZtN4uVmIb2OU0Zs+c=",
+    "vendorSha256": "sha256-3JFdsuJlDW6xTgSgn7hkIWfH9Iqr35t8op4yVXYIFpg=",
+    "version": "1.34.3"
  },
  "helm": {
    "owner": "hashicorp",
@ -648,10 +648,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/kubernetes",
    "repo": "terraform-provider-kubernetes",
-    "rev": "v2.12.0",
-    "sha256": "sha256-MmXJutHh1M/KLJvF8h8hFrihiTOUDxwuXPtxeUvUgAw=",
+    "rev": "v2.12.1",
+    "sha256": "sha256-wswBD4XqtHZsg8vhxIqtjZkXNhFLu/nHUCJDW/24dbQ=",
    "vendorSha256": null,
-    "version": "2.12.0"
+    "version": "2.12.1"
  },
  "launchdarkly": {
    "owner": "launchdarkly",
@ -756,10 +756,10 @@
    "owner": "mongodb",
    "provider-source-address": "registry.terraform.io/mongodb/mongodbatlas",
    "repo": "terraform-provider-mongodbatlas",
-    "rev": "v1.3.1",
-    "sha256": "sha256-X2Utt+MUboLc0/nAXB78ko3w2ieTIQaVsDK6MhbUKSQ=",
-    "vendorSha256": "sha256-yZ/TgAVlBxHhrrZU6SH1KXNoZj8oWRqx3BjVHkTtI+Q=",
-    "version": "1.3.1"
+    "rev": "v1.4.2",
+    "sha256": "sha256-bu/DpqeOIIgtUauBVzbKW+DHJUoD2oVhIhmk+M7fcBg=",
+    "vendorSha256": "sha256-yomqc0uxB02zi/IfZKIOBq3mcs0GkHbRpaQos0jcELw=",
+    "version": "1.4.2"
  },
  "namecheap": {
    "owner": "namecheap",
@ -838,28 +838,28 @@
    "owner": "nutanix",
    "provider-source-address": "registry.terraform.io/nutanix/nutanix",
    "repo": "terraform-provider-nutanix",
-    "rev": "v1.5.0",
-    "sha256": "sha256-H8wLMLBB4pSbiilmP9C0WPn62fCYHgPhy8OlvtrUYro=",
+    "rev": "v1.6.1",
+    "sha256": "sha256-eqWx48ARoL2elnaqTgp/L6a0K8TFSvIFaNH72gdbrZA=",
    "vendorSha256": "sha256-LRIfxQGwG988HE5fftGl6JmBG7tTknvmgpm4Fu1NbWI=",
-    "version": "1.5.0"
+    "version": "1.6.1"
  },
  "oci": {
    "owner": "oracle",
    "provider-source-address": "registry.terraform.io/oracle/oci",
    "repo": "terraform-provider-oci",
-    "rev": "v4.82.0",
-    "sha256": "sha256-S/UraZfbirBkUjLQQO+6imvNVGRu+lzENIWKlobHdGw=",
+    "rev": "v4.83.0",
+    "sha256": "sha256-WuvWE3k2j1whH7UaEx7fa4lZF+GZUKp7T1bVpatxF1w=",
    "vendorSha256": null,
-    "version": "4.82.0"
+    "version": "4.83.0"
  },
  "okta": {
    "owner": "okta",
    "provider-source-address": "registry.terraform.io/okta/okta",
    "repo": "terraform-provider-okta",
-    "rev": "v3.30.0",
-    "sha256": "sha256-iE+lLWnVwb5jUt4EsNc3jZqQ4HEtjE8GB2RniKGegy0=",
-    "vendorSha256": "sha256-9Qz3uGI2x40XL8JAB9l3Lsw6OQ47sHEBFVJNgsbVt/c=",
-    "version": "3.30.0"
+    "rev": "v3.31.0",
+    "sha256": "sha256-IUCiImmT4LG58r342mvWVMxBjVO9zGX8BVHe5G1GiMg=",
+    "vendorSha256": "sha256-BnxtHEd1C0DOUPVggPCXSBtQ36gcNwL7Hl0Pl1B5e4U=",
+    "version": "3.31.0"
  },
  "oktaasa": {
    "owner": "oktadeveloper",
@ -874,10 +874,10 @@
    "owner": "OpenNebula",
    "provider-source-address": "registry.terraform.io/OpenNebula/opennebula",
    "repo": "terraform-provider-opennebula",
-    "rev": "v0.5.0",
-    "sha256": "sha256-MJQQyU+NmLbIWSQY1BqWKY7q9RrF+HAFIr8AFNg2dWc=",
+    "rev": "v0.5.1",
+    "sha256": "sha256-lrdL0aWgrODvgI0gUW1tmHEHldeD5jJzOCD2BMvGPM8=",
    "vendorSha256": "sha256-NOIXn4RWMUz0invWRqAHxVWez7MD0DyWccwcKYz8jTY=",
-    "version": "0.5.0"
+    "version": "0.5.1"
  },
  "openstack": {
    "owner": "terraform-provider-openstack",
@ -892,10 +892,10 @@
    "owner": "opentelekomcloud",
    "provider-source-address": "registry.terraform.io/opentelekomcloud/opentelekomcloud",
    "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.29.8",
-    "sha256": "sha256-oIJ+ygunt8ilW3IfnR0sAvwLOxknt7BN5Ks63tJMbQ4=",
-    "vendorSha256": "sha256-1z5SaH6AoYkrMZVnNurZLmtvVRDNwTBwmQMX0KngKpA=",
-    "version": "1.29.8"
+    "rev": "v1.29.9",
+    "sha256": "sha256-jVDpiNGGw93XLAMYaDrO3mEcok3bnzC4y9tz6C27lhM=",
+    "vendorSha256": "sha256-ImrWG+IPNkFr9lTGdiYaBU2OnHrKXIiNIDGSy4Br+Aw=",
+    "version": "1.29.9"
  },
  "opsgenie": {
    "owner": "opsgenie",
@ -1090,10 +1090,10 @@
    "owner": "spotinst",
    "provider-source-address": "registry.terraform.io/spotinst/spotinst",
    "repo": "terraform-provider-spotinst",
-    "rev": "v1.78.0",
-    "sha256": "sha256-Irbjqp4Yoa8+nNxCLdXvFTCQZhRWUcXK9WfqayIIiPU=",
-    "vendorSha256": "sha256-uXRatEtZMP6V1yJQHSjbWNXKf/DGLTvkCZM7LhbbElU=",
-    "version": "1.78.0"
+    "rev": "v1.79.0",
+    "sha256": "sha256-UOqXUUqbZ7qVlqFI1YABahfW4+ghyMS7n2Yc9Lfd6cc=",
+    "vendorSha256": "sha256-AJfQhIsh7a1WVQ//oT6P12H/sqmGtKD7jwW3JthvVNQ=",
+    "version": "1.79.0"
  },
  "stackpath": {
    "owner": "stackpath",
@ -1126,19 +1126,19 @@
    "owner": "tencentcloudstack",
    "provider-source-address": "registry.terraform.io/tencentcloudstack/tencentcloud",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.75.5",
-    "sha256": "sha256-tDdNkDtUuwtOrbvdR/NPUXpsyrRsES4MtreOKD7/PYc=",
+    "rev": "v1.75.7",
+    "sha256": "sha256-FSdBAaG1xrr0Jnl7wPsaooraerlqKti5uskZyixkbSY=",
    "vendorSha256": null,
-    "version": "1.75.5"
+    "version": "1.75.7"
  },
  "tfe": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/tfe",
    "repo": "terraform-provider-tfe",
-    "rev": "v0.32.1",
-    "sha256": "sha256-7a2uc0f7+OFrbCvHJkKyeX7hXR63PpzpfNhUCWHqOxU=",
-    "vendorSha256": "sha256-V1nXhDwDMWJsbhPu9otXrOmtzVv0rjvL7CH/13AR5iw=",
-    "version": "0.32.1"
+    "rev": "v0.33.0",
+    "sha256": "sha256-OmQQau3nr84sSIiCGeoi2vDvvoK2L7Zve2tzuul0Wyg=",
+    "vendorSha256": "sha256-IeteO1xIpEwdfHGkz9SKy5EZJCHsHho2L02O6yWzoTk=",
+    "version": "0.33.0"
  },
  "thunder": {
    "owner": "a10networks",
--- a/pkgs/applications/science/electronics/gaw/default.nix
+++ b/pkgs/applications/science/electronics/gaw/default.nix
@ -19,7 +19,6 @@ stdenv.mkDerivation rec {
  buildInputs = [ gtk3 ];

  meta = with lib; {
-    broken = stdenv.isDarwin;
    description = "Gtk Analog Wave viewer";
    longDescription = ''
      Gaw is a software tool for displaying analog waveforms from
@ -30,6 +29,6 @@ stdenv.mkDerivation rec {
    homepage = "http://gaw.tuxfamily.org";
    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ fbeffa ];
-    platforms = platforms.all;
+    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@ -8,10 +8,10 @@
 { lib, stdenv, fetchzip, writeText, pkg-config, gnumake42
 , customOCamlPackages ? null
 , ocamlPackages_4_05, ocamlPackages_4_09, ocamlPackages_4_10, ocamlPackages_4_12, ncurses
-, buildIde ? true
+, buildIde ? null # default is true for Coq < 8.14 and false for Coq >= 8.14
 , glib, gnome, wrapGAppsHook, makeDesktopItem, copyDesktopItems
 , csdp ? null
-, version, coq-version ? null,
+, version, coq-version ? null
 }@args:
 let lib' = lib; in
 let lib = import ../../../../build-support/coq/extra-lib.nix {lib = lib';}; in
@ -59,6 +59,7 @@ let
  version = fetched.version;
  coq-version = args.coq-version or (if version != "dev" then versions.majorMinor version else "dev");
  coqAtLeast = v: coq-version == "dev" || versionAtLeast coq-version v;
+  buildIde = args.buildIde or (!coqAtLeast "8.14");
  ideFlags = optionalString (buildIde && !coqAtLeast "8.10")
    "-lablgtkdir ${ocamlPackages.lablgtk}/lib/ocaml/*/site-lib/lablgtk2 -coqide opt";
  csdpPatch = if csdp != null then ''
--- a/pkgs/applications/science/math/ginac/default.nix
+++ b/pkgs/applications/science/math/ginac/default.nix
@ -25,7 +25,6 @@ stdenv.mkDerivation rec {
  configureFlags = [ "--disable-rpath" ];

  meta = with lib; {
-    broken = stdenv.isDarwin;
    description = "GiNaC is Not a CAS";
    homepage = "https://www.ginac.de/";
    maintainers = with maintainers; [ lovek323 ];
--- a/pkgs/applications/science/math/singular/default.nix
+++ b/pkgs/applications/science/math/singular/default.nix
@ -24,7 +24,7 @@

 stdenv.mkDerivation rec {
  pname = "singular";
-  version = "4.3.0";
+  version = "4.3.1";

  # since the tarball does not contain tests, we fetch from GitHub.
  src = fetchFromGitHub {
@ -33,9 +33,8 @@ stdenv.mkDerivation rec {

    # if a release is tagged (which sometimes does not happen), it will
    # be in the format below.
-    # rev = "Release-${lib.replaceStrings ["."] ["-"] version}";
-    rev = "d895b0f1f543c61eb03adddad20f08655a419d4e";
-    sha256 = "sha256-c5Qr6VUuPKjfw8fowjJJz3oGAyUwo/K0WeMvU5djzVA=";
+    rev = "Release-${lib.replaceStrings ["."] ["-"] version}";
+    sha256 = "sha256-3r3epwaVbyveyYtmfxuevO4Q52J6FbI6RRqiaHQGJIk=";

    # the repository's .gitattributes file contains the lines "/Tst/
    # export-ignore" and "/doc/ export-ignore" so some directories are
--- a/pkgs/applications/version-management/git-and-tools/git-extras/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-extras/default.nix
@ -1,4 +1,10 @@
-{ lib, stdenv, fetchFromGitHub, unixtools, which }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchpatch
+, unixtools
+, which
+}:

 stdenv.mkDerivation rec {
  pname = "git-extras";
@ -11,6 +17,13 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-Cn7IXMzgg0QIsNIHz+X14Gkmop0UbsSBlGlGkmg71ek=";
  };

+  patches = [
+    (fetchpatch {
+      url = "https://github.com/tj/git-extras/commit/66961ad4911cd0f1a908530f2b725bacc7d198e1.patch";
+      sha256 = "sha256-iC1lUf/NmuAPADxDWZ2JScHIMgYjIaR0edlGpq0qCOc=";
+    })
+  ];
+
  postPatch = ''
    patchShebangs check_dependencies.sh
  '';
--- a/pkgs/data/icons/papirus-icon-theme/default.nix
+++ b/pkgs/data/icons/papirus-icon-theme/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "papirus-icon-theme";
-  version = "20220606";
+  version = "20220710";

  src = fetchFromGitHub {
    owner = "PapirusDevelopmentTeam";
    repo = pname;
    rev = version;
-    sha256 = "sha256-HJb77ArzwMX9ZYTp0Ffxxtst1/xhPAa+eEP5n950DSs=";
+    sha256 = "sha256-CInoUlWMmLwc4mMi1krmXr2a2JCWZ7XcPe20wFSNjqk=";
  };

  nativeBuildInputs = [ gtk3 papirus-folders ];
--- a/pkgs/data/themes/arc-kde/default.nix
+++ b/pkgs/data/themes/arc-kde/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "arc-kde-theme";
-  version = "20180614";
+  version = "20220706";

  src = fetchFromGitHub {
    owner = "PapirusDevelopmentTeam";
    repo = "arc-kde";
    rev = version;
-    sha256 = "0wli16k9my7m8a9561545vjwfifmxm4w606z1h0j08msvlky40xw";
+    sha256 = "sha256-k/+VhqvOg3wkqal7q7nSVpubK/yHnNoTUUWhnxwcIjM=";
  };

  makeFlags = [ "PREFIX=$(out)" ];
--- a/pkgs/development/compilers/carp/default.nix
+++ b/pkgs/development/compilers/carp/default.nix
@ -2,13 +2,13 @@

 haskellPackages.mkDerivation rec {
  pname = "carp";
-  version = "0.5.4";
+  version = "0.5.5";

  src = fetchFromGitHub {
    owner = "carp-lang";
    repo = "Carp";
    rev = "v${version}";
-    sha256 = "sha256-o7NLd7jC1BvcoVzbD18LvHg/SqOnfn9yELUrpg2uZtY=";
+    sha256 = "sha256-B7SBzjegFzL2gGivIJE6BZcLD3f0Bsh8yndjScG2TZI=";
  };

  # -Werror breaks build with GHC >= 9.0
--- a/pkgs/development/compilers/elm/packages/node-composition.nix
+++ b/pkgs/development/compilers/elm/packages/node-composition.nix
@ -2,7 +2,7 @@

 {pkgs ? import <nixpkgs> {
    inherit system;
-  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-14_x"}:
+  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-12_x"}:

 let
  nodeEnv = import ../../../node-packages/node-env.nix {
--- a/pkgs/development/compilers/elm/packages/node-packages.nix
+++ b/pkgs/development/compilers/elm/packages/node-packages.nix
--- a/pkgs/development/compilers/gcc/12/PR106102-musl-poison-cpp.patch
+++ b/pkgs/development/compilers/gcc/12/PR106102-musl-poison-cpp.patch
@ -0,0 +1,52 @@
+https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=3b21c21f3f5726823e19728fdd1571a14aae0fb3
+https://gcc.gnu.org/PR106102
+--- a/gcc/cp/mapper-client.cc
+++ b/gcc/cp/mapper-client.cc
+@@ -27,6 +27,7 @@ along with GCC; see the file COPYING3.  If not see
+ #define INCLUDE_STRING
+ #define INCLUDE_VECTOR
+ #define INCLUDE_MAP
+#define INCLUDE_MEMORY
+ #include "system.h"
+ 
+ #include "line-map.h"
+--- a/gcc/cp/mapper-resolver.cc
+++ b/gcc/cp/mapper-resolver.cc
+@@ -25,6 +25,7 @@ along with GCC; see the file COPYING3.  If not see
+ #define INCLUDE_VECTOR
+ #define INCLUDE_ALGORITHM
+ #define INCLUDE_MAP
+#define INCLUDE_MEMORY
+ #include "system.h"
+ 
+ // We don't want or need to be aware of networking
+--- a/gcc/cp/module.cc
+++ b/gcc/cp/module.cc
+@@ -206,6 +206,7 @@ Classes used:
+ 
+ #define _DEFAULT_SOURCE 1 /* To get TZ field of struct tm, if available.  */
+ #include "config.h"
+#define INCLUDE_MEMORY
+ #define INCLUDE_STRING
+ #define INCLUDE_VECTOR
+ #include "system.h"
+--- a/libcc1/libcc1plugin.cc
+++ b/libcc1/libcc1plugin.cc
+@@ -31,6 +31,7 @@
+ #undef PACKAGE_TARNAME
+ #undef PACKAGE_VERSION
+ 
+#define INCLUDE_MEMORY
+ #include "gcc-plugin.h"
+ #include "system.h"
+ #include "coretypes.h"
+--- a/libcc1/libcp1plugin.cc
+++ b/libcc1/libcp1plugin.cc
+@@ -32,6 +32,7 @@
+ #undef PACKAGE_TARNAME
+ #undef PACKAGE_VERSION
+ 
+#define INCLUDE_MEMORY
+ #include "gcc-plugin.h"
+ #include "system.h"
+ #include "coretypes.h"
--- a/pkgs/development/compilers/gcc/12/PR106102-musl-poison-jit.patch
+++ b/pkgs/development/compilers/gcc/12/PR106102-musl-poison-jit.patch
@ -0,0 +1,67 @@
+https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=49d508065bdd36fb1a9b6aad9666b1edb5e06474
+https://gcc.gnu.org/PR106102
+--- a/gcc/jit/jit-playback.cc
+++ b/gcc/jit/jit-playback.cc
+@@ -19,6 +19,7 @@ along with GCC; see the file COPYING3.  If not see
+ <http://www.gnu.org/licenses/>.  */
+ 
+ #include "config.h"
+#define INCLUDE_PTHREAD_H
+ #include "system.h"
+ #include "coretypes.h"
+ #include "target.h"
+@@ -41,8 +42,6 @@ along with GCC; see the file COPYING3.  If not see
+ #include "diagnostic.h"
+ #include "stmt.h"
+ 
+-#include <pthread.h>
+-
+ #include "jit-playback.h"
+ #include "jit-result.h"
+ #include "jit-builtins.h"
+--- a/gcc/jit/jit-recording.cc
+++ b/gcc/jit/jit-recording.cc
+@@ -19,13 +19,13 @@ along with GCC; see the file COPYING3.  If not see
+ <http://www.gnu.org/licenses/>.  */
+ 
+ #include "config.h"
+#define INCLUDE_PTHREAD_H
+ #include "system.h"
+ #include "coretypes.h"
+ #include "tm.h"
+ #include "pretty-print.h"
+ #include "toplev.h"
+ 
+-#include <pthread.h>
+ 
+ #include "jit-builtins.h"
+ #include "jit-recording.h"
+--- a/gcc/jit/libgccjit.cc
+++ b/gcc/jit/libgccjit.cc
+@@ -19,12 +19,12 @@ along with GCC; see the file COPYING3.  If not see
+ <http://www.gnu.org/licenses/>.  */
+ 
+ #include "config.h"
+#define INCLUDE_PTHREAD_H
+ #include "system.h"
+ #include "coretypes.h"
+ #include "timevar.h"
+ #include "typed-splay-tree.h"
+ #include "cppbuiltin.h"
+-#include <pthread.h>
+ 
+ #include "libgccjit.h"
+ #include "jit-recording.h"
+--- a/gcc/system.h
+++ b/gcc/system.h
+@@ -753,6 +753,10 @@ extern int vsnprintf (char *, size_t, const char *, va_list);
+ #endif
+ #endif
+ 
+#ifdef INCLUDE_PTHREAD_H
+#include <pthread.h>
+#endif
+
+ #ifdef INCLUDE_ISL
+ #ifdef HAVE_isl
+ #include <isl/options.h>
--- a/pkgs/development/compilers/gcc/12/default.nix
+++ b/pkgs/development/compilers/gcc/12/default.nix
@ -69,6 +69,9 @@ let majorVersion = "12";
        ../gnat-cflags-11.patch
        ../gcc-12-gfortran-driving.patch
        ../ppc-musl.patch
+        # Backports. Should be removed with 12.2.0 release:
+        ./PR106102-musl-poison-cpp.patch
+        ./PR106102-musl-poison-jit.patch
      ] ++ optional (stdenv.isDarwin && stdenv.isAarch64) (fetchpatch {
        url = "https://github.com/fxcoudert/gcc/compare/releases/gcc-11.1.0...gcc-11.1.0-arm-20210504.diff";
        sha256 = "sha256-JqCGJAfbOxSmkNyq49aFHteK/RFsCSLQrL9mzUCnaD0=";
--- a/pkgs/development/compilers/kotlin/default.nix
+++ b/pkgs/development/compilers/kotlin/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "kotlin";
-  version = "1.7.0";
+  version = "1.7.10";

  src = fetchurl {
    url = "https://github.com/JetBrains/kotlin/releases/download/v${version}/kotlin-compiler-${version}.zip";
-    hash = "sha256-9SFmRK2BVx5dti7CMi/gdGiSe9pA9RFH7WJqKIS1X5o=";
+    hash = "sha256-doP1RR7zCOt3Omhu53eadqle2LFDxprCR5N2GdfKOgk=";
  };

  propagatedBuildInputs = [ jre ] ;
--- a/pkgs/development/compilers/kotlin/native.nix
+++ b/pkgs/development/compilers/kotlin/native.nix
@ -7,7 +7,7 @@

 stdenv.mkDerivation rec {
  pname = "kotlin-native";
-  version = "1.7.0";
+  version = "1.7.10";

  src = let
    getArch = {
@ -20,9 +20,9 @@ stdenv.mkDerivation rec {
      "https://github.com/JetBrains/kotlin/releases/download/v${version}/kotlin-native-${arch}-${version}.tar.gz";

    getHash = arch: {
-      "macos-aarch64" = "sha256-Xx9MH7QJDCfbPK9fA5U1ZoVbuLoIJyy7QEFMlCD9JXw=";
-      "macos-x86_64" = "sha256-s5qFpuWeke7LCfUSkNyXBOgWdSJ1+cs6g7mU1osU/J8=";
-      "linux-x86_64" = "sha256-CnDam72UBSM/aNelhj0JjLNy9gFx5WIPAjtvubnpmpw=";
+      "macos-aarch64" = "sha256-wCvld/VBpcc+GvdVNABu6m4Jz2ezqIbzI9rm8EBryz4=";
+      "macos-x86_64" = "sha256-TpRwwl4Mazt56GpZx+yk15xaKMpRXoDbk1BFNbIzKgA=";
+      "linux-x86_64" = "sha256-uHQ3Poc4G5TGo4UXjqlZSltM/rL7rivYnTy4TJa8O5Y=";
    }.${arch};
  in
    fetchurl {
--- a/pkgs/development/coq-modules/coqide/default.nix
+++ b/pkgs/development/coq-modules/coqide/default.nix
@ -0,0 +1,61 @@
+{ lib
+, makeDesktopItem
+, copyDesktopItems
+, wrapGAppsHook
+, glib
+, gnome
+, mkCoqDerivation
+, coq
+, version ? null }:
+
+with lib; mkCoqDerivation rec {
+  pname = "coqide";
+  inherit version;
+
+  inherit (coq) src;
+  release."${coq.version}" = {};
+
+  defaultVersion = if versions.isGe "8.14" coq.version then coq.version else null;
+
+  preConfigure = ''
+    patchShebangs dev/tools/
+  '';
+  prefixKey = "-prefix ";
+
+  useDune2 = true;
+
+  buildInputs = [
+    copyDesktopItems
+    wrapGAppsHook
+    coq.ocamlPackages.lablgtk3-sourceview3
+    glib
+    gnome.adwaita-icon-theme
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    dune build -p ${pname} -j $NIX_BUILD_CORES
+    runHook postBuild
+  '';
+  installPhase = ''
+    runHook preInstall
+    dune install --prefix $out ${pname}
+    runHook postInstall
+  '';
+
+  desktopItems = makeDesktopItem {
+    name = "coqide";
+    exec = "coqide";
+    icon = "coq";
+    desktopName = "CoqIDE";
+    comment = "Graphical interface for the Coq proof assistant";
+    categories = [ "Development" "Science" "Math" "IDE" "GTK" ];
+  };
+
+  meta = with lib; {
+    homepage = "https://coq.inria.fr";
+    description = "The CoqIDE user interface for the Coq proof assistant";
+    license = licenses.lgpl21Plus;
+    maintainers = [ maintainers.Zimmi48 ];
+  };
+}
--- a/pkgs/development/dhall-modules/dhall-grafana.nix
+++ b/pkgs/development/dhall-modules/dhall-grafana.nix
@ -4,8 +4,8 @@ buildDhallGitHubPackage {
  name = "grafana";
  owner = "weeezes";
  repo = "dhall-grafana";
-  # 2021-11-12
-  rev = "d5630dc55deacf5100a99802a4df1d9680b263b3";
-  sha256 = "01320hpqgr5r4grsydmdl9yznmly1ssnlc9gcwa8rj1ah0a8xlgz";
+  # 2022-07-10
+  rev = "49a3ee4801cf64f479e3f0bad839a5dd8e5b4932";
+  sha256 = "1i8b98xx20b73afkmr78l4x4ci3dk2sc737hxkcaxp3sgncwnz1b";
  dependencies = [ Prelude ];
 }
--- a/pkgs/development/libraries/gdcm/default.nix
+++ b/pkgs/development/libraries/gdcm/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "gdcm";
-  version = "3.0.12";
+  version = "3.0.14";

  src = fetchFromGitHub {
    owner = "malaterre";
    repo = "GDCM";
    rev = "v${version}";
-    sha256 = "sha256-ChHsbnX+128ZOugL6Nc8EqfaDMaNMNDmKTN55pyyem8=";
+    sha256 = "sha256-gXREvxgGpIBo5oVxxal+Xdwk0WFZufuJKGzABzhB7zM=";
  };

  cmakeFlags = [
--- a/pkgs/development/libraries/libadwaita/default.nix
+++ b/pkgs/development/libraries/libadwaita/default.nix
@ -21,7 +21,7 @@

 stdenv.mkDerivation rec {
  pname = "libadwaita";
-  version = "1.1.2";
+  version = "1.1.3";

  outputs = [ "out" "dev" "devdoc" ];
  outputBin = "devdoc"; # demo app
@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
    owner = "GNOME";
    repo = "libadwaita";
    rev = version;
-    hash = "sha256-OyjuUWfKE8GoGFCmaCS7YAf5GAS0VwMPht7cvFtkA/Y=";
+    hash = "sha256-Mjv4Z9YaIT9atD8ekepBAA1ZV30kWnMnV8+kOuGULnw=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/libhugetlbfs/default.nix
+++ b/pkgs/development/libraries/libhugetlbfs/default.nix
@ -9,6 +9,13 @@ stdenv.mkDerivation rec {
    sha256 = "0ya4q001g111d3pqlzrf3yaifadl0ccirx5dndz1pih7x3qp41mp";
  };

+  patches = [
+    (fetchurl {
+      url = "https://build.opensuse.org/public/source/openSUSE:Factory/libhugetlbfs/glibc-2.34-fix.patch?rev=50";
+      sha256 = "sha256-eRQa6M0ZdHMtwA5nnzDTWYv/x4AnRZhj+MpDiwyCvVM=";
+    })
+  ];
+
  outputs = [ "bin" "dev" "man" "doc" "lib" "out" ];

  postConfigure = ''
--- a/pkgs/development/libraries/libressl/default.nix
+++ b/pkgs/development/libraries/libressl/default.nix
@ -12,13 +12,13 @@ let
    then "DYLD_LIBRARY_PATH"
    else "LD_LIBRARY_PATH";

-  generic = { version, sha256, patches ? [] }: stdenv.mkDerivation rec {
+  generic = { version, hash, patches ? [] }: stdenv.mkDerivation rec {
    pname = "libressl";
    inherit version;

    src = fetchurl {
      url = "mirror://openbsd/LibreSSL/${pname}-${version}.tar.gz";
-      inherit sha256;
+      inherit hash;
    };

    nativeBuildInputs = [ cmake ];
@ -86,11 +86,11 @@ let
 in {
  libressl_3_4 = generic {
    version = "3.4.3";
-    sha256 = "sha256-/4i//jVIGLPM9UXjyv5FTFAxx6dyFwdPUzJx1jw38I0=";
+    hash = "sha256-/4i//jVIGLPM9UXjyv5FTFAxx6dyFwdPUzJx1jw38I0=";
  };

  libressl_3_5 = generic {
-    version = "3.5.2";
-    sha256 = "sha256-Vv6rjiHD+mVJ+LfXURZYuOmFGBYoOKeVMUcyZUrfPl8=";
+    version = "3.5.3";
+    hash = "sha256-OrXl6u9pziDGsXDuZNeFtCI19I8uYrCV/KXXtmcriyg=";
  };
 }
--- a/pkgs/development/libraries/libui/default.nix
+++ b/pkgs/development/libraries/libui/default.nix
@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
    ln -s $out/lib/libui.so.0 $out/lib/libui.so
  '' + lib.optionalString stdenv.isDarwin ''
    mv ./out/libui.A.dylib $out/lib/
-    ln -s $out/lib/lubui.A.dylib $out/lib/libui.dylib
+    ln -s $out/lib/libui.A.dylib $out/lib/libui.dylib
  '' + ''
    cp $src/ui.h $out/include
    cp $src/ui_${backend}.h $out/include
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@ -1,7 +1,12 @@
-{ lib, stdenv, fetchurl, zlib, interactive ? false, readline, ncurses
-, python3Packages
+{ lib, stdenv, fetchurl, zlib, readline, ncurses
+
+# for tests
+, python3Packages, sqldiff, sqlite-analyzer
+
+# uses readline & ncurses for a better interactive experience if set to true
+, interactive ? false
+# TODO: can be removed since 3.36 since it is the default now.
 , enableDeserialize ? false
-, sqldiff, sqlite-analyzer
 }:

 with lib;
--- a/pkgs/development/ocaml-modules/erm_xmpp/default.nix
+++ b/pkgs/development/ocaml-modules/erm_xmpp/default.nix
@ -3,14 +3,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "0.3+20200317";
+  version = "0.3+20220404";
  pname = "ocaml${ocaml.version}-erm_xmpp";

  src = fetchFromGitHub {
    owner  = "hannesm";
    repo   = "xmpp";
-    rev    = "7fa5bea252671fd88625c6af109998b879ca564f";
-    sha256 = "0spzyd9kbyizzwl8y3mq8z19zlkzxnkh2fppry4lyc7vaw7bqrwq";
+    rev    = "e54d54e142ac9770c37e144693473692bf473530";
+    sha256 = "sha256-Ize8Em4LI54Cy1Xuzr9BjQGV7JMr3W6KI1YzI8G1q/U=";
  };

  nativeBuildInputs = [ ocaml findlib ocamlbuild camlp4 ];
--- a/pkgs/development/python-modules/afdko/default.nix
+++ b/pkgs/development/python-modules/afdko/default.nix
@ -5,6 +5,7 @@
 , setuptools-scm, scikit-build
 , cmake
 , antlr4_9
+, libxml2
 , pytestCheckHook
 # Enables some expensive tests, useful for verifying an update
 , runAllTests ? false
@ -13,13 +14,13 @@

 buildPythonPackage rec {
  pname = "afdko";
-  version = "3.8.3";
+  version = "3.9.0";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0mplyla4zcai3qld7is7bl5wn2kzhp87w87yi13wpqnw06i6ij4b";
+    sha256 = "1fjsaz6bp028fbmry6fzfcih78mdzycqmky1wsz5y0bg4kfk4shh";
  };

  format = "pyproject";
@ -32,6 +33,7 @@ buildPythonPackage rec {

  buildInputs = [
    antlr4_9.runtime.cpp
+    libxml2.dev
  ];

  patches = [
@ -40,6 +42,8 @@ buildPythonPackage rec {

    # Use antlr4 runtime from nixpkgs and link it dynamically
    ./use-dynamic-system-antlr4-runtime.patch
+
+    ./libxml2-cmake-find-package.patch
  ];

  # setup.py will always (re-)execute cmake in buildPhase
--- a/pkgs/development/python-modules/afdko/libxml2-cmake-find-package.patch
+++ b/pkgs/development/python-modules/afdko/libxml2-cmake-find-package.patch
@ -0,0 +1,22 @@
+commit c423d1ddf0345aed7ecaf4c8b9e1fa5108aafc6f
+Author: sternenseemann <sternenseemann@systemli.org>
+Date:   Sat Jul 2 12:35:56 2022 +0200
+
+    Force use of CMake-shipped FindLibXml2 module
+    
+    This is needed to work around a nixpkgs bug:
+    https://github.com/NixOS/nixpkgs/issues/125008
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index a75b6fb1..c1408283 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -42,7 +42,7 @@ set(ANTLR4_TAG tags/4.9.3)
+ find_path(ANTLR4_HEADER antlr4-runtime.h PATH_SUFFIXES antlr4-runtime)
+ set(ANTLR4_INCLUDE_DIRS ${ANTLR4_HEADER})
+ 
+-FIND_PACKAGE(LibXml2)
+FIND_PACKAGE(LibXml2 REQUIRED MODULE)
+ IF (NOT ${LibXml2_FOUND})
+    MESSAGE(STATUS "Could not locate LibXml2, will install externally.")
+    set(LIBXML2_TAG tags/v2.9.13)
--- a/pkgs/development/python-modules/afdko/use-dynamic-system-antlr4-runtime.patch
+++ b/pkgs/development/python-modules/afdko/use-dynamic-system-antlr4-runtime.patch
@ -1,4 +1,4 @@
-commit 1ccbf21a67da0fdbaad881a1f5c2a4df915e8c57
+commit 286b9c6e69691292dce4f2b4beaac8f886da184d
 Author: sternenseemann <sternenseemann@systemli.org>
 Date:   Tue Oct 5 18:16:10 2021 +0200

@ -9,7 +9,7 @@ Date:   Tue Oct 5 18:16:10 2021 +0200
    called antlr4-runtime, not antlr4_static).

 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index e9c8c08e..dc3a46da 100644
+index 9ce80598..a75b6fb1 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
@@ -36,11 +36,11 @@ list(APPEND CMAKE_MODULE_PATH ${CMAKE_CURRENT_SOURCE_DIR}/cmake)
@ -24,10 +24,22 @@ index e9c8c08e..dc3a46da 100644
 +find_path(ANTLR4_HEADER antlr4-runtime.h PATH_SUFFIXES antlr4-runtime)
 +set(ANTLR4_INCLUDE_DIRS ${ANTLR4_HEADER})
 
- # sanitizer support
- # work around https://github.com/pypa/setuptools/issues/1928 with environment
+ FIND_PACKAGE(LibXml2)
+ IF (NOT ${LibXml2_FOUND})
+diff --git a/c/makeotf/lib/cffread/CMakeLists.txt b/c/makeotf/lib/cffread/CMakeLists.txt
+index 9a400fde..5452d987 100644
+--- a/c/makeotf/lib/cffread/CMakeLists.txt
+++ b/c/makeotf/lib/cffread/CMakeLists.txt
+@@ -13,6 +13,6 @@ else ()
+     endif()
+ endif()
+ 
+-target_link_libraries(makeotf_cffread PUBLIC antlr4_static)
+target_link_libraries(makeotf_cffread PUBLIC antlr4-runtime)
+ 
+ target_compile_definitions(makeotf_cffread PRIVATE $<$<CONFIG:Debug>:CFF_DEBUG=1> CFF_T13_SUPPORT=0)
 diff --git a/c/makeotf/lib/hotconv/CMakeLists.txt b/c/makeotf/lib/hotconv/CMakeLists.txt
-index 82257bf2..02eb2e30 100644
+index 3cceceea..9695ea21 100644
 --- a/c/makeotf/lib/hotconv/CMakeLists.txt
 +++ b/c/makeotf/lib/hotconv/CMakeLists.txt
@@ -69,7 +69,7 @@ add_library(hotconv STATIC
@ -37,5 +49,5 @@ index 82257bf2..02eb2e30 100644
 -target_link_libraries(hotconv PUBLIC antlr4_static)
 +target_link_libraries(hotconv PUBLIC antlr4-runtime)
 
- if ( CMAKE_COMPILER_IS_GNUCC )
-     target_compile_options(hotconv PRIVATE -Wall -Wno-attributes)
+ if (${LibXml2_FOUND})
+     target_link_libraries(hotconv PUBLIC ${LIBXML2_LIBRARY})
--- a/pkgs/development/python-modules/afsapi/default.nix
+++ b/pkgs/development/python-modules/afsapi/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "afsapi";
-  version = "0.2.4";
+  version = "0.2.5";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "wlcrs";
    repo = "python-afsapi";
    rev = "refs/tags/${version}";
-    hash = "sha256-pNggrg97GIBBTm4rjtpx0NOZIWCGn9boB/Wss/QwF6U=";
+    hash = "sha256-GWBj4MsbWb4g67rjVWxe7RHinkv+rYlcAJiY4goFB5c=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
@ -0,0 +1,51 @@
+{ lib
+, aio-geojson-client
+, aiohttp
+, aresponses
+, asynctest
+, buildPythonPackage
+, fetchFromGitHub
+, pytest-asyncio
+, pytestCheckHook
+, pytz
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "aio-geojson-usgs-earthquakes";
+  version = "0.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "exxamalte";
+    repo = "python-aio-geojson-usgs-earthquakes";
+    rev = "v${version}";
+    hash = "sha256-Hb0/BdK/jjxlPl9WJJpFdOCzZpZDCguXoGreGIyN8oo=";
+  };
+
+  propagatedBuildInputs = [
+    aio-geojson-client
+    aiohttp
+    pytz
+  ];
+
+  checkInputs = [
+    aresponses
+    asynctest
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "aio_geojson_usgs_earthquakes"
+  ];
+
+  meta = with lib; {
+    description = "Python module for accessing the U.S. Geological Survey Earthquake Hazards Program feeds";
+    homepage = "https://github.com/exxamalte/python-aio-geojson-usgs-earthquakes";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/aioaladdinconnect/default.nix
+++ b/pkgs/development/python-modules/aioaladdinconnect/default.nix
@ -0,0 +1,38 @@
+{ lib
+, aiohttp
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "aioaladdinconnect";
+  version = "0.1.21";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    pname = "AIOAladdinConnect";
+    inherit version;
+    hash = "sha256-Zr9QLiQNmphPpAVnFVpoOlVbuWUVtWXIacYKAnth+E4=";
+  };
+
+  propagatedBuildInputs = [
+    aiohttp
+  ];
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "AIOAladdinConnect"
+  ];
+
+  meta = with lib; {
+    description = "Library for controlling Genie garage doors connected to Aladdin Connect devices";
+    homepage = "https://github.com/mkmer/AIOAladdinConnect";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/aiomusiccast/default.nix
+++ b/pkgs/development/python-modules/aiomusiccast/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "aiomusiccast";
-  version = "0.14.4";
+  version = "0.14.5";

  format = "pyproject";
  disabled = pythonOlder "3.8";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "vigonotion";
    repo = "aiomusiccast";
    rev = "refs/tags/${version}";
-    hash = "sha256-vSf4Fcioz+ZrXCaFQQbHzhz7vOknCOEFJXduXJlO/wE=";
+    hash = "sha256-YssBrG4sFtQtrzKU/O/tWEVL9eq8dpszejY/1So5Mec=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/binwalk/default.nix
+++ b/pkgs/development/python-modules/binwalk/default.nix
@ -67,7 +67,5 @@ buildPythonPackage rec {
    description = "A tool for searching a given binary image for embedded files";
    maintainers = [ maintainers.koral ];
    license = licenses.mit;
-    # Signature Exception: [Errno 1] Operation not permitted: '/testing/tests/input-vectors/_dirtraversal.tar.extracted'
-    broken = (stdenv.isDarwin && stdenv.isx86_64); # broken on hydra since 2021-11-02
  };
 }
--- a/pkgs/development/python-modules/graphite-api/default.nix
+++ b/pkgs/development/python-modules/graphite-api/default.nix
@ -1,46 +0,0 @@
-{ stdenv, buildPythonPackage, fetchFromGitHub, lib, flask, flask-caching, cairocffi, pyparsing, pytz, pyyaml
-, raven, six, structlog, tzlocal, nose, mock, cairo, isPyPy
-}:
-
-buildPythonPackage rec {
-  pname = "graphite-api";
-  version = "1.1.3";
-
-  disabled = isPyPy;
-
-  src = fetchFromGitHub {
-    owner = "brutasse";
-    repo = "graphite-api";
-    rev = version;
-    sha256 = "0sz3kav2024ms2z4q03pigcf080gsr5v774z9bp3zw29k2p47ass";
-  };
-
-  # https://github.com/brutasse/graphite-api/pull/239 rebased onto 1.1.3
-  patches = [ ./flask-caching-rebased.patch ];
-
-  checkPhase = "nosetests";
-
-  propagatedBuildInputs = [
-    flask
-    flask-caching
-    cairocffi
-    pyparsing
-    pytz
-    pyyaml
-    raven
-    six
-    structlog
-    tzlocal
-  ];
-
-  checkInputs = [ nose mock ];
-
-  LD_LIBRARY_PATH = "${cairo.out}/lib";
-
-  meta = with lib; {
-    broken = stdenv.isDarwin;
-    description = "Graphite-web, without the interface. Just the rendering HTTP API";
-    homepage = "https://github.com/brutasse/graphite-api";
-    license = licenses.asl20;
-  };
-}
--- a/pkgs/development/python-modules/graphite-api/flask-caching-rebased.patch
+++ b/pkgs/development/python-modules/graphite-api/flask-caching-rebased.patch
@ -1,132 +0,0 @@
-diff --git a/graphite_api/config.py b/graphite_api/config.py
-index 5e1e382..dc033a8 100644
--- a/graphite_api/config.py
-+++ b/graphite_api/config.py
-@@ -112,11 +112,11 @@ def configure(app):
-     app.cache = None
-     if 'cache' in config:
-         try:
-            from flask.ext.cache import Cache
-+            from flask_caching import Cache
-         except ImportError:
-             warnings.warn("'cache' is provided in the configuration but "
-                          "Flask-Cache is not installed. Please `pip install "
-                          "Flask-Cache`.")
-+                          "flask-caching is not installed. Please `pip "
-+                          "install flask-caching`.")
-         else:
-             cache_conf = {'CACHE_DEFAULT_TIMEOUT': 60,
-                           'CACHE_KEY_PREFIX': 'graphite-api:'}
-diff --git a/requirements.txt b/requirements.txt
-index c68b446..7826b0c 100644
--- a/requirements.txt
-+++ b/requirements.txt
-@@ -1,5 +1,5 @@
- Flask
-Flask-Cache
-+Flask-Caching
- cairocffi
- pyparsing>=1.5.7
- pytz
-diff --git a/setup.py b/setup.py
-index 0337cbe..df07989 100644
--- a/setup.py
-+++ b/setup.py
-@@ -38,7 +38,7 @@ setup(
-     extras_require={
-         'sentry': ['raven[flask]'],
-         'cyanite': ['cyanite'],
-        'cache': ['Flask-Cache'],
-+        'cache': ['Flask-Caching'],
-         'statsd': ['statsd'],
-     },
-     zip_safe=False,
-diff --git a/tests/test_render.py b/tests/test_render.py
-index be5609d..a0e7190 100644
--- a/tests/test_render.py
-+++ b/tests/test_render.py
-@@ -8,7 +8,7 @@ from graphite_api._vendor import whisper
- from . import TestCase, WHISPER_DIR
- 
- try:
-    from flask.ext.cache import Cache
-+    from flask_caching import Cache
- except ImportError:
-     Cache = None
- 
-diff --git a/tox.ini b/tox.ini
-index 85a0abb..c820393 100644
--- a/tox.ini
-+++ b/tox.ini
-@@ -47,7 +47,7 @@ basepython = python2.7
- deps =
- 	{[testenv]deps}
- 	Flask
-	Flask-Cache
-+	Flask-Caching
- 	pyparsing
- 	mock
- 
-@@ -56,7 +56,7 @@ basepython = python3.3
- deps =
- 	{[testenv]deps}
- 	Flask
-	Flask-Cache
-+	Flask-Caching
- 	pyparsing
- 
- [testenv:py34]
-@@ -66,7 +66,7 @@ commands =
- deps =
- 	{[testenv]deps}
- 	Flask
-	Flask-Cache
-+	Flask-Caching
- 	pyparsing
- 
- [testenv:py35]
-@@ -76,7 +76,7 @@ commands =
- deps =
- 	{[testenv]deps}
- 	Flask
-	Flask-Cache
-+	Flask-Caching
- 	pyparsing
- 
- [testenv:pyparsing1]
-@@ -84,7 +84,7 @@ basepython = python2.7
- deps =
- 	{[testenv]deps}
- 	Flask
-	Flask-Cache
-+	Flask-Caching
- 	pyparsing==1.5.7
- 	mock
- 
-@@ -93,7 +93,7 @@ basepython = pypy
- deps =
- 	{[testenv]deps}
- 	Flask
-	Flask-Cache
-+	Flask-Caching
- 	pyparsing
- 	mock
- 
-@@ -102,7 +102,7 @@ basepython = python2.7
- deps =
- 	{[testenv]deps}
- 	Flask<0.9
-	Flask-Cache
-+	Flask-Caching
- 	pyparsing
- 	mock
- 
-@@ -111,7 +111,7 @@ basepython = python2.7
- deps =
- 	{[testenv]deps}
- 	Flask<0.10
-	Flask-Cache
-+	Flask-Caching
- 	pyparsing
- 	mock
- 
--- a/pkgs/development/python-modules/graphite_beacon/default.nix
+++ b/pkgs/development/python-modules/graphite_beacon/default.nix
@ -1,33 +0,0 @@
-{ lib, buildPythonPackage, fetchPypi
-, tornado_5, pyyaml, funcparserlib
-, nixosTests
-}:
-
-buildPythonPackage rec {
-  pname = "graphite_beacon";
-  version = "0.27.0";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "03bp4wyfn3xhcqyvs5hnk1n87m4smsmm1p7qp459m7j8hwpbq2ks";
-  };
-
-  propagatedBuildInputs = [ tornado_5 pyyaml funcparserlib ];
-
-  postPatch = ''
-    substituteInPlace requirements.txt --replace "==" ">="
-  '';
-
-  pythonImportsCheck = [ "graphite_beacon" ];
-
-  passthru.tests = {
-    nixos = nixosTests.graphite;
-  };
-
-  meta = with lib; {
-    description = "A simple alerting application for Graphite metrics";
-    homepage = "https://github.com/klen/graphite-beacon";
-    maintainers = [ maintainers.offline ];
-    license = licenses.mit;
-  };
-}
--- a/pkgs/development/python-modules/humanize/default.nix
+++ b/pkgs/development/python-modules/humanize/default.nix
@ -2,6 +2,7 @@
 , buildPythonPackage
 , fetchFromGitHub
 , freezegun
+, gettext
 , importlib-metadata
 , pytestCheckHook
 , pythonOlder
@ -10,7 +11,7 @@
 }:

 buildPythonPackage rec {
-  version = "4.1.0";
+  version = "4.2.3";
  pname = "humanize";
  format = "pyproject";

@ -20,13 +21,14 @@ buildPythonPackage rec {
    owner = "python-humanize";
    repo = pname;
    rev = version;
-    hash = "sha256-5xL3gfEohDjnF085Pgx/PBXWWM76X4FU2KR+8OGshMw=";
+    hash = "sha256-cAlNtN9sUnDAkCQj2bJfT72B2TQDYRBB4P4NJY9mUU0=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;

  nativeBuildInputs = [
    setuptools-scm
+    gettext
  ];

  propagatedBuildInputs = [
@ -35,6 +37,14 @@ buildPythonPackage rec {
    importlib-metadata
  ];

+  postBuild = ''
+    scripts/generate-translation-binaries.sh
+  '';
+
+  postInstall = ''
+    cp -r 'src/humanize/locale' "$out/lib/"*'/site-packages/humanize/'
+  '';
+
  checkInputs = [
    freezegun
    pytestCheckHook
@ -48,6 +58,6 @@ buildPythonPackage rec {
    description = "Python humanize utilities";
    homepage = "https://github.com/python-humanize/humanize";
    license = licenses.mit;
-    maintainers = with maintainers; [ rmcgibbo ];
+    maintainers = with maintainers; [ rmcgibbo Luflosi ];
  };
 }
--- a/pkgs/development/python-modules/influxgraph/default.nix
+++ b/pkgs/development/python-modules/influxgraph/default.nix
@ -1,24 +0,0 @@
-{ lib, buildPythonPackage, fetchPypi, isPy3k
-, influxdb, graphite_api, python-memcached
-}:
-
-buildPythonPackage rec {
-  pname = "influxgraph";
-  version = "1.5.0";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0l33sfwdh4bfprmzp2kx0d9098g6yxbnhyyx9qr3kzczpm0jg9vy";
-  };
-
-  propagatedBuildInputs = [ influxdb graphite_api python-memcached ];
-
-  passthru.moduleName = "influxgraph.InfluxDBFinder";
-
-  meta = with lib; {
-    description = "InfluxDB storage plugin for Graphite-API";
-    homepage = "https://github.com/InfluxGraph/influxgraph";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ basvandijk ];
-  };
-}
--- a/pkgs/development/python-modules/levenshtein/default.nix
+++ b/pkgs/development/python-modules/levenshtein/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "levenshtein";
-  version = "0.18.2";
+  version = "0.19.1";
  format = "pyproject";

  disabled = pythonOlder "3.6";
@ -20,8 +20,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "maxbachmann";
    repo = "Levenshtein";
-    rev = "v${version}";
-    hash = "sha256-FmEB0i235rzK6S1MV189iDNB+CYpcBvcdVE+kdclwmE=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-2/m9vn3yHDt5sjE/hY3s3gBCkZnehbk25+VReLo2jn8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/myst-docutils/default.nix
+++ b/pkgs/development/python-modules/myst-docutils/default.nix
@ -0,0 +1,46 @@
+{ lib
+, buildPythonPackage
+, docutils
+, fetchPypi
+, flit-core
+, jinja2
+, markdown-it-py
+, mdit-py-plugins
+, pythonOlder
+, pyyaml
+, typing-extensions
+}:
+
+buildPythonPackage rec {
+  pname = "myst-docutils";
+  version = "0.17.2";
+  format = "pyproject";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-Of3AVM0OsspcmvRAEXbfu2+V3ju6yqb2sFBexkbmNIU=";
+  };
+
+  nativeBuildInputs = [
+    flit-core
+  ];
+
+  propagatedBuildInputs = [
+    docutils
+    jinja2
+    markdown-it-py
+    mdit-py-plugins
+    pyyaml
+    typing-extensions
+  ];
+
+  pythonImportsCheck = [ "myst_parser" ];
+
+  meta = with lib; {
+    description = "An extended commonmark compliant parser, with bridges to docutils/sphinx.";
+    homepage = "https://github.com/executablebooks/MyST-Parser";
+    license = licenses.mit;
+    maintainers = with maintainers; [ dpausp ];
+    broken = pythonOlder "3.8"; # dependency networkx requires 3.8
+  };
+}
--- a/pkgs/development/python-modules/panflute/default.nix
+++ b/pkgs/development/python-modules/panflute/default.nix
@ -3,18 +3,19 @@
 , click
 , pyyaml
 , buildPythonPackage
-, isPy3k
+, pythonOlder
 }:

 buildPythonPackage rec{
-  version = "2.1.3";
  pname = "panflute";
+  version = "2.1.5";
+  format = "setuptools";

-  disabled = !isPy3k;
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "y5QkT+dmiTuy8XLruCfsPe12G4//qE5MhLZ4ufip/5U=";
+    hash = "sha256-7xHcWVoZh51PlonvmoOCBKJGNMpjT7z8jkoO1B65EqE=";
  };

  propagatedBuildInputs = [
@ -22,8 +23,12 @@ buildPythonPackage rec{
    pyyaml
  ];

+  pythonImportsCheck = [
+    "panflute"
+  ];
+
  meta = with lib; {
-    description = "A Pythonic alternative to John MacFarlane's pandocfilters, with extra helper functions";
+    description = "Pythonic alternative to John MacFarlane's pandocfilters, with extra helper functions";
    homepage = "http://scorreia.com/software/panflute";
    license = licenses.bsd3;
    maintainers = with maintainers; [ synthetica ];
--- a/pkgs/development/python-modules/pyialarm/default.nix
+++ b/pkgs/development/python-modules/pyialarm/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "pyialarm";
-  version = "1.9.0";
+  version = "2.0.0";
  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "RyuzakiKK";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-mvi8cd9uVFvG1Jc3OeuEwuLjbuMjPRrNRHFUVe3g/NM=";
+    sha256 = "sha256-rJS6KgEy4iuiY6QRue6K6woyGefuTN7/4RLCu8cb8M4=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pymazda/default.nix
+++ b/pkgs/development/python-modules/pymazda/default.nix
@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "pymazda";
-  version = "0.3.4";
+  version = "0.3.6";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-Xq+DXrZp1NrsCgUnjaMWUoM+SDfnXK+YDX2Gcr7FKvQ=";
+    sha256 = "sha256-zzyaG1i5eEnQWBiW8Wh/cIncJsU/XdEC61JmkB6Z6mY=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/pysml/default.nix
+++ b/pkgs/development/python-modules/pysml/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "pysml";
-  version = "0.0.7";
+  version = "0.0.8";
  format = "pyproject";

  src = fetchFromGitHub {
    owner = "mtdcr";
    repo = pname;
    rev = version;
-    sha256 = "sha256-h8rQOKZozioZ7HmPETC5wBJyz7rMH1Q2wL6lF8G3zQU=";
+    sha256 = "sha256-Qw2irvj94cBquYeVUhqOq8lw85oP5TqtA2XTT2z5/as=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/python-swiftclient/default.nix
+++ b/pkgs/development/python-modules/python-swiftclient/default.nix
@ -1,6 +1,7 @@
 { lib
 , buildPythonApplication
 , fetchPypi
+, installShellFiles
 , mock
 , openstacksdk
 , pbr
@ -21,6 +22,10 @@ buildPythonApplication rec {
    hash = "sha256-V7bx/yO0ZoQ4AqaBb0trvGiWtq0F1ld6/udiK+OilTg=";
  };

+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
  propagatedBuildInputs = [
    pbr
    python-keystoneclient
@ -33,7 +38,9 @@ buildPythonApplication rec {
  ];

  postInstall = ''
-    install -Dm644 tools/swift.bash_completion $out/share/bash_completion.d/swift
+    installShellCompletion --cmd swift \
+      --bash tools/swift.bash_completion
+    installManPage doc/manpages/*
  '';

  checkPhase = ''
--- a/pkgs/development/python-modules/regenmaschine/default.nix
+++ b/pkgs/development/python-modules/regenmaschine/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "regenmaschine";
-  version = "2022.07.0";
+  version = "2022.07.1";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "bachya";
    repo = pname;
    rev = "refs/tags/${version}";
-    sha256 = "sha256-zUef2AMC+vNINUi78xv3rSfBJ9peG7dlDVVmn+WFAsk=";
+    sha256 = "sha256-x8KyNB3aNiRT64/rrA7y8LM7ZOd524ok++n1Fwjz1Gc=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/rokuecp/default.nix
+++ b/pkgs/development/python-modules/rokuecp/default.nix
@ -17,7 +17,7 @@

 buildPythonPackage rec {
  pname = "rokuecp";
-  version = "0.16.0";
+  version = "0.17.0";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "ctalkington";
    repo = "python-rokuecp";
    rev = version;
-    hash = "sha256-MeugjIZorwO8d0Yb7bthI6f4NNo6GX9JrRbxrVSdWv0=";
+    hash = "sha256-M4eZzFphhc96Pf1bspD+Hvl9SUN1N72xnxdtVFiPc78=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/shodan/default.nix
+++ b/pkgs/development/python-modules/shodan/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "shodan";
-  version = "1.27.0";
+  version = "1.28.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-XkrnBuALYxZ6n/f34PM0QvxqxvC08mKci9Mswwf41VA=";
+    sha256 = "sha256-GL0q6BEUtwg24OMxUicyXhQ5gnUiOZiowjWwmUMvSws=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/softlayer/default.nix
+++ b/pkgs/development/python-modules/softlayer/default.nix
@ -14,20 +14,28 @@
 , testtools
 , tkinter
 , urllib3
+, prettytable
+, rich
+, zeep
 }:

 buildPythonPackage rec {
  pname = "softlayer";
-  version = "5.9.9";
+  version = "6.1.0";
  disabled = pythonOlder "3.5";

  src = fetchFromGitHub {
    owner = pname;
    repo = "softlayer-python";
    rev = "v${version}";
-    sha256 = "sha256-LskPz5KXOi7olb3+DUP9uEFESQeo6ec/ZLx9B/w6Ni0=";
+    sha256 = "sha256-T49KVAsgcAZySkaJi47IrFcMHGZvEkGDjPWsdMarzwM=";
  };

+  postPatch = ''
+    substituteInPlace setup.py \
+        --replace 'rich == 12.3.0' 'rich >= 12.3.0'
+  '';
+
  propagatedBuildInputs = [
    click
    prompt-toolkit
@ -35,6 +43,8 @@ buildPythonPackage rec {
    pygments
    requests
    urllib3
+    prettytable
+    rich
  ];

  checkInputs = [
@ -43,15 +53,26 @@ buildPythonPackage rec {
    sphinx
    testtools
    tkinter
+    zeep
+  ];
+
+  # Otherwise soap_tests.py will fail to create directory
+  # Permission denied: '/homeless-shelter'
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  disabledTestPaths = [
+    # Test fails with ConnectionError trying to connect to api.softlayer.com
+    "tests/transports/soap_tests.py"
  ];

  pythonImportsCheck = [ "SoftLayer" ];

  meta = with lib; {
-    broken = (stdenv.isLinux && stdenv.isAarch64) || stdenv.isDarwin;
    description = "Python libraries that assist in calling the SoftLayer API";
    homepage = "https://github.com/softlayer/softlayer-python";
    license = licenses.mit;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ onny ];
  };
 }
--- a/pkgs/development/python-modules/sunpy/default.nix
+++ b/pkgs/development/python-modules/sunpy/default.nix
@ -31,14 +31,14 @@

 buildPythonPackage rec {
  pname = "sunpy";
-  version = "4.0.2";
+  version = "4.0.3";
  format = "setuptools";

  disabled = pythonOlder "3.8";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-ZswUFdMRqEiMpTXAuVtEnsHJ4dgwcx2f4k1DwLl8pz8=";
+    hash = "sha256-Ett9CBubdyKJh9MkwUhQ1kQH6/zBb6Ma0CdEH5Eqcw8=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/swift/default.nix
+++ b/pkgs/development/python-modules/swift/default.nix
@ -6,6 +6,7 @@
 , eventlet
 , greenlet
 , iana-etc
+, installShellFiles
 , libredirect
 , lxml
 , mock
@ -35,7 +36,10 @@ buildPythonPackage rec {
    rm test/functional/s3api/{__init__.py,s3_test_client.py}
  '';

-  nativeBuildInputs = [ pbr ];
+  nativeBuildInputs = [
+    installShellFiles
+    pbr
+  ];

  propagatedBuildInputs = [
    cryptography
@ -51,6 +55,10 @@ buildPythonPackage rec {
    xattr
  ];

+  postInstall = ''
+    installManPage doc/manpages/*
+  '';
+
  checkInputs = [
    boto3
    mock
--- a/pkgs/development/python-modules/tweepy/default.nix
+++ b/pkgs/development/python-modules/tweepy/default.nix
@ -8,6 +8,7 @@
 , pythonOlder
 , requests
 , requests-oauthlib
+, six
 , vcrpy
 }:

@ -31,6 +32,7 @@ buildPythonPackage rec {
    oauthlib
    requests
    requests-oauthlib
+    six
  ];

  checkInputs = [
--- a/pkgs/development/python-modules/unidiff/default.nix
+++ b/pkgs/development/python-modules/unidiff/default.nix
@ -1,14 +1,18 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib, buildPythonPackage, fetchPypi, python }:

 buildPythonPackage rec {
  pname = "unidiff";
-  version = "0.7.3";
+  version = "0.7.4";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-1fLlOpoA2zIkqMNjSbU4Dg4i0a7GxpSxT7lIPuk8YgU=";
+    sha256 = "2bbcbc986e1fb97f04b1d7b864aa6002ab02f4d8a996bf03aa6e5a81447d1fc5";
  };

+  checkPhase = ''
+    ${python.interpreter} -m unittest discover -s tests/
+  '';
+
  pythonImportsCheck = [ "unidiff" ];

  meta = with lib; {
--- a/pkgs/development/tools/analysis/coan/default.nix
+++ b/pkgs/development/tools/analysis/coan/default.nix
@ -11,9 +11,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ perl ];

-  NIX_CFLAGS_COMPILE = [
-    "-std=c++11"
-  ];
+  CXXFLAGS = "-std=c++11";

  enableParallelBuilding = true;

@ -22,7 +20,6 @@ stdenv.mkDerivation rec {
  '';

  meta = with lib; {
-    broken = stdenv.isDarwin;
    description = "The C preprocessor chainsaw";
    longDescription = ''
      A software engineering tool for analysing preprocessor-based
--- a/pkgs/development/tools/analysis/dotenv-linter/default.nix
+++ b/pkgs/development/tools/analysis/dotenv-linter/default.nix
@ -2,6 +2,7 @@
 , lib
 , rustPlatform
 , fetchFromGitHub
+, Security
 }:

 rustPlatform.buildRustPackage rec {
@ -17,8 +18,9 @@ rustPlatform.buildRustPackage rec {

  cargoSha256 = "sha256-q59hpnXc00OzrJk1KOWbIPQYfIE+7ku9XtTDXHgwQBg=";

+  buildInputs = lib.optional stdenv.isDarwin Security;
+
  meta = with lib; {
-    broken = stdenv.isDarwin;
    description = "Lightning-fast linter for .env files. Written in Rust";
    homepage = "https://dotenv-linter.github.io";
    license = licenses.mit;
--- a/pkgs/development/tools/bazel-gazelle/default.nix
+++ b/pkgs/development/tools/bazel-gazelle/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "bazel-gazelle";
-  version = "0.25.0";
+  version = "0.26.0";

  src = fetchFromGitHub {
    owner = "bazelbuild";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-wMhFhJruXHuAq81A4efxvR9eJ5YTp7QTnr1gj8RrIX8=";
+    sha256 = "sha256-f+4XeH282VbasY6ShSNLsesn1OR8wb6kePU808UQWpw=";
  };

  vendorSha256 = null;
--- a/pkgs/development/tools/dapr/cli/default.nix
+++ b/pkgs/development/tools/dapr/cli/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "dapr-cli";
-  version = "1.7.1";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "dapr";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-gEYN9r5hHRya1nqle8qHaUaOpuBN8cSLJx2FBRqyztw=";
+    sha256 = "sha256-ytn7fG84Wu4+fcgkV5B9djCw8KgAJWgffoNbV7wveK4=";
  };

-  vendorSha256 = "sha256-RGEoewLDKo+D9Wp/v8PI/LPjCh2rFrdLO/AS4RWFliY=";
+  vendorSha256 = "sha256-ZsuDaFcBPZuyt5rmjeBkzkrphCCcraLZCrMiQ2FtAUc=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/development/tools/database/clickhouse-backup/default.nix
+++ b/pkgs/development/tools/database/clickhouse-backup/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "clickhouse-backup";
-  version = "1.4.0";
+  version = "1.4.7";

  src = fetchFromGitHub {
    owner = "AlexAkulov";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-NlOYRgCsReEeP/X98fddVRLnTnkqsiwpCg6MpdRcfZ0=";
+    sha256 = "sha256-1lkG8Rboq6t/hRrdAweo3Kxz9IkukQ39sQSpidFTElw=";
  };

-  vendorSha256 = "sha256-F+FfZESB/m/2m4RnYzFPs0PL5+8lyxzEwAdHMykrFsw=";
+  vendorSha256 = "sha256-N4zAdylb7etNknR0/VjIVkuI6kTWlk137HNT03Y2gWs=";

  postConfigure = ''
    export CGO_ENABLED=0
--- a/pkgs/development/tools/misc/gef/default.nix
+++ b/pkgs/development/tools/misc/gef/default.nix
@ -21,13 +21,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "gef";
-  version = "2022.01";
+  version = "2022.06";

  src = fetchFromGitHub {
    owner = "hugsy";
    repo = "gef";
    rev = version;
-    sha256 = "sha256-Ot0OYMbXFGCzJdmDHD+LoZRDShCbYJ+IGzLTcU2Rfd4=";
+    sha256 = "sha256-XMm4K5X3F5DDtI/usHxNZwqzYpjck8sVaZIYKGuE6Qc=";
  };

  dontBuild = true;
--- a/pkgs/development/tools/ocaml/ocamlformat/default.nix
+++ b/pkgs/development/tools/ocaml/ocamlformat/default.nix
@ -27,5 +27,9 @@ rec {
    version = "0.22.4";
  };

-  ocamlformat = ocamlformat_0_22_4;
+  ocamlformat_0_23_0 = mkOCamlformat {
+    version = "0.23.0";
+  };
+
+  ocamlformat = ocamlformat_0_23_0;
 }
--- a/pkgs/development/tools/ocaml/ocamlformat/generic.nix
+++ b/pkgs/development/tools/ocaml/ocamlformat/generic.nix
@ -12,6 +12,7 @@ let src =
      "0.20.1" = "sha256-fTpRZFQW+ngoc0T6A69reEUAZ6GmHkeQvxspd5zRAjU=";
      "0.21.0" = "sha256-KhgX9rxYH/DM6fCqloe4l7AnJuKrdXSe6Y1XY3BXMy0=";
      "0.22.4" = "sha256-61TeK4GsfMLmjYGn3ICzkagbc3/Po++Wnqkb2tbJwGA=";
+      "0.23.0" = "sha256-m9Pjz7DaGy917M1GjyfqG5Lm5ne7YSlJF2SVcDHe3+0=";
    }."${version}";
  };
  ocamlPackages = ocaml-ng.ocamlPackages;
--- a/pkgs/development/tools/rust/cargo-binutils/default.nix
+++ b/pkgs/development/tools/rust/cargo-binutils/default.nix
@ -2,14 +2,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-binutils";
-  version = "0.3.3";
+  version = "0.3.6";

  src = fetchCrate {
    inherit pname version;
-    sha256 = "sha256-1sJ+vi78lZsYEQBDyUzifdiU47R1Z6Y8ejNI9h5U+Ao=";
+    sha256 = "sha256-tRh3+X6QCdkkJE1O60ZRkDBRbznGZ1aB1AOmcz0EINI=";
  };

-  cargoSha256 = "sha256-kZhxKwSEI24LNJ9lPPjtX5etE0XeqaVN7h3HTzpoAY0=";
+  cargoSha256 = "sha256-lZJcsCg7e5ZmClnzKFjm/roXBIyhkPTzS7R6BTmcNIk=";

  meta = with lib; {
    description = "Cargo subcommands to invoke the LLVM tools shipped with the Rust toolchain";
--- a/pkgs/development/tools/rust/cargo-nextest/default.nix
+++ b/pkgs/development/tools/rust/cargo-nextest/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-nextest";
-  version = "0.9.22";
+  version = "0.9.24";

  src = fetchFromGitHub {
    owner = "nextest-rs";
    repo = "nextest";
    rev = "cargo-nextest-${version}";
-    sha256 = "sha256-so9h6bpQzGMVwXI4qGHOJGbX7hnd9tllPGJcRvtIiIU=";
+    sha256 = "sha256-CGtPftjt09qGbEnI4qGSoRkjMVVTfPHNOzIb4/Hx78g=";
  };

-  cargoSha256 = "sha256-rbrJPEMOFq37U+0uL5NIqithQAdjO8J6TDwr5vdfT50=";
+  cargoSha256 = "sha256-KAy5BDUrV3Voe3JBDBH2nZVUioRkONFMTdOyPjzx0Sk=";

  buildInputs = lib.optionals stdenv.isDarwin [ Security ];

--- a/Show More
+++ b/Show More