Merge master into haskell-updates

2021-10-29 00:07:03 +00:00 · 2021-10-29 00:07:03 +00:00 · 2c83416cdc
commit 2c83416cdc
parent a8d2181317 848b4f463e
194 changed files with 4721 additions and 7791 deletions
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@ -10,18 +10,13 @@ jobs:
    steps:
      - uses: actions/checkout@v2
        with:
-          # required to find all branches
-          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha }}
      - name: Create backport PRs
-        # should be kept in sync with `version`
-        uses: zeebe-io/backport-action@v0.0.5
+        uses: zeebe-io/backport-action@v0.0.6
        with:
          # Config README: https://github.com/zeebe-io/backport-action#backport-action
          github_token: ${{ secrets.GITHUB_TOKEN }}
          github_workspace: ${{ github.workspace }}
-          # should be kept in sync with `uses`
-          version: v0.0.5
          pull_description: |-
            Bot-based backport to `${target_branch}`, triggered by a label in #${pull_number}.

--- a/doc/contributing/coding-conventions.chapter.md
+++ b/doc/contributing/coding-conventions.chapter.md
@ -181,7 +181,7 @@
  rev = "${version}";
  ```

- Filling lists condionally _should_ be done with `lib.optional(s)` instead of using `if cond then [ ... ] else null` or `if cond then [ ... ] else [ ]`.
+- Building lists conditionally _should_ be done with `lib.optional(s)` instead of using `if cond then [ ... ] else null` or `if cond then [ ... ] else [ ]`.

  ```nix
  buildInputs = lib.optional stdenv.isDarwin iconv;
--- a/lib/systems/platforms.nix
+++ b/lib/systems/platforms.nix
@ -20,15 +20,17 @@ rec {
      name = "PowerNV";

      baseConfig = "powernv_defconfig";
-      target = "zImage";
-      installTarget = "install";
-      file = "vmlinux";
+      target = "vmlinux";
      autoModules = true;
      # avoid driver/FS trouble arising from unusual page size
      extraConfig = ''
        PPC_64K_PAGES n
        PPC_4K_PAGES y
        IPV6 y
+
+        ATA_BMDMA y
+        ATA_SFF y
+        VIRTIO_MENU y
      '';
    };
  };
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3227,12 +3227,6 @@
    githubId = 119483;
    name = "Matthew Brown";
  };
-  eduardosm = {
-    email = "esm@eduardosm.net";
-    github = "eduardosm";
-    githubId = 761151;
-    name = "Eduardo Sánchez Muñoz";
-  };
  eduarrrd = {
    email = "e.bachmakov@gmail.com";
    github = "eduarrrd";
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@ -1176,6 +1176,13 @@ Superuser created successfully.
          dropped because it was EOLed by upstream in 2021-10.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The <literal>virtualisation.pathsInNixDB</literal> option was
+          renamed
+          <link xlink:href="options.html#opt-virtualisation.additionalPaths"><literal>virtualisation.additionalPaths</literal></link>.
+        </para>
+      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="sec-release-21.11-notable-changes">
@ -1199,25 +1206,31 @@ Superuser created successfully.
        <para>
          In NixOS virtual machines (QEMU), the
          <literal>virtualisation</literal> module has been updated with
-          new options to configure:
+          new options:
        </para>
        <itemizedlist spacing="compact">
          <listitem>
            <para>
-              IPv4 port forwarding
-              (<link xlink:href="options.html#opt-virtualisation.forwardPorts"><literal>virtualisation.forwardPorts</literal></link>),
+              <link xlink:href="options.html#opt-virtualisation.forwardPorts"><literal>forwardPorts</literal></link>
+              to configure IPv4 port forwarding,
            </para>
          </listitem>
          <listitem>
            <para>
-              shared host directories
-              (<link xlink:href="options.html#opt-virtualisation.sharedDirectories"><literal>virtualisation.sharedDirectories</literal></link>),
+              <link xlink:href="options.html#opt-virtualisation.sharedDirectories"><literal>sharedDirectories</literal></link>
+              to set up shared host directories,
            </para>
          </listitem>
          <listitem>
            <para>
-              screen resolution
-              (<link xlink:href="options.html#opt-virtualisation.resolution"><literal>virtualisation.resolution</literal></link>).
+              <link xlink:href="options.html#opt-virtualisation.resolution"><literal>resolution</literal></link>
+              to set the screen resolution,
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              <link xlink:href="options.html#opt-virtualisation.useNixStoreImage"><literal>useNixStoreImage</literal></link>
+              to use a disk image for the Nix store instead of 9P.
            </para>
          </listitem>
        </itemizedlist>
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@ -362,16 +362,20 @@ In addition to numerous new and upgraded packages, this release has the followin

 - Nextcloud 20 (`pkgs.nextcloud20`) has been dropped because it was EOLed by upstream in 2021-10.

+- The `virtualisation.pathsInNixDB` option was renamed
+  [`virtualisation.additionalPaths`](options.html#opt-virtualisation.additionalPaths).
+
 ## Other Notable Changes {#sec-release-21.11-notable-changes}


 - The linux kernel package infrastructure was moved out of `all-packages.nix`, and restructured. Linux related functions and attributes now live under the `pkgs.linuxKernel` attribute set.
  In particular the versioned `linuxPackages_*` package sets (such as `linuxPackages_5_4`) and kernels from `pkgs` were moved there and now live under `pkgs.linuxKernel.packages.*`. The unversioned ones (such as `linuxPackages_latest`) remain untouched.

- In NixOS virtual machines (QEMU), the `virtualisation` module has been updated with new options to configure:
-    - IPv4 port forwarding ([`virtualisation.forwardPorts`](options.html#opt-virtualisation.forwardPorts)),
-    - shared host directories ([`virtualisation.sharedDirectories`](options.html#opt-virtualisation.sharedDirectories)),
-    - screen resolution ([`virtualisation.resolution`](options.html#opt-virtualisation.resolution)).
+- In NixOS virtual machines (QEMU), the `virtualisation` module has been updated with new options:
+    - [`forwardPorts`](options.html#opt-virtualisation.forwardPorts) to configure IPv4 port forwarding,
+    - [`sharedDirectories`](options.html#opt-virtualisation.sharedDirectories) to set up shared host directories,
+    - [`resolution`](options.html#opt-virtualisation.resolution) to set the screen resolution,
+    - [`useNixStoreImage`](options.html#opt-virtualisation.useNixStoreImage) to use a disk image for the Nix store instead of 9P.

  In addition, the default [`msize`](options.html#opt-virtualisation.msize) parameter in 9P filesystems (including /nix/store and all shared directories) has been increased to 16K for improved performance.

--- a/nixos/lib/make-disk-image.nix
+++ b/nixos/lib/make-disk-image.nix
@ -44,11 +44,14 @@
  #   most likely fails as GRUB will probably refuse to install.
  partitionTableType ? "legacy"

+, # Whether to invoke `switch-to-configuration boot` during image creation
+  installBootLoader ? true
+
 , # The root file system type.
  fsType ? "ext4"

 , # Filesystem label
-  label ? "nixos"
+  label ? if onlyNixStore then "nix-store" else "nixos"

 , # The initial NixOS configuration file to be copied to
  # /etc/nixos/configuration.nix.
@ -57,10 +60,24 @@
 , # Shell code executed after the VM has finished.
  postVM ? ""

+, # Copy the contents of the Nix store to the root of the image and
+  # skip further setup. Incompatible with `contents`,
+  # `installBootLoader` and `configFile`.
+  onlyNixStore ? false
+
 , name ? "nixos-disk-image"

 , # Disk image format, one of qcow2, qcow2-compressed, vdi, vpc, raw.
  format ? "raw"
+
+, # Whether a nix channel based on the current source tree should be
+  # made available inside the image. Useful for interactive use of nix
+  # utils, but changes the hash of the image when the sources are
+  # updated.
+  copyChannel ? true
+
+, # Additional store paths to copy to the image's store.
+  additionalPaths ? []
 }:

 assert partitionTableType == "legacy" || partitionTableType == "legacy+gpt" || partitionTableType == "efi" || partitionTableType == "hybrid" || partitionTableType == "none";
@ -71,6 +88,7 @@ assert lib.all
         (attrs: ((attrs.user  or null) == null)
              == ((attrs.group or null) == null))
         contents;
+assert onlyNixStore -> contents == [] && configFile == null && !installBootLoader;

 with lib;

@ -163,7 +181,14 @@ let format' = format; in let
  users   = map (x: x.user  or "''") contents;
  groups  = map (x: x.group or "''") contents;

-  closureInfo = pkgs.closureInfo { rootPaths = [ config.system.build.toplevel channelSources ]; };
+  basePaths = [ config.system.build.toplevel ]
+    ++ lib.optional copyChannel channelSources;
+
+  additionalPaths' = subtractLists basePaths additionalPaths;
+
+  closureInfo = pkgs.closureInfo {
+    rootPaths = basePaths ++ additionalPaths';
+  };

  blockSize = toString (4 * 1024); # ext4fs block size (not block device sector size)

@ -251,7 +276,13 @@ let format' = format; in let
    chmod 755 "$TMPDIR"
    echo "running nixos-install..."
    nixos-install --root $root --no-bootloader --no-root-passwd \
-      --system ${config.system.build.toplevel} --channel ${channelSources} --substituters ""
+      --system ${config.system.build.toplevel} \
+      ${if copyChannel then "--channel ${channelSources}" else "--no-channel-copy"} \
+      --substituters ""
+
+    ${optionalString (additionalPaths' != []) ''
+      nix copy --to $root --no-check-sigs ${concatStringsSep " " additionalPaths'}
+    ''}

    diskImage=nixos.raw

@ -320,25 +351,29 @@ let format' = format; in let
    ''}

    echo "copying staging root to image..."
-    cptofs -p ${optionalString (partitionTableType != "none") "-P ${rootPartition}"} -t ${fsType} -i $diskImage $root/* / ||
+    cptofs -p ${optionalString (partitionTableType != "none") "-P ${rootPartition}"} \
+           -t ${fsType} \
+           -i $diskImage \
+           $root${optionalString onlyNixStore builtins.storeDir}/* / ||
      (echo >&2 "ERROR: cptofs failed. diskSize might be too small for closure."; exit 1)
  '';
-in pkgs.vmTools.runInLinuxVM (
-  pkgs.runCommand name
-    { preVM = prepareImage;
+
+  moveOrConvertImage = ''
+    ${if format == "raw" then ''
+      mv $diskImage $out/${filename}
+    '' else ''
+      ${pkgs.qemu}/bin/qemu-img convert -f raw -O ${format} ${compress} $diskImage $out/${filename}
+    ''}
+    diskImage=$out/${filename}
+  '';
+
+  buildImage = pkgs.vmTools.runInLinuxVM (
+    pkgs.runCommand name {
+      preVM = prepareImage;
      buildInputs = with pkgs; [ util-linux e2fsprogs dosfstools ];
-      postVM = ''
-        ${if format == "raw" then ''
-          mv $diskImage $out/${filename}
-        '' else ''
-          ${pkgs.qemu}/bin/qemu-img convert -f raw -O ${format} ${compress} $diskImage $out/${filename}
-        ''}
-        diskImage=$out/${filename}
-        ${postVM}
-      '';
+      postVM = moveOrConvertImage + postVM;
      memSize = 1024;
-    }
-    ''
+    } ''
      export PATH=${binPath}:$PATH

      rootDisk=${if partitionTableType != "none" then "/dev/vda${rootPartition}" else "/dev/vda"}
@ -368,11 +403,13 @@ in pkgs.vmTools.runInLinuxVM (
        cp ${configFile} /mnt/etc/nixos/configuration.nix
      ''}

-      # Set up core system link, GRUB, etc.
-      NIXOS_INSTALL_BOOTLOADER=1 nixos-enter --root $mountPoint -- /nix/var/nix/profiles/system/bin/switch-to-configuration boot
+      ${lib.optionalString installBootLoader ''
+        # Set up core system link, GRUB, etc.
+        NIXOS_INSTALL_BOOTLOADER=1 nixos-enter --root $mountPoint -- /nix/var/nix/profiles/system/bin/switch-to-configuration boot

-      # The above scripts will generate a random machine-id and we don't want to bake a single ID into all our images
-      rm -f $mountPoint/etc/machine-id
+        # The above scripts will generate a random machine-id and we don't want to bake a single ID into all our images
+        rm -f $mountPoint/etc/machine-id
+      ''}

      # Set the ownerships of the contents. The modes are set in preVM.
      # No globbing on targets, so no need to set -f
@ -398,4 +435,9 @@ in pkgs.vmTools.runInLinuxVM (
        tune2fs -T now -c 0 -i 0 $rootDisk
      ''}
    ''
-)
+  );
+in
+  if onlyNixStore then
+    pkgs.runCommand name {}
+      (prepareImage + moveOrConvertImage + postVM)
+  else buildImage
--- a/nixos/lib/testing-python.nix
+++ b/nixos/lib/testing-python.nix
@ -209,11 +209,30 @@ rec {
    let
      nodes = qemu_pkg:
        let
+          testScript' =
+            # Call the test script with the computed nodes.
+            if lib.isFunction testScript
+            then testScript { nodes = nodes qemu_pkg; }
+            else testScript;
+
          build-vms = import ./build-vms.nix {
            inherit system lib pkgs minimal specialArgs;
            extraConfigurations = extraConfigurations ++ [(
              {
                virtualisation.qemu.package = qemu_pkg;
+
+                # Make sure all derivations referenced by the test
+                # script are available on the nodes. When the store is
+                # accessed through 9p, this isn't important, since
+                # everything in the store is available to the guest,
+                # but when building a root image it is, as all paths
+                # that should be available to the guest has to be
+                # copied to the image.
+                virtualisation.additionalPaths =
+                  lib.optional
+                    (builtins.hasContext testScript')
+                    (pkgs.writeStringReferencesToFile testScript');
+
                # Ensure we do not use aliases. Ideally this is only set
                # when the test framework is used by Nixpkgs NixOS tests.
                nixpkgs.config.allowAliases = false;
--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@ -227,8 +227,10 @@ in
      environment.sessionVariables.GTK_CSD = "1";
      environment.etc."gtk-3.0/settings.ini".source = "${pkgs.pantheon.elementary-default-settings}/etc/gtk-3.0/settings.ini";

-      xdg.portal.extraPortals = [
-        pkgs.pantheon.elementary-files
+      xdg.portal.extraPortals = with pkgs; [
+        pantheon.elementary-files
+        pantheon.elementary-settings-daemon
+        xdg-desktop-portal-pantheon
      ];

      # Override GSettings schemas
@ -266,7 +268,7 @@ in

      fonts.fontconfig.defaultFonts = {
        monospace = [ "Roboto Mono" ];
-        sansSerif = [ "Open Sans" ];
+        sansSerif = [ "Inter" ];
      };
    })

--- a/nixos/modules/services/x11/desktop-managers/pantheon.xml
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.xml
@ -105,7 +105,7 @@ switchboard-with-plugs.override {
    </term>
    <listitem>
     <para>
-      AppCenter has been available since 20.03, but it is of little use. This is because there is no functioning PackageKit backend for Nix 2.0. Starting from 21.11, the Flatpak backend should work so you can install some Flatpak applications using it. See this <link xlink:href="https://github.com/NixOS/nixpkgs/issues/70214">issue</link>.
+      AppCenter has been available since 20.03, but it is of little use. This is because there is no functioning PackageKit backend for Nix 2.0. The Flatpak backend will not work before <link xlink:href="https://github.com/elementary/appcenter/issues/1076">flag for Flatpak-only</link> is provided. See this <link xlink:href="https://github.com/NixOS/nixpkgs/issues/70214">issue</link>.
     </para>
     <para>
      To use AppCenter on NixOS, add <literal>pantheon.appcenter</literal> to <xref linkend="opt-environment.systemPackages" />, <link linkend="module-services-flatpak">enable Flatpak support</link> and optionally add the <literal>appcenter</literal> Flatpak remote:
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -122,6 +122,12 @@ let
          TMPDIR=$(mktemp -d nix-vm.XXXXXXXXXX --tmpdir)
      fi

+      ${lib.optionalString cfg.useNixStoreImage
+      ''
+        # Create a writable copy/snapshot of the store image.
+        ${qemu}/bin/qemu-img create -f qcow2 -F qcow2 -b ${storeImage}/nixos.qcow2 "$TMPDIR"/store.img
+      ''}
+
      # Create a directory for exchanging data with the VM.
      mkdir -p "$TMPDIR/xchg"

@ -171,7 +177,7 @@ let
    '';


-  regInfo = pkgs.closureInfo { rootPaths = config.virtualisation.pathsInNixDB; };
+  regInfo = pkgs.closureInfo { rootPaths = config.virtualisation.additionalPaths; };


  # Generate a hard disk image containing a /boot partition and GRUB
@ -263,11 +269,24 @@ let
        '' # */
    );

+  storeImage = import ../../lib/make-disk-image.nix {
+    inherit pkgs config lib;
+    additionalPaths = [ regInfo ];
+    format = "qcow2";
+    onlyNixStore = true;
+    partitionTableType = "none";
+    installBootLoader = false;
+    diskSize = "auto";
+    additionalSpace = "0M";
+    copyChannel = false;
+  };
+
 in

 {
  imports = [
    ../profiles/qemu-guest.nix
+    (mkRenamedOptionModule [ "virtualisation" "pathsInNixDB" ] [ "virtualisation" "additionalPaths" ])
  ];

  options = {
@ -399,17 +418,23 @@ in
          '';
      };

-    virtualisation.pathsInNixDB =
+    virtualisation.additionalPaths =
      mkOption {
        type = types.listOf types.path;
        default = [];
        description =
          ''
-            The list of paths whose closure is registered in the Nix
-            database in the VM.  All other paths in the host Nix store
+            A list of paths whose closure should be made available to
+            the VM.
+
+            When 9p is used, the closure is registered in the Nix
+            database in the VM. All other paths in the host Nix store
            appear in the guest Nix store as well, but are considered
            garbage (because they are not registered in the Nix
-            database in the guest).
+            database of the guest).
+
+            When <option>virtualisation.useNixStoreImage</option> is
+            set, the closure is copied to the Nix store image.
          '';
      };

@ -608,6 +633,20 @@ in
        };
    };

+    virtualisation.useNixStoreImage =
+      mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Build and use a disk image for the Nix store, instead of
+          accessing the host's one through 9p.
+
+          For applications which do a lot of reads from the store,
+          this can drastically improve performance, but at the cost of
+          disk space and image build time.
+        '';
+      };
+
    virtualisation.useBootLoader =
      mkOption {
        type = types.bool;
@ -740,7 +779,7 @@ in
      '';

    # After booting, register the closure of the paths in
-    # `virtualisation.pathsInNixDB' in the Nix database in the VM.  This
+    # `virtualisation.additionalPaths' in the Nix database in the VM.  This
    # allows Nix operations to work in the VM.  The path to the
    # registration file is passed through the kernel command line to
    # allow `system.build.toplevel' to be included.  (If we had a direct
@ -759,12 +798,21 @@ in

    virtualisation.bootDevice = mkDefault (driveDeviceName 1);

-    virtualisation.pathsInNixDB = [ config.system.build.toplevel ];
+    virtualisation.additionalPaths = [ config.system.build.toplevel ];

    virtualisation.sharedDirectories = {
-      nix-store = { source = "/nix/store"; target = "/nix/store"; };
-      xchg      = { source = ''"$TMPDIR"/xchg''; target = "/tmp/xchg"; };
-      shared    = { source = ''"''${SHARED_DIR:-$TMPDIR/xchg}"''; target = "/tmp/shared"; };
+      nix-store = mkIf (!cfg.useNixStoreImage) {
+        source = builtins.storeDir;
+        target = "/nix/store";
+      };
+      xchg = {
+        source = ''"$TMPDIR"/xchg'';
+        target = "/tmp/xchg";
+      };
+      shared = {
+        source = ''"''${SHARED_DIR:-$TMPDIR/xchg}"'';
+        target = "/tmp/shared";
+      };
    };

    virtualisation.qemu.networkingOptions =
@ -815,6 +863,11 @@ in
        driveExtraOpts.cache = "writeback";
        driveExtraOpts.werror = "report";
      }]
+      (mkIf cfg.useNixStoreImage [{
+        name = "nix-store";
+        file = ''"$TMPDIR"/store.img'';
+        deviceExtraOpts.bootindex = if cfg.useBootLoader then "3" else "2";
+      }])
      (mkIf cfg.useBootLoader [
        # The order of this list determines the device names, see
        # note [Disk layout with `useBootLoader`].
@ -865,6 +918,13 @@ in
            options = [ "mode=1777" "strictatime" "nosuid" "nodev" "size=${toString config.boot.tmpOnTmpfsSize}" ];
          };

+        "/nix/${if cfg.writableStore then ".ro-store" else "store"}" =
+          mkIf cfg.useNixStoreImage
+            { device = "${lookupDriveDeviceName "nix-store" cfg.qemu.drives}";
+              neededForBoot = true;
+              options = [ "ro" ];
+            };
+
        "/nix/.rw-store" = mkIf (cfg.writableStore && cfg.writableStoreUseTmpfs)
          { fsType = "tmpfs";
            options = [ "mode=0755" ];
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -499,7 +499,6 @@ in
  xterm = handleTest ./xterm.nix {};
  yabar = handleTest ./yabar.nix {};
  yggdrasil = handleTest ./yggdrasil.nix {};
-  yq = handleTest ./yq.nix {};
  zfs = handleTest ./zfs.nix {};
  zigbee2mqtt = handleTest ./zigbee2mqtt.nix {};
  zoneminder = handleTest ./zoneminder.nix {};
--- a/nixos/tests/containers-bridge.nix
+++ b/nixos/tests/containers-bridge.nix
@ -56,7 +56,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
        };


-      virtualisation.pathsInNixDB = [ pkgs.stdenv ];
+      virtualisation.additionalPaths = [ pkgs.stdenv ];
    };

  testScript = ''
--- a/nixos/tests/containers-extra_veth.nix
+++ b/nixos/tests/containers-extra_veth.nix
@ -45,7 +45,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
            };
        };

-      virtualisation.pathsInNixDB = [ pkgs.stdenv ];
+      virtualisation.additionalPaths = [ pkgs.stdenv ];
    };

  testScript =
--- a/nixos/tests/containers-imperative.nix
+++ b/nixos/tests/containers-imperative.nix
@ -17,7 +17,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
      virtualisation.memorySize = 1024;
      # Make sure we always have all the required dependencies for creating a
      # container available within the VM, because we don't have network access.
-      virtualisation.pathsInNixDB = let
+      virtualisation.additionalPaths = let
        emptyContainer = import ../lib/eval-config.nix {
          inherit (config.nixpkgs.localSystem) system;
          modules = lib.singleton {
--- a/nixos/tests/containers-ip.nix
+++ b/nixos/tests/containers-ip.nix
@ -27,7 +27,7 @@ in import ./make-test-python.nix ({ pkgs, lib, ... }: {

      containers.webserver4 = webserverFor "10.231.136.1" "10.231.136.2";
      containers.webserver6 = webserverFor "fc00::2" "fc00::1";
-      virtualisation.pathsInNixDB = [ pkgs.stdenv ];
+      virtualisation.additionalPaths = [ pkgs.stdenv ];
    };

  testScript = { nodes, ... }: ''
--- a/nixos/tests/containers-portforward.nix
+++ b/nixos/tests/containers-portforward.nix
@ -29,7 +29,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
            };
        };

-      virtualisation.pathsInNixDB = [ pkgs.stdenv ];
+      virtualisation.additionalPaths = [ pkgs.stdenv ];
    };

  testScript =
--- a/nixos/tests/containers-tmpfs.nix
+++ b/nixos/tests/containers-tmpfs.nix
@ -26,7 +26,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
          config = { };
        };

-      virtualisation.pathsInNixDB = [ pkgs.stdenv ];
+      virtualisation.additionalPaths = [ pkgs.stdenv ];
    };

  testScript = ''
--- a/nixos/tests/discourse.nix
+++ b/nixos/tests/discourse.nix
@ -28,6 +28,8 @@ import ./make-test-python.nix (
      { nodes, ... }:
      {
        virtualisation.memorySize = 2048;
+        virtualisation.cores = 4;
+        virtualisation.useNixStoreImage = true;

        imports = [ common/user-account.nix ];

--- a/nixos/tests/gitlab.nix
+++ b/nixos/tests/gitlab.nix
@ -14,6 +14,8 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : with lib; {
      imports = [ common/user-account.nix ];

      virtualisation.memorySize = if pkgs.stdenv.is64bit then 4096 else 2047;
+      virtualisation.cores = 4;
+      virtualisation.useNixStoreImage = true;
      systemd.services.gitlab.serviceConfig.Restart = mkForce "no";
      systemd.services.gitlab-workhorse.serviceConfig.Restart = mkForce "no";
      systemd.services.gitaly.serviceConfig.Restart = mkForce "no";
--- a/nixos/tests/yq.nix
+++ b/nixos/tests/yq.nix
@ -1,12 +0,0 @@
-import ./make-test-python.nix ({ pkgs, ... }: {
-  name = "yq";
-  meta = with pkgs.lib.maintainers; { maintainers = [ nequissimus ]; };
-
-  nodes.yq = { pkgs, ... }: { environment.systemPackages = with pkgs; [ jq yq ]; };
-
-  testScript = ''
-    assert "hello:\n  foo: bar\n" in yq.succeed(
-        'echo \'{"hello":{"foo":"bar"}}\' | yq -y .'
-    )
-  '';
-})
--- a/pkgs/applications/blockchains/exodus/default.nix
+++ b/pkgs/applications/blockchains/exodus/default.nix
@ -4,11 +4,11 @@ cups, vivaldi-ffmpeg-codecs, libpulseaudio, at-spi2-core, libxkbcommon, mesa }:

 stdenv.mkDerivation rec {
  pname = "exodus";
-  version = "21.8.19";
+  version = "21.10.25";

  src = fetchurl {
    url = "https://downloads.exodus.io/releases/${pname}-linux-x64-${version}.zip";
-    sha256 = "1ssacadx5hdxq0cljb869ds3d11i4fyy3qd5hzh8wk5mlpdnba6k";
+    sha256 = "a85ddda4e73dfadddbb77cf9bc84c30fc6b893ead46367d702976bbf4da5afa4";
  };

  sourceRoot = ".";
--- a/pkgs/applications/editors/emacs/elisp-packages/bqn-mode/default.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/bqn-mode/default.nix
@ -5,13 +5,13 @@

 trivialBuild {
  pname = "bqn-mode";
-  version = "0.pre+unstable=2021-09-27";
+  version = "0.pre+unstable=2021-10-26";

  src = fetchFromGitHub {
    owner = "AndersonTorres";
    repo = "bqn-mode";
-    rev = "5bdc713ade78f11d756231739429440552d7faf8";
-    hash = "sha256-ztGHWKVgMP9N4hV9k0PY9LxqXgHxkycyF3N0eZ+jIZs=";
+    rev = "89d6928d0653518c97bcb06ae156f8b1de1b8768";
+    sha256 = "0pnvfssglaqbjw6hw7vf7vffzjdbqscqhyl62vknml29yl7mjq05";
  };

  meta = with lib; {
--- a/pkgs/applications/editors/kakoune/default.nix
+++ b/pkgs/applications/editors/kakoune/default.nix
@ -4,12 +4,12 @@ with lib;

 stdenv.mkDerivation rec {
  pname = "kakoune-unwrapped";
-  version = "2021.08.28";
+  version = "2021.10.28";
  src = fetchFromGitHub {
    repo = "kakoune";
    owner = "mawww";
    rev = "v${version}";
-    sha256 = "13kc68vkrzg89khir6ayyxgbnmz16dhippcnw09hhzxivf5ayzpy";
+    sha256 = "sha256-ph0063EHyFa7arXvCVD+tGhs8ShyCDYkFVd1w6MZ5Z8=";
  };
  makeFlags = [ "debug=no" "PREFIX=${placeholder "out"}" ];

--- a/pkgs/applications/misc/openlp/lib.nix
+++ b/pkgs/applications/misc/openlp/lib.nix
@ -5,7 +5,7 @@
 # python deps
 , python, buildPythonPackage
 , alembic, beautifulsoup4, chardet, lxml, Mako, pyenchant
-, pyqt5_with_qtwebkit, pyxdg, sip_4, sqlalchemy, sqlalchemy_migrate
+, pyqt5_with_qtwebkit, pyxdg, sip_4, sqlalchemy, sqlalchemy-migrate
 }:

 buildPythonPackage rec {
@ -43,7 +43,7 @@ buildPythonPackage rec {
    pyxdg
    sip_4
    sqlalchemy
-    sqlalchemy_migrate
+    sqlalchemy-migrate
  ];

  prePatch = ''
--- a/pkgs/applications/misc/pytrainer/default.nix
+++ b/pkgs/applications/misc/pytrainer/default.nix
@ -36,7 +36,7 @@ in python.pkgs.buildPythonApplication rec {
  };

  propagatedBuildInputs = with python.pkgs; [
-    sqlalchemy_migrate
+    sqlalchemy-migrate
    python-dateutil
    matplotlib
    lxml
--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "spicetify-cli";
-  version = "2.2.6";
+  version = "2.7.1";

  src = fetchFromGitHub {
    owner = "khanhas";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-9g6rkSDjE7x/YprPX0dkzqgpjgED5qBpUUQoVv6fGkk=";
+    sha256 = "sha256-fWh345J2fD9uoGrDiVZyEBiOlMy8giEGKHGMujT0mjo=";
  };

  vendorSha256 = "sha256-g0RYIVIq4oMXdRZDBDnVYg7ombN5WEo/6O9hChQvOYs=";
--- a/pkgs/applications/misc/tootle/default.nix
+++ b/pkgs/applications/misc/tootle/default.nix
@ -2,7 +2,7 @@
 , fetchFromGitHub
 , nix-update-script
 , fetchpatch
-, vala
+, vala_0_52
 , meson
 , ninja
 , pkg-config
@ -35,7 +35,9 @@ stdenv.mkDerivation rec {
    ninja
    pkg-config
    python3
-    vala
+    # Does not build with vala 0.54
+    # https://github.com/bleakgrey/tootle/issues/337
+    vala_0_52
    wrapGAppsHook
  ];

--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@ -57,6 +57,7 @@ let
    libvirt = callPackage ./libvirt { };
    linuxbox = callPackage ./linuxbox { };
    lxd = callPackage ./lxd { };
+    teleport = callPackage ./teleport { };
    vpsadmin = callPackage ./vpsadmin { };
    vercel = callPackage ./vercel { };
  } // (lib.optionalAttrs (config.allowAliases or false) {
--- a/pkgs/applications/networking/cluster/terraform-providers/teleport/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/teleport/default.nix
@ -0,0 +1,31 @@
+{ lib, fetchFromGitHub, buildGoModule }:
+
+buildGoModule rec {
+  pname = "terraform-provider-teleport";
+  version = "7.3.0";
+
+  src = fetchFromGitHub {
+    owner = "gravitational";
+    repo = "teleport-plugins";
+    rev = "v${version}";
+    sha256 = "19zn78nn64gc0nm7ycblzi4549a0asql07pfxvrphi6s9fjr5m3y";
+  };
+  vendorSha256 = null;
+
+  sourceRoot = "source/terraform";
+
+  # Terraform allow checking the provider versions, but this breaks
+  # if the versions are not provided via file paths.
+  postBuild = ''
+    mv $NIX_BUILD_TOP/go/bin/{terraform,terraform-provider-teleport_v${version}}
+  '';
+
+  passthru.provider-source-address = "gravitational.com/teleport/teleport";
+
+  meta = with lib; {
+    description = "Provider for managing resources in Teleport, a SSH CA management suite";
+    homepage = "https://github.com/gravitational/teleport-plugins";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ justinas ];
+  };
+}
--- a/pkgs/applications/networking/feedreaders/newsboat/default.nix
+++ b/pkgs/applications/networking/feedreaders/newsboat/default.nix
@ -3,16 +3,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "newsboat";
-  version = "2.24";
+  version = "2.25";

  src = fetchFromGitHub {
    owner = "newsboat";
    repo = "newsboat";
    rev = "r${version}";
-    sha256 = "0qb10w7pn9hiczjjpc0xanmc83p22ngcqcrkjwji5rl0sh8v9ii4";
+    sha256 = "sha256-TAnGDxTKYl4niouS6nYdJDaIngAPsPHr9Bw9L3cR2Xk=";
  };

-  cargoSha256 = "0vhr8qyw4f3lc208mgl1m3z42igkbwly6wcv7g7jrq3c6dcwyhjn";
+  cargoSha256 = "sha256-MxoyYBLbrCuLVa0p8JrYKSKu2oFPnXMwab42lhhAu48=";

  # TODO: Check if that's still needed
  postPatch = lib.optionalString stdenv.isDarwin ''
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@ -2,14 +2,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "flexget";
-  version = "3.1.140";
+  version = "3.1.148";

  # Fetch from GitHub in order to use `requirements.in`
  src = fetchFromGitHub {
    owner = "flexget";
    repo = "flexget";
    rev = "v${version}";
-    sha256 = "15ngmpqqx902l7gxg2lb6h8q8vmjk247jbqhc92l1apr1imjqcc5";
+    sha256 = "0gf07qa1wsysvl0mckh2r3a40065rxhgszf4767jkbryz8z174bc";
  };

  postPatch = ''
@ -32,38 +32,36 @@ python3Packages.buildPythonApplication rec {
    # See https://github.com/Flexget/Flexget/blob/master/requirements.in
    APScheduler
    beautifulsoup4
-    cherrypy
-    colorama
-    colorclass
    feedparser
-    flask-compress
-    flask-cors
-    flask_login
-    flask-restful
-    flask-restx
-    flask
-    greenlet
    guessit
    html5lib
    jinja2
    jsonschema
    loguru
    more-itertools
-    progressbar
+    psutil
    pynzb
-    pyparsing
    PyRSS2Gen
    python-dateutil
    pyyaml
    rebulk
    requests
+    rich
    rpyc
-    sgmllib3k
    sqlalchemy
-    terminaltables
+
+    # WebUI requirements
+    cherrypy
+    flask-compress
+    flask-cors
+    flask_login
+    flask-restful
+    flask-restx
+    flask
+    pyparsing
    zxcvbn
-    psutil
-    # plugins
+
+    # Plugins requirements
    transmission-rpc
  ];

--- a/pkgs/applications/networking/instant-messengers/gajim/default.nix
+++ b/pkgs/applications/networking/instant-messengers/gajim/default.nix
@ -21,11 +21,11 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "gajim";
-  version = "1.3.2";
+  version = "1.3.3";

  src = fetchurl {
    url = "https://gajim.org/downloads/${lib.versions.majorMinor version}/gajim-${version}.tar.gz";
-    sha256 = "1vjzv8zg9s393xw81klcgbkn4h6j2blzla9iil5kqfrw7wmldskh";
+    sha256 = "1337qkpcv7j0fgws9scnk82mn2l7s17060vmrbh3ihinmxmbxg6x";
  };

  buildInputs = [
@ -57,9 +57,6 @@ python3.pkgs.buildPythonApplication rec {
  checkInputs = [ xvfb-run dbus.daemon ];

  checkPhase = ''
-    # https://dev.gajim.org/gajim/gajim/-/issues/10478
-    rm test/lib/gajim_mocks.py test/unit/test_gui_interface.py
-
    xvfb-run dbus-run-session \
      --config-file=${dbus.daemon}/share/dbus-1/session.conf \
      ${python3.interpreter} setup.py test
--- a/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin-plugins/purple-discord/default.nix
@ -1,17 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, pidgin, json-glib }:
+{ lib, stdenv, fetchFromGitHub, imagemagick, gettext, pidgin, json-glib }:

 stdenv.mkDerivation {
  pname = "purple-discord";
-  version = "unstable-2018-04-10";
+  version = "unstable-2021-10-17";

  src = fetchFromGitHub {
    owner = "EionRobb";
    repo = "purple-discord";
-    rev = "9a97886d15a1f028de54b5e6fc54e784531063b0";
-    sha256 = "0dc344zh1v4yh9c8javcw5ylzwc1wpx0ih8bww8p8cjmhr8kcl32";
+    rev = "b7ac72399218d2ce011ac84bb171b572560aa2d2";
+    sha256 = "0xvj9rdvgsvcr55sk9m40y07rchg699l1yr98xqwx7sc2sba3814";
  };

-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [ imagemagick gettext ];
  buildInputs = [ pidgin json-glib ];

  PKG_CONFIG_PURPLE_PLUGINDIR = "${placeholder "out"}/lib/purple-2";
--- a/pkgs/applications/networking/instant-messengers/schildichat/pin.json
+++ b/pkgs/applications/networking/instant-messengers/schildichat/pin.json
@ -0,0 +1,6 @@
+{
+  "version": "1.9.0-sc.1",
+  "srcHash": "10swz5gwz1izryzllmjm8mhhd0vqk2cp8qjcmmr5gbzspj7p3xgw",
+  "webYarnHash": "134llyh0197andpnbmfcxnidcgi3xxnb9v10bwfvrqysgnhb5z8v",
+  "desktopYarnHash": "150jc6p9kbdz599bdkinrhbhncpamhz35j6rcc008qxg2d9qfhwr"
+}
--- a/pkgs/applications/networking/instant-messengers/schildichat/schildichat-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/schildichat/schildichat-desktop.nix
@ -0,0 +1,128 @@
+{ lib
+, element-desktop # for seshat and keytar
+, schildichat-web
+, stdenv
+, fetchgit
+, makeWrapper
+, makeDesktopItem
+, copyDesktopItems
+, fetchYarnDeps
+, yarn, nodejs, fixup_yarn_lock
+, electron
+, Security
+, AppKit
+, CoreServices
+
+, useWayland ? false
+}:
+
+let
+  pinData = lib.importJSON ./pin.json;
+  executableName = "schildichat-desktop";
+  electron_exec = if stdenv.isDarwin then "${electron}/Applications/Electron.app/Contents/MacOS/Electron" else "${electron}/bin/electron";
+in
+stdenv.mkDerivation rec {
+  pname = "schildichat-desktop";
+  inherit (pinData) version;
+
+  src = fetchgit {
+    url = "https://github.com/SchildiChat/schildichat-desktop/";
+    rev = "v${version}";
+    sha256 = pinData.srcHash;
+    fetchSubmodules = true;
+  };
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = src + "/element-desktop/yarn.lock";
+    sha256 = pinData.desktopYarnHash;
+  };
+
+  nativeBuildInputs = [ yarn fixup_yarn_lock nodejs makeWrapper copyDesktopItems ];
+  inherit (element-desktop) seshat keytar;
+
+  configurePhase = ''
+    runHook preConfigure
+
+    export HOME=$(mktemp -d)
+    pushd element-desktop
+    yarn config --offline set yarn-offline-mirror $offlineCache
+    fixup_yarn_lock yarn.lock
+    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
+    rm -rf node_modules/matrix-seshat node_modules/keytar
+    ln -s $keytar node_modules/keytar
+    ln -s $seshat node_modules/matrix-seshat
+    patchShebangs node_modules/
+    popd
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    pushd element-desktop
+    npx tsc
+    yarn run i18n
+    node ./scripts/copy-res.js
+    popd
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    # resources
+    mkdir -p "$out/share/element"
+    ln -s '${schildichat-web}' "$out/share/element/webapp"
+    mv element-desktop "$out/share/element/electron"
+    cp -r "$out/share/element/electron/res/img" "$out/share/element"
+    cp $out/share/element/electron/lib/i18n/strings/en_EN.json $out/share/element/electron/lib/i18n/strings/en-us.json
+    ln -s $out/share/element/electron/lib/i18n/strings/en{-us,}.json
+
+    # icons
+    for icon in $out/share/element/electron/build/icons/*.png; do
+      mkdir -p "$out/share/icons/hicolor/$(basename $icon .png)/apps"
+      ln -s "$icon" "$out/share/icons/hicolor/$(basename $icon .png)/apps/schildichat.png"
+    done
+
+    # executable wrapper
+    makeWrapper '${electron_exec}' "$out/bin/${executableName}" \
+      --add-flags "$out/share/element/electron${lib.optionalString useWayland " --enable-features=UseOzonePlatform --ozone-platform=wayland"}"
+
+    runHook postInstall
+  '';
+
+  # Do not attempt generating a tarball for element-web again.
+  # note: `doDist = false;` does not work.
+  distPhase = ";";
+
+  # The desktop item properties should be kept in sync with data from upstream:
+  # https://github.com/schildichat/element-desktop/blob/sc/package.json
+  desktopItems = [
+    (makeDesktopItem {
+     name = "schildichat-desktop";
+     exec = "${executableName} %u";
+     icon = "schildichat";
+     desktopName = "SchildiChat";
+     genericName = "Matrix Client";
+     comment = meta.description;
+     categories = "Network;InstantMessaging;Chat;";
+     extraEntries = ''
+       StartupWMClass=schildichat
+       MimeType=x-scheme-handler/element;
+     '';
+    })
+  ];
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Matrix client / Element Desktop fork";
+    homepage = "https://schildi.chat/";
+    changelog = "https://github.com/SchildiChat/schildichat-desktop/releases";
+    maintainers = lib.teams.matrix.members;
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/schildichat/schildichat-web.nix
+++ b/pkgs/applications/networking/instant-messengers/schildichat/schildichat-web.nix
@ -0,0 +1,86 @@
+{ stdenv, lib
+, fetchgit
+, fetchYarnDeps
+, nodejs
+, yarn
+, fixup_yarn_lock
+, writeText, jq, conf ? {}
+}:
+
+let
+  pinData = builtins.fromJSON (builtins.readFile ./pin.json);
+  noPhoningHome = {
+    disable_guests = true; # disable automatic guest account registration at matrix.org
+  };
+  configOverrides = writeText "element-config-overrides.json" (builtins.toJSON (noPhoningHome // conf));
+
+in stdenv.mkDerivation rec {
+  pname = "schildichat-web";
+  inherit (pinData) version;
+
+  src = fetchgit {
+    url = "https://github.com/SchildiChat/schildichat-desktop/";
+    rev = "v${version}";
+    sha256 = pinData.srcHash;
+    fetchSubmodules = true;
+  };
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = src + "/element-web/yarn.lock";
+    sha256 = pinData.webYarnHash;
+  };
+
+  nativeBuildInputs = [ yarn fixup_yarn_lock jq nodejs ];
+
+  configurePhase = ''
+    runHook preConfigure
+
+    export HOME=$PWD/tmp
+    mkdir -p $HOME
+    pushd element-web
+    yarn config --offline set yarn-offline-mirror $offlineCache
+    fixup_yarn_lock yarn.lock
+    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
+    rm -rf node_modules/matrix-react-sdk
+    patchShebangs node_modules/ ../matrix-react-sdk/scripts/
+    ln -s $PWD/../matrix-react-sdk node_modules/
+    ln -s $PWD/node_modules ../matrix-react-sdk/
+    popd
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    pushd matrix-react-sdk
+    node_modules/.bin/reskindex -h ../element-web/src/header
+    popd
+
+    pushd element-web
+    node scripts/copy-res.js
+    node_modules/.bin/reskindex -h ../element-web/src/header
+    node_modules/.bin/webpack --progress --mode production
+    popd
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mv element-web/webapp $out
+    jq -s '.[0] * .[1]' "configs/sc/config.json" "${configOverrides}" > "$out/config.json"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Matrix client / Element Web fork";
+    homepage = "https://schildi.chat/";
+    changelog = "https://github.com/SchildiChat/schildichat-desktop/releases";
+    maintainers = lib.teams.matrix.members;
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/schildichat/update.sh
+++ b/pkgs/applications/networking/instant-messengers/schildichat/update.sh
@ -0,0 +1,35 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -I nixpkgs=../../../../../ -i bash -p nix wget prefetch-yarn-deps nix-prefetch-git jq
+
+if [[ "$#" -gt 1 || "$1" == -* ]]; then
+  echo "Regenerates packaging data for the SchildiChat packages."
+  echo "Usage: $0 [git release tag]"
+  exit 1
+fi
+
+version="$1"
+
+set -euo pipefail
+
+if [ -z "$version" ]; then
+  version="$(wget -O- "https://api.github.com/repos/SchildiChat/schildichat-desktop/releases?per_page=1" | jq -r '.[0].tag_name')"
+fi
+
+# strip leading "v"
+version="${version#v}"
+
+src_data=$(nix-prefetch-git https://github.com/SchildiChat/schildichat-desktop --fetch-submodules --rev v${version})
+src=$(echo $src_data | jq -r .path)
+src_hash=$(echo $src_data | jq -r .sha256)
+
+web_yarn_hash=$(prefetch-yarn-deps $src/element-web/yarn.lock)
+desktop_yarn_hash=$(prefetch-yarn-deps $src/element-desktop/yarn.lock)
+
+cat > pin.json << EOF
+{
+  "version": "$version",
+  "srcHash": "$src_hash",
+  "webYarnHash": "$web_yarn_hash",
+  "desktopYarnHash": "$desktop_yarn_hash"
+}
+EOF
--- a/pkgs/applications/networking/instant-messengers/session-desktop-appimage/default.nix
+++ b/pkgs/applications/networking/instant-messengers/session-desktop-appimage/default.nix
@ -4,13 +4,13 @@
 }:

 let
-  version = "1.7.3";
+  version = "1.7.4";
 in
 appimageTools.wrapType2 {
  name = "session-desktop-appimage-${version}";
  src = fetchurl {
    url = "https://github.com/oxen-io/session-desktop/releases/download/v${version}/session-desktop-linux-x86_64-${version}.AppImage";
-    sha256 = "0s0zvj9ddrngdzsx8hd07pq3150sq8ab1hbpsi9i2ir99sv1p7gn";
+    sha256 = "1yjah9ip3r2irvv2g9j0ql55nkmpwml7lngmq954xrkq9smrdrm5";
  };

  meta = with lib; {
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@ -10,6 +10,7 @@
 , hunspellDicts, spellcheckerLanguage ? null # E.g. "de_DE"
 # For a full list of available languages:
 # $ cat pkgs/development/libraries/hunspell/dictionaries.nix | grep "dictFileName =" | awk '{ print $3 }'
+, sqlcipher
 }:

 let
@ -21,6 +22,40 @@ let
    in lib.optionalString (spellcheckerLanguage != null) ''
      --set HUNSPELL_DICTIONARIES "${hunspellDicts.${hunspellDict}}/share/hunspell" \
      --set LC_MESSAGES "${spellcheckerLanguage}"'');
+
+  sqlcipher-signal = sqlcipher.overrideAttrs (_: {
+    # Using the same features as the upstream signal sqlcipher build
+    # https://github.com/signalapp/better-sqlite3/blob/2fa02d2484e9f9a10df5ac7ea4617fb2dff30006/deps/defines.gypi
+    CFLAGS = [
+      "-DSQLITE_LIKE_DOESNT_MATCH_BLOBS"
+      "-DSQLITE_THREADSAFE=2"
+      "-DSQLITE_USE_URI=0"
+      "-DSQLITE_DEFAULT_MEMSTATUS=0"
+      "-DSQLITE_OMIT_DEPRECATED"
+      "-DSQLITE_OMIT_GET_TABLE"
+      "-DSQLITE_OMIT_TCL_VARIABLE"
+      "-DSQLITE_OMIT_PROGRESS_CALLBACK"
+      "-DSQLITE_OMIT_SHARED_CACHE"
+      "-DSQLITE_TRACE_SIZE_LIMIT=32"
+      "-DSQLITE_DEFAULT_CACHE_SIZE=-16000"
+      "-DSQLITE_DEFAULT_FOREIGN_KEYS=1"
+      "-DSQLITE_DEFAULT_WAL_SYNCHRONOUS=1"
+      "-DSQLITE_ENABLE_COLUMN_METADATA"
+      "-DSQLITE_ENABLE_UPDATE_DELETE_LIMIT"
+      "-DSQLITE_ENABLE_STAT4"
+      "-DSQLITE_ENABLE_FTS5"
+      "-DSQLITE_ENABLE_JSON1"
+      "-DSQLITE_ENABLE_RTREE"
+      "-DSQLITE_INTROSPECTION_PRAGMAS"
+
+      # SQLCipher-specific options
+      "-DSQLITE_HAS_CODEC"
+      "-DSQLITE_TEMP_STORE=2"
+      "-DSQLITE_SECURE_DELETE"
+    ];
+
+    LDFLAGS = [ "-lm" ];
+  });
 in stdenv.mkDerivation rec {
  pname = "signal-desktop";
  version = "5.21.0"; # Please backport all updates to the stable channel.
@ -115,15 +150,10 @@ in stdenv.mkDerivation rec {
    runHook postInstall
  '';

-  # Required for $SQLCIPHER_LIB which contains "/build/" inside the path:
-  noAuditTmpdir = true;
-
  preFixup = ''
-    export SQLCIPHER_LIB="$out/lib/Signal/resources/app.asar.unpacked/node_modules/better-sqlite3/build/Release/better_sqlite3.node"
-    test -x "$SQLCIPHER_LIB" # To ensure the location hasn't changed
    gappsWrapperArgs+=(
      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc ] }"
-      --prefix LD_PRELOAD : "$SQLCIPHER_LIB"
+      --prefix LD_PRELOAD : "${sqlcipher-signal}/lib/libsqlcipher.so"
      ${customLanguageWrapperArgs}
    )

--- a/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
+++ b/pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix
@ -3,12 +3,12 @@ electron, libsecret }:

 stdenv.mkDerivation rec {
  pname = "tutanota-desktop";
-  version = "3.88.4";
+  version = "3.89.5";

  src = fetchurl {
    url = "https://github.com/tutao/tutanota/releases/download/tutanota-release-${version}/${pname}-${version}-unpacked-linux.tar.gz";
    name = "tutanota-desktop-${version}.tar.gz";
-    sha256 = "sha256-UOb63+NfW6mHKaj3PDEzvz5hcmJBIISq02rtwgSZMjo=";
+    sha256 = "sha256-DBqeLoHPr/OwiA3cWO5MYoHSBqrEmP8j8q+rd50hYH8=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/protonvpn-gui/default.nix
+++ b/pkgs/applications/networking/protonvpn-gui/default.nix
@ -1,90 +1,54 @@
-{ lib, fetchFromGitHub, makeDesktopItem, makeWrapper, imagemagick
-, python3Packages, wrapGAppsHook, protonvpn-cli, gtk3, pango
-, gobject-introspection, libnotify, libappindicator-gtk3
-, procps, openvpn }:
+{ lib, fetchFromGitHub, gobject-introspection, imagemagick,
+wrapGAppsHook, python3Packages, gtk3, networkmanager, webkitgtk }:

-let
-  extraPath = lib.makeBinPath [ procps openvpn ];
-
-in python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "protonvpn-linux-gui";
-  version = "2.1.1";
+  version = "1.4.1";

  src = fetchFromGitHub {
-    owner = "protonvpn";
-    repo = "linux-gui";
-    rev = "v${version}";
-    sha256 = "avo5/2eq53HSHCnnjtxrsmpURtHvxmLZn2BxActImGY=";
+    owner = "ProtonVPN";
+    repo = "linux-app";
+    rev = version;
+    sha256 = "sha256-08gXEKm8udgNltRdqvAMFL0pDCWZu/kfl1xGQtZPBCc=";
  };

-  desktopItem = makeDesktopItem {
-    name = "ProtonVPN";
-    desktopName = "ProtonVPN GUI";
-    type = "Application";
-    exec = "protonvpn-gui";
-    icon = "protonvpn";
-    categories = "Network;";
-    terminal = "false";
-  };
+  strictDeps = false;

-  trayDesktopItem = makeDesktopItem {
-    name = "ProtonVPN Tray";
-    desktopName = "ProtonVPN Tray";
-    type = "Application";
-    exec = "protonvpn-tray";
-    icon = "protonvpn";
-    categories = "Network;";
-    terminal = "false";
-  };
+  nativeBuildInputs = [
+    gobject-introspection imagemagick wrapGAppsHook
+  ];

-  nativeBuildInputs = [ wrapGAppsHook makeWrapper imagemagick ];
+  propagatedBuildInputs = with python3Packages; [
+    protonvpn-nm-lib
+    psutil
+  ];

-  propagatedBuildInputs = (with python3Packages; [
-      pygobject3
-      pycairo
-      requests
-      configparser
-    ]) ++ [
-      protonvpn-cli
-      gtk3
-      gobject-introspection
-      libnotify
-      libappindicator-gtk3
-    ];
+  buildInputs = [
+    gtk3 networkmanager webkitgtk
+  ];

-  prePatch = ''
-    # if pkexec is used, we want to have more time to enter password
-    substituteInPlace linux_gui/services/login_service.py --replace 'timeout=8' 'timeout=30'
-  '';
-
-  postInstall = ''
-    # wrap binaries with extra required path
-    wrapProgram "$out/bin/protonvpn-tray" --prefix PATH ":" ${extraPath}
-    wrapProgram "$out/bin/protonvpn-gui" --prefix PATH ":" ${extraPath}
-
-    # install desktop files
-    mkdir -p $out/share/applications
-    cp "$desktopItem/share/applications/ProtonVPN.desktop" $out/share/applications/protonvpn-gui.desktop
-    cp "$trayDesktopItem/share/applications/ProtonVPN Tray.desktop" $out/share/applications/protonvpn-tray.desktop
-
-    # create icons
+  postFixup = ''
+    # Setting icons
    for size in 16 32 48 64 72 96 128 192 512 1024; do
      mkdir -p $out/share/icons/hicolor/"$size"x"$size"/apps
-      convert -resize "$size"x"$size" \
-        linux_gui/resources/img/logo/protonvpn_logo.png \
-        $out/share/icons/hicolor/"$size"x"$size"/apps/protonvpn.png
+      convert -resize $size'x'$size \
+        protonvpn_gui/assets/icons/protonvpn-logo.png \
+        $out/share/icons/hicolor/$size'x'$size/apps/protonvpn.png
    done
+
+    install -Dm644 protonvpn.desktop -t $out/share/applications/
+    substituteInPlace $out/share/applications/protonvpn.desktop \
+      --replace 'protonvpn-logo' protonvpn
  '';

-  # no tests
+  # Project has a dummy test
  doCheck = false;

  meta = with lib; {
    description = "Linux GUI for ProtonVPN, written in Python";
-    homepage = "https://github.com/ProtonVPN/linux-gui";
-    maintainers = with maintainers; [ offline ];
+    homepage = "https://github.com/ProtonVPN/linux-app";
+    maintainers = with maintainers; [ offline wolfangaukang ];
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
-    mainProgram = "protonvpn-gui";
  };
 }
--- a/pkgs/applications/networking/seafile-client/default.nix
+++ b/pkgs/applications/networking/seafile-client/default.nix
@ -29,6 +29,6 @@ mkDerivation rec {
    description = "Desktop client for Seafile, the Next-generation Open Source Cloud Storage";
    license = licenses.asl20;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ eduardosm ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/office/vnote/default.nix
+++ b/pkgs/applications/office/vnote/default.nix
@ -8,14 +8,14 @@

 mkDerivation rec {
  pname = "vnote";
-  version = "3.7.0";
+  version = "3.8.1";

  src = fetchFromGitHub {
    owner = "vnotex";
    repo = pname;
    fetchSubmodules = true;
    rev = "v${version}";
-    sha256 = "sha256-D9/4BakXTComvGTV8F131G5PzA8LhWfNSZRBOMo5t5c=";
+    sha256 = "sha256-GgSVBVcT0rfgglyjCmkEMbKCEltesC3eSsN38psrkS4=";
  };

  nativeBuildInputs = [ qmake ];
--- a/pkgs/applications/radio/pothos/default.nix
+++ b/pkgs/applications/radio/pothos/default.nix
@ -69,6 +69,6 @@ mkDerivation rec {
    homepage = "https://github.com/pothosware/PothosCore/wiki";
    license = licenses.boost;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ eduardosm ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/science/electronics/diylc/default.nix
+++ b/pkgs/applications/science/electronics/diylc/default.nix
@ -71,6 +71,6 @@ stdenv.mkDerivation rec {
    changelog = "https://github.com/bancika/diy-layout-creator/releases";
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ eduardosm ];
+    maintainers = with maintainers; [ ];
  };
 }
--- a/pkgs/applications/science/math/pcalc/default.nix
+++ b/pkgs/applications/science/math/pcalc/default.nix
@ -19,8 +19,8 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    homepage = "https://vapier.github.io/pcalc/";
    description = "Programmer's calculator";
-    license = licenses.gpl2;
-    maintainers = with lib.maintainers; [ ftrvxmtrx ];
-    platforms = lib.platforms.linux;
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ ftrvxmtrx ];
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
@ -1,12 +1,7 @@
-{ lib, stdenv
-, fetchurl
-, cmake
-, hwloc
-, fftw
-, perl
+{ lib, stdenv, fetchurl, cmake, hwloc, fftw, perl, blas, lapack, mpi, cudatoolkit
 , singlePrec ? true
-, mpiEnabled ? false
-, mpi
+, enableMpi ? false
+, enableCuda ? false
 , cpuAcceleration ? null
 }:

@ -24,20 +19,32 @@ let

 in stdenv.mkDerivation rec {
  pname = "gromacs";
-  version = "2020.4";
+  version = "2021.3";

  src = fetchurl {
    url = "ftp://ftp.gromacs.org/pub/gromacs/gromacs-${version}.tar.gz";
-    sha256 = "1rplvgna60nqyb8nspaz3bfkwb044kv3zxdaa5whql5m441nj6am";
+    sha256 = "4QmFbsREdo373kHzBZ4xI6vbj+Vsozsag/Me1FdaHMY=";
  };

  nativeBuildInputs = [ cmake ];
-  buildInputs = [ fftw perl hwloc ]
-  ++ (lib.optionals mpiEnabled [ mpi ]);
+
+  buildInputs = [
+    fftw
+    perl
+    hwloc
+    blas
+    lapack
+  ] ++ lib.optional enableMpi mpi
+    ++ lib.optional enableCuda cudatoolkit
+  ;
+
+  propagatedBuildInputs = lib.optional enableMpi mpi;
+  propagatedUserEnvPkgs = lib.optional enableMpi mpi;

  cmakeFlags = [
    "-DGMX_SIMD:STRING=${SIMD cpuAcceleration}"
    "-DGMX_OPENMP:BOOL=TRUE"
+    "-DBUILD_SHARED_LIBS=ON"
  ] ++ (
    if singlePrec then [
      "-DGMX_DOUBLE=OFF"
@ -46,13 +53,15 @@ in stdenv.mkDerivation rec {
      "-DGMX_DEFAULT_SUFFIX=OFF"
    ]
  ) ++ (
-    if mpiEnabled then [
-      "-DGMX_MPI:BOOL=TRUE"
-      "-DGMX_THREAD_MPI:BOOL=FALSE"
-    ] else [
-      "-DGMX_MPI:BOOL=FALSE"
-    ]
-  );
+    if enableMpi
+      then [
+        "-DGMX_MPI:BOOL=TRUE"
+        "-DGMX_THREAD_MPI:BOOL=FALSE"
+      ]
+     else [
+       "-DGMX_MPI:BOOL=FALSE"
+     ]
+  ) ++ lib.optional enableCuda "-DGMX_GPU=CUDA";

  meta = with lib; {
    homepage = "http://www.gromacs.org";
@ -78,5 +87,6 @@ in stdenv.mkDerivation rec {
      See: http://www.gromacs.org/About_Gromacs for details.
    '';
    platforms = platforms.unix;
+    maintainers = with maintainers; [ sheepforce markuskowa ];
  };
 }
--- a/pkgs/applications/system/monitor/default.nix
+++ b/pkgs/applications/system/monitor/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , nix-update-script
 , meson
@ -13,18 +14,21 @@
 , libwnck
 , libgee
 , libgtop
+, libhandy
+, sassc
+, udisks2
 , wrapGAppsHook
 }:

 stdenv.mkDerivation rec {
  pname = "monitor";
-  version = "0.10.0";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "stsdc";
    repo = "monitor";
    rev = version;
-    sha256 = "sha256-Gin/1vbQbOAKFrjzDuDTNDQlTGTIlb0NUfIWWXd5tQ4=";
+    sha256 = "sha256-xWhhjn7zk/juXx50wLG2TpB5aqU+588kWBBquWrVJbM=";
    fetchSubmodules = true;
  };

@ -45,7 +49,10 @@ stdenv.mkDerivation rec {
    pantheon.wingpanel
    libgee
    libgtop
+    libhandy
    libwnck
+    sassc
+    udisks2
  ];

  postPatch = ''
@ -70,5 +77,6 @@ stdenv.mkDerivation rec {
    maintainers = with maintainers; [ xiorcale ] ++ teams.pantheon.members;
    platforms = platforms.linux;
    license = licenses.gpl3;
+    mainProgram = "com.github.stsdc.monitor";
  };
 }
--- a/pkgs/applications/terminal-emulators/alacritty/default.nix
+++ b/pkgs/applications/terminal-emulators/alacritty/default.nix
@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , rustPlatform

 , cmake
@ -87,6 +88,14 @@ rustPlatform.buildRustPackage rec {

  outputs = [ "out" "terminfo" ];

+  patches = [
+    # Handle PTY EIO error for Rust 1.55+
+    (fetchpatch {
+      url = "https://github.com/alacritty/alacritty/commit/58985a4dcbe464230b5d2566ee68e2d34a1788c8.patch";
+      sha256 = "sha256-Z6589yRrQtpx3/vNqkMiGgGsLysd/QyfaX7trqX+k5c=";
+    })
+  ];
+
  postPatch = ''
    substituteInPlace alacritty/src/config/ui_config.rs \
      --replace xdg-open ${xdg-utils}/bin/xdg-open
--- a/pkgs/applications/version-management/git-and-tools/delta/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/delta/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "delta";
-  version = "0.8.3";
+  version = "0.9.1";

  src = fetchFromGitHub {
    owner = "dandavison";
    repo = pname;
    rev = version;
-    sha256 = "sha256-lwdsl3dzqrIL1JoBFmldwsCvNCWUcTlgeoEoCvmlTCQ=";
+    sha256 = "sha256-LyKkkQlYdCyvlru+o/QeA7CDWYgCRTFKAdAjJxJX+oM=";
  };

-  cargoSha256 = "sha256-7TvxkSJ3iWJnjD3Xe7WDXBNWIyl8U9XTCn9muUG1AmI=";
+  cargoSha256 = "sha256-+ao2nVRkXNWs00oUiATgzsDTfPo09BV66AioZQqBhGk=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/version-management/gitea/default.nix
+++ b/pkgs/applications/version-management/gitea/default.nix
@ -16,12 +16,12 @@ with lib;

 buildGoPackage rec {
  pname = "gitea";
-  version = "1.15.5";
+  version = "1.15.6";

  # not fetching directly from the git repo, because that lacks several vendor files for the web UI
  src = fetchurl {
    url = "https://github.com/go-gitea/gitea/releases/download/v${version}/gitea-src-${version}.tar.gz";
-    sha256 = "sha256-W+czWzo4keTLRPDLcTeYl3JSccwfq+P6k4ELADO9FVM=";
+    sha256 = "sha256-FMM/iQAxJcymv4jYBzaBXG0Uy8UxHh9gFWB5gzV9cn0=";
  };

  unpackPhase = ''
--- a/pkgs/applications/version-management/github-desktop/default.nix
+++ b/pkgs/applications/version-management/github-desktop/default.nix
@ -19,11 +19,11 @@

 stdenv.mkDerivation rec {
  pname = "github-desktop";
-  version = "2.9.3";
+  version = "2.9.4";

  src = fetchurl {
    url = "https://github.com/shiftkey/desktop/releases/download/release-${version}-linux1/GitHubDesktop-linux-${version}-linux1.deb";
-    sha256 = "sha256-e3XDjVQ5VcsS/MGxNsDs2h77joZAz8mNn+SwrqiUAR0=";
+    sha256 = "sha256-CcAOATIEcrUKhVQWFr0dMvY9Q5rHWQI9/KdSEZ/ncD4=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,14 +1,14 @@
 {
-  "version": "14.3.3",
-  "repo_hash": "1sh8lf6arqljzc0hmajl2r2j38ahk9hl6kikg9inw72xycrll7dk",
-  "yarn_hash": "0b6brkxg93gv4gjp1f7qlx7v7q7mb8z9vikcz98igdnhm46nl4dn",
+  "version": "14.4.0",
+  "repo_hash": "1hkx30abwbhwrlwr4sykpjgsk8k2k375d9xl1pxjhg3n8vwqncs8",
+  "yarn_hash": "0l0lgcgxaira980a1y550pfsm4f2pw97gi8s5pghyfil2v2lyxyw",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v14.3.3-ee",
+  "rev": "v14.4.0-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "14.3.3",
-    "GITLAB_PAGES_VERSION": "1.44.0",
+    "GITALY_SERVER_VERSION": "14.4.0",
+    "GITLAB_PAGES_VERSION": "1.46.0",
    "GITLAB_SHELL_VERSION": "13.21.1",
-    "GITLAB_WORKHORSE_VERSION": "14.3.3"
+    "GITLAB_WORKHORSE_VERSION": "14.4.0"
  }
 }
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@ -95,6 +95,8 @@ let

      bundle exec rake gettext:po_to_json RAILS_ENV=production NODE_ENV=production
      bundle exec rake rake:assets:precompile RAILS_ENV=production NODE_ENV=production
+      # hack: rake gettext:po_to_json breaks the node_modules folder. We repair it by patching the shebangs again.
+      patchShebangs node_modules/
      bundle exec rake gitlab:assets:compile_webpack_if_needed RAILS_ENV=production NODE_ENV=production
      bundle exec rake gitlab:assets:fix_urls RAILS_ENV=production NODE_ENV=production
      bundle exec rake gitlab:assets:check_page_bundle_mixins_css_for_sideeffects RAILS_ENV=production NODE_ENV=production
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile
@ -3,7 +3,7 @@ source 'https://rubygems.org'
 gem 'rugged', '~> 1.1'
 gem 'github-linguist', '~> 7.12', require: 'linguist'
 gem 'gitlab-markup', '~> 1.7.1'
-gem 'activesupport', '~> 6.1.3.2'
+gem 'activesupport', '~> 6.1.4.1'
 gem 'rdoc', '~> 6.0'
 gem 'gitlab-gollum-lib', '~> 4.2.7.10.gitlab.1', require: false
 gem 'gitlab-gollum-rugged_adapter', '~> 0.4.4.4.gitlab.1', require: false
@ -13,7 +13,7 @@ gem 'faraday', '~> 1.0'
 gem 'rbtrace', require: false

 # Labkit provides observability functionality
-gem 'gitlab-labkit', '~> 0.20.0'
+gem 'gitlab-labkit', '~> 0.21.1'

 # Detects the open source license the repository includes
 # This version needs to be in sync with GitLab CE/EE
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
@ -2,20 +2,20 @@ GEM
  remote: https://rubygems.org/
  specs:
    abstract_type (0.0.7)
-    actionpack (6.1.3.2)
-      actionview (= 6.1.3.2)
-      activesupport (= 6.1.3.2)
+    actionpack (6.1.4.1)
+      actionview (= 6.1.4.1)
+      activesupport (= 6.1.4.1)
      rack (~> 2.0, >= 2.0.9)
      rack-test (>= 0.6.3)
      rails-dom-testing (~> 2.0)
      rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actionview (6.1.3.2)
-      activesupport (= 6.1.3.2)
+    actionview (6.1.4.1)
+      activesupport (= 6.1.4.1)
      builder (~> 3.1)
      erubi (~> 1.4)
      rails-dom-testing (~> 2.0)
      rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activesupport (6.1.3.2)
+    activesupport (6.1.4.1)
      concurrent-ruby (~> 1.0, >= 1.0.2)
      i18n (>= 1.6, < 2)
      minitest (>= 5.1)
@ -65,10 +65,10 @@ GEM
    gitlab-gollum-rugged_adapter (0.4.4.4.gitlab.1)
      mime-types (>= 1.15)
      rugged (~> 1.0)
-    gitlab-labkit (0.20.0)
+    gitlab-labkit (0.21.2)
      actionpack (>= 5.0.0, < 7.0.0)
      activesupport (>= 5.0.0, < 7.0.0)
-      grpc (~> 1.19)
+      grpc (~> 1.30)
      jaeger-client (~> 1.1)
      opentracing (~> 0.4)
      pg_query (~> 2.1)
@ -94,7 +94,7 @@ GEM
      reverse_markdown (~> 1.0)
      rugged (>= 0.24, < 2.0)
      thor (>= 0.19, < 2.0)
-    loofah (2.10.0)
+    loofah (2.12.0)
      crass (~> 1.0.2)
      nokogiri (>= 1.5.9)
    memoizable (0.4.2)
@ -139,7 +139,7 @@ GEM
    rails-dom-testing (2.0.3)
      activesupport (>= 4.2.0)
      nokogiri (>= 1.6)
-    rails-html-sanitizer (1.3.0)
+    rails-html-sanitizer (1.4.2)
      loofah (~> 2.3)
    rainbow (3.0.0)
    rbtrace (0.4.14)
@ -147,7 +147,7 @@ GEM
      msgpack (>= 0.4.3)
      optimist (>= 3.0.0)
    rdoc (6.3.2)
-    redis (4.2.5)
+    redis (4.4.0)
    regexp_parser (1.8.1)
    reverse_markdown (1.4.0)
      nokogiri
@ -197,7 +197,7 @@ GEM
    stringex (2.8.5)
    thor (1.1.0)
    thread_safe (0.3.6)
-    thrift (0.14.1)
+    thrift (0.15.0)
    timecop (0.9.1)
    tzinfo (2.0.4)
      concurrent-ruby (~> 1.0)
@ -216,13 +216,13 @@ PLATFORMS
  ruby

 DEPENDENCIES
-  activesupport (~> 6.1.3.2)
+  activesupport (~> 6.1.4.1)
  factory_bot
  faraday (~> 1.0)
  github-linguist (~> 7.12)
  gitlab-gollum-lib (~> 4.2.7.10.gitlab.1)
  gitlab-gollum-rugged_adapter (~> 0.4.4.4.gitlab.1)
-  gitlab-labkit (~> 0.20.0)
+  gitlab-labkit (~> 0.21.1)
  gitlab-markup (~> 1.7.1)
  google-protobuf (~> 3.17.0)
  grpc (~> 1.30.2)
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -20,7 +20,7 @@ let
        };
      };
  };
-  version = "14.3.3";
+  version = "14.4.0";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/v${lib.versions.major version}";
 in

@ -32,7 +32,7 @@ buildGoModule {
    owner = "gitlab-org";
    repo = "gitaly";
    rev = "v${version}";
-    sha256 = "sha256-WC361E+p3i02n2YCOwUzRxCWFt5UMEfJi6tHZPj1dgo=";
+    sha256 = "sha256-GnjG/LuHvulNrwj1/4r07snue7rysZ74cWpf60w48cc=";
  };

  vendorSha256 = "sha256-9RhPQosen70E9t1iAoc2SeKs9pYMMpMqgXLekWfKNf8=";
--- a/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
@ -13,10 +13,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1wdgv5llgbl4nayx5j78lfvhhjssrzfmypb45mjy37mgm8z5l5m5";
+      sha256 = "0xgysqnibjsy6kdz10x2xb3kwa6lssiqhh0zggrbgs31ypwhlpia";
      type = "gem";
    };
-    version = "6.1.3.2";
+    version = "6.1.4.1";
  };
  actionview = {
    dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
@ -24,10 +24,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1r6db2g3fsrca1hp9kbyvjx9psipsxw0g306qharkcblxl8h1ysn";
+      sha256 = "1yf4ic5kl324rs0raralpwx24s6hvvdzxfhinafylf8f3x7jj23z";
      type = "gem";
    };
-    version = "6.1.3.2";
+    version = "6.1.4.1";
  };
  activesupport = {
    dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo" "zeitwerk"];
@ -35,10 +35,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1csxddyhl6k773ycxjvmyshyr4g9jb1icbs3pnm7crnavqs4h1yr";
+      sha256 = "19gx1jcq46x9d1pi1w8xq0bgvvfw239y4lalr8asm291gj3q3ds4";
      type = "gem";
    };
-    version = "6.1.3.2";
+    version = "6.1.4.1";
  };
  adamantium = {
    dependencies = ["ice_nine" "memoizable"];
@ -269,10 +269,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1krn6vi33i5vqbz3gmwzj9f9ifda41a3as3chpl899mrgni61q6r";
+      sha256 = "0xkzm6kri1dzjrmicm3wgbnxi9gk0byanr6ibfrflv7spd98fz19";
      type = "gem";
    };
-    version = "0.20.0";
+    version = "0.21.2";
  };
  gitlab-markup = {
    groups = ["default"];
@ -383,10 +383,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "19vkaazjqyq7yj5ah8rpr4vl9n4mg95scdr5im93akhd5bjvkkly";
+      sha256 = "1nqcya57x2n58y1dify60i0dpla40n4yir928khp4nj5jrn9mgmw";
      type = "gem";
    };
-    version = "2.10.0";
+    version = "2.12.0";
  };
  memoizable = {
    dependencies = ["thread_safe"];
@ -643,10 +643,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1icpqmxbppl4ynzmn6dx7wdil5hhq6fz707m9ya6d86c7ys8sd4f";
+      sha256 = "09qrfi3pgllxb08r024lln9k0qzxs57v0slsj8616xf9c0cwnwbk";
      type = "gem";
    };
-    version = "1.3.0";
+    version = "1.4.2";
  };
  rainbow = {
    source = {
@ -682,10 +682,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "15x2sr6h094rjbvg8pkq6m3lcd5abpyx93aifvfdz3wv6x55xa48";
+      sha256 = "1ig832dp0xmpp6a934nifzaj7wm9lzjxzasw911fagycs8p6m720";
      type = "gem";
    };
-    version = "4.2.5";
+    version = "4.4.0";
  };
  regexp_parser = {
    groups = ["default" "development" "test"];
@ -899,10 +899,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1sfa4120a7yl3gxjcx990gyawsshfr22gfv5rvgpk72l2p9j2420";
+      sha256 = "0rb9nax4k72zbriq7k98shfcj4lf54sqjpin2xm6ma7bb48ra8mc";
      type = "gem";
    };
-    version = "0.14.1";
+    version = "0.15.0";
  };
  timecop = {
    source = {
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -5,7 +5,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "14.3.3";
+  version = "14.4.0";

  src = fetchFromGitLab {
    owner = data.owner;
@ -16,7 +16,7 @@ buildGoModule rec {

  sourceRoot = "source/workhorse";

-  vendorSha256 = "sha256-piA14jYFV+FD20kR38rN1o329eeYAW/PmS0QI1GaU50=";
+  vendorSha256 = "sha256-yLZY9FFUS4nJl4TkE6MwICCEwtPTXFc5zuj4FgiIy74=";
  buildInputs = [ git ];
  ldflags = [ "-X main.Version=${version}" ];
  doCheck = false;
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@ -2,7 +2,7 @@

 source 'https://rubygems.org'

-gem 'rails', '~> 6.1.3.2'
+gem 'rails', '~> 6.1.4.1'

 gem 'bootsnap', '~> 1.4.6'

@ -92,7 +92,7 @@ gem 'net-ldap', '~> 0.16.3'

 # API
 gem 'grape', '~> 1.5.2'
-gem 'grape-entity', '~> 0.9.0'
+gem 'grape-entity', '~> 0.10.0'
 gem 'rack-cors', '~> 1.0.6', require: 'rack/cors'

 # GraphQL API
@ -129,7 +129,7 @@ gem 'fog-local', '~> 0.6'
 gem 'fog-openstack', '~> 1.0'
 gem 'fog-rackspace', '~> 0.1.1'
 gem 'fog-aliyun', '~> 0.3'
-gem 'gitlab-fog-azure-rm', '~> 1.1.1', require: false
+gem 'gitlab-fog-azure-rm', '~> 1.2.0', require: false

 # for Google storage
 gem 'google-api-client', '~> 0.33'
@ -154,7 +154,7 @@ gem 'html-pipeline', '~> 2.13.2'
 gem 'deckar01-task_list', '2.3.1'
 gem 'gitlab-markup', '~> 1.7.1'
 gem 'github-markup', '~> 1.7.0', require: 'github/markup'
-gem 'commonmarker', '~> 0.21'
+gem 'commonmarker', '~> 0.23.2'
 gem 'kramdown', '~> 2.3.1'
 gem 'RedCloth', '~> 4.3.2'
 gem 'rdoc', '~> 6.3.2'
@ -165,7 +165,7 @@ gem 'asciidoctor', '~> 2.0.10'
 gem 'asciidoctor-include-ext', '~> 0.3.1', require: false
 gem 'asciidoctor-plantuml', '~> 0.0.12'
 gem 'asciidoctor-kroki', '~> 0.5.0', require: false
-gem 'rouge', '~> 3.26.0'
+gem 'rouge', '~> 3.26.1'
 gem 'truncato', '~> 0.7.11'
 gem 'bootstrap_form', '~> 4.2.0'
 gem 'nokogiri', '~> 1.11.4'
@ -195,10 +195,10 @@ gem 'state_machines-activerecord', '~> 0.8.0'
 gem 'acts-as-taggable-on', '~> 7.0'

 # Background jobs
-gem 'sidekiq', '~> 5.2.7'
+gem 'sidekiq', '~> 6.2.2'
 gem 'sidekiq-cron', '~> 1.0'
 gem 'redis-namespace', '~> 1.8.1'
-gem 'gitlab-sidekiq-fetcher', '0.5.6', require: 'sidekiq-reliable-fetch'
+gem 'gitlab-sidekiq-fetcher', '0.8.0', require: 'sidekiq-reliable-fetch'

 # Cron Parser
 gem 'fugit', '~> 1.2.1'
@ -229,7 +229,7 @@ gem 'js_regex', '~> 3.7'
 gem 'device_detector'

 # Redis
-gem 'redis', '~> 4.1.4'
+gem 'redis', '~> 4.4.0'
 gem 'connection_pool', '~> 2.0'

 # Redis session store
@ -341,7 +341,7 @@ group :development do
  gem 'lefthook', '~> 0.7.0', require: false
  gem 'solargraph', '~> 0.43', require: false

-  gem 'letter_opener_web', '~> 1.4.0'
+  gem 'letter_opener_web', '~> 1.4.1'

  # Better errors handler
  gem 'better_errors', '~> 2.9.0'
@ -355,7 +355,7 @@ group :development, :test do
  gem 'bullet', '~> 6.1.3'
  gem 'pry-byebug'
  gem 'pry-rails', '~> 0.3.9'
-  gem 'pry-shell', '~> 0.4.0'
+  gem 'pry-shell', '~> 0.5.0'

  gem 'awesome_print', require: false

@ -424,7 +424,7 @@ group :test do
  gem 'webmock', '~> 3.9.1'
  gem 'rails-controller-testing'
  gem 'concurrent-ruby', '~> 1.1'
-  gem 'test-prof', '~> 0.12.0'
+  gem 'test-prof', '~> 1.0.7'
  gem 'rspec_junit_formatter'
  gem 'guard-rspec'

@ -474,7 +474,7 @@ end
 gem 'spamcheck', '~> 0.1.0'

 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 14.3.0.pre.rc1'
+gem 'gitaly', '~> 14.3.0.pre.rc2'

 # KAS GRPC protocol definitions
 gem 'kas-grpc', '~> 0.0.2'
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@ -4,63 +4,63 @@ GEM
    RedCloth (4.3.2)
    acme-client (2.0.6)
      faraday (>= 0.17, < 2.0.0)
-    actioncable (6.1.3.2)
-      actionpack (= 6.1.3.2)
-      activesupport (= 6.1.3.2)
+    actioncable (6.1.4.1)
+      actionpack (= 6.1.4.1)
+      activesupport (= 6.1.4.1)
      nio4r (~> 2.0)
      websocket-driver (>= 0.6.1)
-    actionmailbox (6.1.3.2)
-      actionpack (= 6.1.3.2)
-      activejob (= 6.1.3.2)
-      activerecord (= 6.1.3.2)
-      activestorage (= 6.1.3.2)
-      activesupport (= 6.1.3.2)
+    actionmailbox (6.1.4.1)
+      actionpack (= 6.1.4.1)
+      activejob (= 6.1.4.1)
+      activerecord (= 6.1.4.1)
+      activestorage (= 6.1.4.1)
+      activesupport (= 6.1.4.1)
      mail (>= 2.7.1)
-    actionmailer (6.1.3.2)
-      actionpack (= 6.1.3.2)
-      actionview (= 6.1.3.2)
-      activejob (= 6.1.3.2)
-      activesupport (= 6.1.3.2)
+    actionmailer (6.1.4.1)
+      actionpack (= 6.1.4.1)
+      actionview (= 6.1.4.1)
+      activejob (= 6.1.4.1)
+      activesupport (= 6.1.4.1)
      mail (~> 2.5, >= 2.5.4)
      rails-dom-testing (~> 2.0)
-    actionpack (6.1.3.2)
-      actionview (= 6.1.3.2)
-      activesupport (= 6.1.3.2)
+    actionpack (6.1.4.1)
+      actionview (= 6.1.4.1)
+      activesupport (= 6.1.4.1)
      rack (~> 2.0, >= 2.0.9)
      rack-test (>= 0.6.3)
      rails-dom-testing (~> 2.0)
      rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actiontext (6.1.3.2)
-      actionpack (= 6.1.3.2)
-      activerecord (= 6.1.3.2)
-      activestorage (= 6.1.3.2)
-      activesupport (= 6.1.3.2)
+    actiontext (6.1.4.1)
+      actionpack (= 6.1.4.1)
+      activerecord (= 6.1.4.1)
+      activestorage (= 6.1.4.1)
+      activesupport (= 6.1.4.1)
      nokogiri (>= 1.8.5)
-    actionview (6.1.3.2)
-      activesupport (= 6.1.3.2)
+    actionview (6.1.4.1)
+      activesupport (= 6.1.4.1)
      builder (~> 3.1)
      erubi (~> 1.4)
      rails-dom-testing (~> 2.0)
      rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (6.1.3.2)
-      activesupport (= 6.1.3.2)
+    activejob (6.1.4.1)
+      activesupport (= 6.1.4.1)
      globalid (>= 0.3.6)
-    activemodel (6.1.3.2)
-      activesupport (= 6.1.3.2)
-    activerecord (6.1.3.2)
-      activemodel (= 6.1.3.2)
-      activesupport (= 6.1.3.2)
+    activemodel (6.1.4.1)
+      activesupport (= 6.1.4.1)
+    activerecord (6.1.4.1)
+      activemodel (= 6.1.4.1)
+      activesupport (= 6.1.4.1)
    activerecord-explain-analyze (0.1.0)
      activerecord (>= 4)
      pg
-    activestorage (6.1.3.2)
-      actionpack (= 6.1.3.2)
-      activejob (= 6.1.3.2)
-      activerecord (= 6.1.3.2)
-      activesupport (= 6.1.3.2)
+    activestorage (6.1.4.1)
+      actionpack (= 6.1.4.1)
+      activejob (= 6.1.4.1)
+      activerecord (= 6.1.4.1)
+      activesupport (= 6.1.4.1)
      marcel (~> 1.0.0)
-      mini_mime (~> 1.0.2)
-    activesupport (6.1.3.2)
+      mini_mime (>= 1.1.0)
+    activesupport (6.1.4.1)
      concurrent-ruby (~> 1.0, >= 1.0.2)
      i18n (>= 1.6, < 2)
      minitest (>= 5.1)
@ -193,8 +193,7 @@ GEM
      open4 (~> 1.3)
    coderay (1.1.3)
    colored2 (3.1.2)
-    commonmarker (0.21.0)
-      ruby-enum (~> 0.5)
+    commonmarker (0.23.2)
    concurrent-ruby (1.1.9)
    connection_pool (2.2.2)
    contracts (0.11.0)
@ -446,7 +445,7 @@ GEM
      rails (>= 3.2.0)
    git (1.7.0)
      rchardet (~> 1.8)
-    gitaly (14.3.0.pre.rc1)
+    gitaly (14.3.0.pre.rc2)
      grpc (~> 1.0)
    github-markup (1.7.0)
    gitlab (4.16.1)
@ -461,7 +460,7 @@ GEM
      activesupport (>= 3.0)
      request_store (>= 1.0)
      scientist (~> 1.6, >= 1.6.0)
-    gitlab-fog-azure-rm (1.1.1)
+    gitlab-fog-azure-rm (1.2.0)
      azure-storage-blob (~> 2.0)
      azure-storage-common (~> 2.0)
      fog-core (= 2.1.0)
@ -484,8 +483,8 @@ GEM
      addressable (~> 2.7)
      omniauth (~> 1.9)
      openid_connect (~> 1.2)
-    gitlab-sidekiq-fetcher (0.5.6)
-      sidekiq (~> 5)
+    gitlab-sidekiq-fetcher (0.8.0)
+      sidekiq (~> 6.1)
    gitlab-styles (6.3.0)
      rubocop (~> 0.91, >= 0.91.1)
      rubocop-gitlab-security (~> 0.1.1)
@ -499,8 +498,8 @@ GEM
      omniauth (~> 1.3)
      pyu-ruby-sasl (>= 0.0.3.3, < 0.1)
      rubyntlm (~> 0.5)
-    globalid (0.4.2)
-      activesupport (>= 4.2.0)
+    globalid (0.5.2)
+      activesupport (>= 5.0)
    gon (6.4.0)
      actionpack (>= 3.0.20)
      i18n (>= 0.7)
@ -536,7 +535,7 @@ GEM
      mustermann-grape (~> 1.0.0)
      rack (>= 1.3.0)
      rack-accept
-    grape-entity (0.9.0)
+    grape-entity (0.10.0)
      activesupport (>= 3.0.0)
      multi_json (>= 1.3.2)
    grape-path-helpers (1.7.0)
@ -693,7 +692,7 @@ GEM
    lefthook (0.7.5)
    letter_opener (1.7.0)
      launchy (~> 2.2)
-    letter_opener_web (1.4.0)
+    letter_opener_web (1.4.1)
      actionmailer (>= 3.2)
      letter_opener (~> 1.0)
      railties (>= 3.2)
@ -740,7 +739,7 @@ GEM
    mime-types-data (3.2020.0512)
    mini_histogram (0.3.1)
    mini_magick (4.10.1)
-    mini_mime (1.0.2)
+    mini_mime (1.1.1)
    mini_portile2 (2.5.3)
    minitest (5.11.3)
    mixlib-cli (2.1.8)
@ -777,7 +776,7 @@ GEM
      net-ssh (>= 2.6.5, < 7.0.0)
    net-ssh (6.0.0)
    netrc (0.11.0)
-    nio4r (2.5.4)
+    nio4r (2.5.8)
    no_proxy_fix (0.1.2)
    nokogiri (1.11.7)
      mini_portile2 (~> 2.5.0)
@ -901,7 +900,7 @@ GEM
    peek (1.1.0)
      railties (>= 4.0.0)
    pg (1.2.3)
-    pg_query (2.1.0)
+    pg_query (2.1.1)
      google-protobuf (>= 3.17.1)
    plist (3.6.0)
    png_quantizator (0.2.1)
@ -927,7 +926,7 @@ GEM
      pry (~> 0.13.0)
    pry-rails (0.3.9)
      pry (>= 0.10.4)
-    pry-shell (0.4.1)
+    pry-shell (0.5.0)
      pry (~> 0.13.0)
      tty-markdown
      tty-prompt
@ -953,27 +952,25 @@ GEM
      httpclient
      json-jwt (>= 1.11.0)
      rack (>= 2.1.0)
-    rack-protection (2.0.5)
-      rack
    rack-proxy (0.6.0)
      rack
    rack-test (1.1.0)
      rack (>= 1.0, < 3)
    rack-timeout (0.5.2)
-    rails (6.1.3.2)
-      actioncable (= 6.1.3.2)
-      actionmailbox (= 6.1.3.2)
-      actionmailer (= 6.1.3.2)
-      actionpack (= 6.1.3.2)
-      actiontext (= 6.1.3.2)
-      actionview (= 6.1.3.2)
-      activejob (= 6.1.3.2)
-      activemodel (= 6.1.3.2)
-      activerecord (= 6.1.3.2)
-      activestorage (= 6.1.3.2)
-      activesupport (= 6.1.3.2)
+    rails (6.1.4.1)
+      actioncable (= 6.1.4.1)
+      actionmailbox (= 6.1.4.1)
+      actionmailer (= 6.1.4.1)
+      actionpack (= 6.1.4.1)
+      actiontext (= 6.1.4.1)
+      actionview (= 6.1.4.1)
+      activejob (= 6.1.4.1)
+      activemodel (= 6.1.4.1)
+      activerecord (= 6.1.4.1)
+      activestorage (= 6.1.4.1)
+      activesupport (= 6.1.4.1)
      bundler (>= 1.15.0)
-      railties (= 6.1.3.2)
+      railties (= 6.1.4.1)
      sprockets-rails (>= 2.0.0)
    rails-controller-testing (1.0.5)
      actionpack (>= 5.0.1.rc1)
@ -987,11 +984,11 @@ GEM
    rails-i18n (6.0.0)
      i18n (>= 0.7, < 2)
      railties (>= 6.0.0, < 7)
-    railties (6.1.3.2)
-      actionpack (= 6.1.3.2)
-      activesupport (= 6.1.3.2)
+    railties (6.1.4.1)
+      actionpack (= 6.1.4.1)
+      activesupport (= 6.1.4.1)
      method_source
-      rake (>= 0.8.7)
+      rake (>= 0.13)
      thor (~> 1.0)
    rainbow (3.0.0)
    rake (13.0.6)
@ -1011,7 +1008,7 @@ GEM
    recaptcha (4.13.1)
      json
    recursive-open-struct (1.1.3)
-    redis (4.1.4)
+    redis (4.4.0)
    redis-actionpack (5.2.0)
      actionpack (>= 5, < 7)
      redis-rack (>= 2.1.0, < 3)
@ -1045,7 +1042,7 @@ GEM
    rexml (3.2.5)
    rinku (2.0.0)
    rotp (6.2.0)
-    rouge (3.26.0)
+    rouge (3.26.1)
    rqrcode (0.7.0)
      chunky_png
    rqrcode-rails3 (0.1.7)
@ -1109,8 +1106,6 @@ GEM
    rubocop-rspec (1.44.1)
      rubocop (~> 0.87)
      rubocop-ast (>= 0.7.1)
-    ruby-enum (0.8.0)
-      i18n
    ruby-fogbugz (0.2.1)
      crack (~> 0.4)
    ruby-magic (0.4.0)
@ -1169,11 +1164,10 @@ GEM
    shellany (0.0.1)
    shoulda-matchers (4.0.1)
      activesupport (>= 4.2.0)
-    sidekiq (5.2.9)
-      connection_pool (~> 2.2, >= 2.2.2)
+    sidekiq (6.2.2)
+      connection_pool (>= 2.2.2)
      rack (~> 2.0)
-      rack-protection (>= 1.5.0)
-      redis (>= 3.3.5, < 4.2)
+      redis (>= 4.2.0)
    sidekiq-cron (1.0.4)
      fugit (~> 1.1)
      sidekiq (>= 4.2.1)
@ -1251,7 +1245,7 @@ GEM
      unicode-display_width (~> 1.1, >= 1.1.1)
    terser (1.0.2)
      execjs (>= 0.3.0, < 3)
-    test-prof (0.12.0)
+    test-prof (1.0.7)
    test_file_finder (0.1.4)
      faraday (~> 1.0)
    text (1.3.1)
@ -1351,7 +1345,7 @@ GEM
      crack (>= 0.3.2)
      hashdiff (>= 0.4.0, < 2.0.0)
    webrick (1.6.1)
-    websocket-driver (0.7.3)
+    websocket-driver (0.7.5)
      websocket-extensions (>= 0.1.0)
    websocket-extensions (0.1.5)
    wikicloth (0.8.1)
@ -1408,7 +1402,7 @@ DEPENDENCIES
  capybara-screenshot (~> 1.0.22)
  carrierwave (~> 1.3)
  charlock_holmes (~> 0.7.7)
-  commonmarker (~> 0.21)
+  commonmarker (~> 0.23.2)
  concurrent-ruby (~> 1.1)
  connection_pool (~> 2.0)
  countries (~> 3.0)
@ -1458,19 +1452,19 @@ DEPENDENCIES
  gettext (~> 3.3)
  gettext_i18n_rails (~> 1.8.0)
  gettext_i18n_rails_js (~> 1.3)
-  gitaly (~> 14.3.0.pre.rc1)
+  gitaly (~> 14.3.0.pre.rc2)
  github-markup (~> 1.7.0)
  gitlab-chronic (~> 0.10.5)
  gitlab-dangerfiles (~> 2.3.0)
  gitlab-experiment (~> 0.6.4)
-  gitlab-fog-azure-rm (~> 1.1.1)
+  gitlab-fog-azure-rm (~> 1.2.0)
  gitlab-labkit (~> 0.21.1)
  gitlab-license (~> 2.0)
  gitlab-mail_room (~> 0.0.9)
  gitlab-markup (~> 1.7.1)
  gitlab-net-dns (~> 0.9.1)
  gitlab-omniauth-openid-connect (~> 0.8.0)
-  gitlab-sidekiq-fetcher (= 0.5.6)
+  gitlab-sidekiq-fetcher (= 0.8.0)
  gitlab-styles (~> 6.3.0)
  gitlab_chronic_duration (~> 0.10.6.2)
  gitlab_omniauth-ldap (~> 2.1.1)
@ -1479,7 +1473,7 @@ DEPENDENCIES
  google-protobuf (~> 3.17.1)
  gpgme (~> 2.0.19)
  grape (~> 1.5.2)
-  grape-entity (~> 0.9.0)
+  grape-entity (~> 0.10.0)
  grape-path-helpers (~> 1.7.0)
  grape_logging (~> 1.7)
  graphiql-rails (~> 1.4.10)
@ -1512,7 +1506,7 @@ DEPENDENCIES
  kramdown (~> 2.3.1)
  kubeclient (~> 4.9.2)
  lefthook (~> 0.7.0)
-  letter_opener_web (~> 1.4.0)
+  letter_opener_web (~> 1.4.1)
  license_finder (~> 6.0)
  licensee (~> 9.14.1)
  lockbox (~> 0.6.2)
@ -1563,7 +1557,7 @@ DEPENDENCIES
  prometheus-client-mmap (~> 0.15.0)
  pry-byebug
  pry-rails (~> 0.3.9)
-  pry-shell (~> 0.4.0)
+  pry-shell (~> 0.5.0)
  puma (~> 5.3.1)
  puma_worker_killer (~> 0.3.1)
  rack (~> 2.2.3)
@ -1572,7 +1566,7 @@ DEPENDENCIES
  rack-oauth2 (~> 1.16.0)
  rack-proxy (~> 0.6.0)
  rack-timeout (~> 0.5.1)
-  rails (~> 6.1.3.2)
+  rails (~> 6.1.4.1)
  rails-controller-testing
  rails-i18n (~> 6.0)
  rainbow (~> 3.0)
@ -1581,14 +1575,14 @@ DEPENDENCIES
  rdoc (~> 6.3.2)
  re2 (~> 1.2.0)
  recaptcha (~> 4.11)
-  redis (~> 4.1.4)
+  redis (~> 4.4.0)
  redis-actionpack (~> 5.2.0)
  redis-namespace (~> 1.8.1)
  request_store (~> 1.5)
  responders (~> 3.0)
  retriable (~> 3.1.2)
  rexml (~> 3.2.5)
-  rouge (~> 3.26.0)
+  rouge (~> 3.26.1)
  rqrcode-rails3 (~> 0.1.7)
  rspec-parameterized
  rspec-rails (~> 5.0.1)
@ -1611,7 +1605,7 @@ DEPENDENCIES
  sentry-raven (~> 3.1)
  settingslogic (~> 2.0.9)
  shoulda-matchers (~> 4.0.1)
-  sidekiq (~> 5.2.7)
+  sidekiq (~> 6.2.2)
  sidekiq-cron (~> 1.0)
  simple_po_parser (~> 1.1.2)
  simplecov (~> 0.18.5)
@ -1628,7 +1622,7 @@ DEPENDENCIES
  state_machines-activerecord (~> 0.8.0)
  sys-filesystem (~> 1.1.6)
  terser (= 1.0.2)
-  test-prof (~> 0.12.0)
+  test-prof (~> 1.0.7)
  test_file_finder (~> 0.1.3)
  thin (~> 1.8.0)
  thrift (>= 0.14.0)
@ -1650,4 +1644,4 @@ DEPENDENCIES
  yajl-ruby (~> 1.4.1)

 BUNDLED WITH
-   2.2.20
+   2.2.24
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@ -16,10 +16,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "15r6ab17iwhhq92by4ah9z4wwvjbr07qn16x8pn2ypgqwvfy74h7";
+      sha256 = "0ilq5mniarm0zlvnkagqj9n9p73ljrhphciz02aymrpfxxxclz2x";
      type = "gem";
    };
-    version = "6.1.3.2";
+    version = "6.1.4.1";
  };
  actionmailbox = {
    dependencies = ["actionpack" "activejob" "activerecord" "activestorage" "activesupport" "mail"];
@ -27,10 +27,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1q1r3x9fbq5wlgn4xhqw48la09q7f97zna7ld5fglk3jpmh973x5";
+      sha256 = "16azdnjws215clb056b9mabglx4b8f61hr82hv7hm80dmn89zqq6";
      type = "gem";
    };
-    version = "6.1.3.2";
+    version = "6.1.4.1";
  };
  actionmailer = {
    dependencies = ["actionpack" "actionview" "activejob" "activesupport" "mail" "rails-dom-testing"];
@ -38,10 +38,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1nqdaykzgib8fsldkxdkw0w44jzz4grvb028crzg0qpwvv03g2wp";
+      sha256 = "00s07l2ac5igch1g2rpa0linmiq7mhgk6v6wxkckg8gbiqijb592";
      type = "gem";
    };
-    version = "6.1.3.2";
+    version = "6.1.4.1";
  };
  actionpack = {
    dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
@ -49,10 +49,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1wdgv5llgbl4nayx5j78lfvhhjssrzfmypb45mjy37mgm8z5l5m5";
+      sha256 = "0xgysqnibjsy6kdz10x2xb3kwa6lssiqhh0zggrbgs31ypwhlpia";
      type = "gem";
    };
-    version = "6.1.3.2";
+    version = "6.1.4.1";
  };
  actiontext = {
    dependencies = ["actionpack" "activerecord" "activestorage" "activesupport" "nokogiri"];
@ -60,10 +60,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1zfrkcnp9wy1dm4b6iqf29858dp04a62asfmldainqmv4a7931q7";
+      sha256 = "0m4fy4qqh09vnzbhx383vjdfid6fzbs49bzzg415x05nmmjkx582";
      type = "gem";
    };
-    version = "6.1.3.2";
+    version = "6.1.4.1";
  };
  actionview = {
    dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
@ -71,10 +71,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1r6db2g3fsrca1hp9kbyvjx9psipsxw0g306qharkcblxl8h1ysn";
+      sha256 = "1yf4ic5kl324rs0raralpwx24s6hvvdzxfhinafylf8f3x7jj23z";
      type = "gem";
    };
-    version = "6.1.3.2";
+    version = "6.1.4.1";
  };
  activejob = {
    dependencies = ["activesupport" "globalid"];
@ -82,10 +82,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0p80rbahcxhxlkxgf4bh580hbifn9q4gr5g9fy8fd0z5g6gr9xxq";
+      sha256 = "1q7c0i0kwarxgcbxk71wa9jnlg45grbxmhlrh7dk9bgcv7r7r7hn";
      type = "gem";
    };
-    version = "6.1.3.2";
+    version = "6.1.4.1";
  };
  activemodel = {
    dependencies = ["activesupport"];
@ -93,10 +93,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1gpd3hh4ryyr84drj6m0b5sy6929nyf50bfgksw1hpc594542nal";
+      sha256 = "16ixam4lni8b5lgx0whnax0imzh1dh10fy5r9pxs52n83yz5nbq3";
      type = "gem";
    };
-    version = "6.1.3.2";
+    version = "6.1.4.1";
  };
  activerecord = {
    dependencies = ["activemodel" "activesupport"];
@ -104,10 +104,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0fg58qma2zgrz0gr61p61qcz8c3h88fd5lbdrkpkm96aq5shwh68";
+      sha256 = "1ccgvlj767ybps3pxlaa4iw77n7wbriw2sr8754id3ngjfap08ja";
      type = "gem";
    };
-    version = "6.1.3.2";
+    version = "6.1.4.1";
  };
  activerecord-explain-analyze = {
    dependencies = ["activerecord" "pg"];
@ -126,10 +126,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0sbpkk3r8qi47bd0ilznq4gpfyfwm2bwvxqb5z0wc75h3zj1jhqg";
+      sha256 = "17knzz9fvqg4x582vy0xmlgjkxfb13xyzl2rgw19qfma86hxsvvi";
      type = "gem";
    };
-    version = "6.1.3.2";
+    version = "6.1.4.1";
  };
  activesupport = {
    dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo" "zeitwerk"];
@ -137,10 +137,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1csxddyhl6k773ycxjvmyshyr4g9jb1icbs3pnm7crnavqs4h1yr";
+      sha256 = "19gx1jcq46x9d1pi1w8xq0bgvvfw239y4lalr8asm291gj3q3ds4";
      type = "gem";
    };
-    version = "6.1.3.2";
+    version = "6.1.4.1";
  };
  acts-as-taggable-on = {
    dependencies = ["activerecord"];
@ -790,15 +790,14 @@
    version = "3.1.2";
  };
  commonmarker = {
-    dependencies = ["ruby-enum"];
    groups = ["default" "development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0vwpkmwfr8lx8b6cfvwh56f1ygyf2da5ah37mxbdr9mxmfwig5fr";
+      sha256 = "0sshs8mvjgk73sfz3bi9apq0p99kfj7n9bg1cyldl4yyy2z05prs";
      type = "gem";
    };
-    version = "0.21.0";
+    version = "0.23.2";
  };
  concurrent-ruby = {
    groups = ["default" "development" "test"];
@ -1911,10 +1910,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0k0jrimdg0pij75hndkrl28hqgvsnl7sdn5k6mjv3sjwbm1p217w";
+      sha256 = "197db842msm326ib8r3gqlavf5d11r4cd9jg4wjnyar3ccyr9dn7";
      type = "gem";
    };
-    version = "14.3.0.pre.rc1";
+    version = "14.3.0.pre.rc2";
  };
  github-markup = {
    groups = ["default"];
@ -1976,10 +1975,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1k5f3vyy2jqv3zdkdqal6sgn447zakz8xcc04432qd806s7g9i89";
+      sha256 = "1hi9v0zy863gnk17w0fp1ks2kr1s2z6q0bkx5wdbq6yawycjs94h";
      type = "gem";
    };
-    version = "1.1.1";
+    version = "1.2.0";
  };
  gitlab-labkit = {
    dependencies = ["actionpack" "activesupport" "grpc" "jaeger-client" "opentracing" "pg_query" "redis"];
@ -2049,10 +2048,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0838p0vnyl65571d8j5hljwyfyhsnfs6dlj6di57gpmwrbl9sdpr";
+      sha256 = "0qkkwd2sj9l6nmvipd1308ni01m2n8ixqwl6syl493cm5am4qmlw";
      type = "gem";
    };
-    version = "0.5.6";
+    version = "0.8.0";
  };
  gitlab-styles = {
    dependencies = ["rubocop" "rubocop-gitlab-security" "rubocop-performance" "rubocop-rails" "rubocop-rspec"];
@ -2093,10 +2092,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1zkxndvck72bfw235bd9nl2ii0lvs5z88q14706cmn702ww2mxv1";
+      sha256 = "0k6ww3shk3mv119xvr9m99l6ql0czq91xhd66hm8hqssb18r2lvm";
      type = "gem";
    };
-    version = "0.4.2";
+    version = "0.5.2";
  };
  gon = {
    dependencies = ["actionpack" "i18n" "multi_json" "request_store"];
@ -2191,10 +2190,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0sqk33djlyvkinj0vxblfcib86bk9dy0iq2c3j2yalxyrpns3kfr";
+      sha256 = "1zic5fx8s0424vdarhslmxdqmfnlfv3k4prfyxrrwvf9pdy1xvcs";
      type = "gem";
    };
-    version = "0.9.0";
+    version = "0.10.0";
  };
  grape-path-helpers = {
    dependencies = ["activesupport" "grape" "rake" "ruby2_keywords"];
@ -2832,10 +2831,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0pianlrbf9n7jrqxpyxgsfk1j1d312d57d6gq7yxni6ax2q0293q";
+      sha256 = "0kgz2n0cyw3m8ipvijlikb6bldmzhnq451b9d7w5l74gw2fhqckg";
      type = "gem";
    };
-    version = "1.4.0";
+    version = "1.4.1";
  };
  libyajl2 = {
    groups = ["default"];
@ -3054,10 +3053,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1axm0rxyx3ss93wbmfkm78a6x03l8y4qy60rhkkiq0aza0vwq3ha";
+      sha256 = "173dp4vqvx1sl6aq83daxwn5xvb5rn3jgynjmb91swl7gmgp17yl";
      type = "gem";
    };
-    version = "1.0.2";
+    version = "1.1.1";
  };
  mini_portile2 = {
    groups = ["default" "development" "test"];
@ -3302,10 +3301,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1cbwp1kbv6b2qfxv8sarv0d0ilb257jihlvdqj8f5pdm0ksq1sgk";
+      sha256 = "0xk64wghkscs6bv2n22853k2nh39d131c6rfpnlw12mbjnnv9v1v";
      type = "gem";
    };
-    version = "2.5.4";
+    version = "2.5.8";
  };
  no_proxy_fix = {
    groups = ["default" "development"];
@ -3805,10 +3804,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "12dibsqndfnckc24yryy8v467rxp7p80jx21jhm8z7swp8118jhx";
+      sha256 = "0cf1b97nznl6adkx25j2x96sq8xx2b4fpic230fx65k3vqqn8a4r";
      type = "gem";
    };
-    version = "2.1.0";
+    version = "2.1.1";
  };
  plist = {
    groups = ["default"];
@ -3927,10 +3926,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1wyx2rz58lfys1h62h6inz7ggq8xckqyfxndk8jq2cbkkdi2n6d7";
+      sha256 = "1jn3f5d9h2kg3hc4q7nzxfian4bhs23hh8n6g6hm9nzxqqbh9448";
      type = "gem";
    };
-    version = "0.4.1";
+    version = "0.5.0";
  };
  public_suffix = {
    groups = ["default" "development" "test"];
@ -4048,17 +4047,6 @@
    };
    version = "1.16.0";
  };
-  rack-protection = {
-    dependencies = ["rack"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "15167q25rmxipqwi6hjqj3i1byi9iwl3xq9b7mdar7qiz39pmjsk";
-      type = "gem";
-    };
-    version = "2.0.5";
-  };
  rack-proxy = {
    dependencies = ["rack"];
    groups = ["default"];
@ -4097,10 +4085,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0flnpli87b9j0zvb3c4l5addjbznbpkbmp1wzfjc1gh8qxlhcs1n";
+      sha256 = "1y59m2x8rdc581bjgyyr9dabi3vk3frqhhpbb5ldpbj622kxfpbz";
      type = "gem";
    };
-    version = "6.1.3.2";
+    version = "6.1.4.1";
  };
  rails-controller-testing = {
    dependencies = ["actionpack" "actionview" "activesupport"];
@ -4152,10 +4140,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "17r1pr8d467vh3zkciw4wmrcixj9zjrvd11nxn2z091bkzf66xq2";
+      sha256 = "1kwpm068cqys34p2g0j3l1g0cd5f3kxnsay5v7lmbd0sgarac0vy";
      type = "gem";
    };
-    version = "6.1.3.2";
+    version = "6.1.4.1";
  };
  rainbow = {
    groups = ["default" "development" "test"];
@ -4300,10 +4288,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0j0p82yb2a0z2sv38jq9xdzs0kvbslpyfdxky9f3znpy3igxj6yh";
+      sha256 = "1ig832dp0xmpp6a934nifzaj7wm9lzjxzasw911fagycs8p6m720";
      type = "gem";
    };
-    version = "4.1.4";
+    version = "4.4.0";
  };
  redis-actionpack = {
    dependencies = ["actionpack" "redis-rack" "redis-store"];
@ -4465,14 +4453,14 @@
    version = "6.2.0";
  };
  rouge = {
-    groups = ["default"];
+    groups = ["default" "development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0b4b300i3m4m4kw7w1n9wgxwy16zccnb7271miksyzd0wq5b9pm3";
+      sha256 = "197k0vskf72wxx0gzwld2jzg27bb7982xlvnzy9adlvkzp7nh8vf";
      type = "gem";
    };
-    version = "3.26.0";
+    version = "3.26.1";
  };
  rqrcode = {
    dependencies = ["chunky_png"];
@ -4671,17 +4659,6 @@
    };
    version = "1.44.1";
  };
-  ruby-enum = {
-    dependencies = ["i18n"];
-    groups = ["default" "development" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0d3dyx2z41zd6va9dwn3q8caf710vzdaf57xspc0y17aqmnprwnw";
-      type = "gem";
-    };
-    version = "0.8.0";
-  };
  ruby-fogbugz = {
    dependencies = ["crack"];
    groups = ["default"];
@ -5008,15 +4985,15 @@
    version = "4.0.1";
  };
  sidekiq = {
-    dependencies = ["connection_pool" "rack" "rack-protection" "redis"];
+    dependencies = ["connection_pool" "rack" "redis"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0kw4z9mr8h1rddx6f81gf7glw9pf90w0kvgc2fx4g9hspgh9xh7y";
+      sha256 = "104a97cl94aclg71ngrr097zjbdf6cibnz4q3rqjb88izmd7cfk6";
      type = "gem";
    };
-    version = "5.2.9";
+    version = "6.2.2";
  };
  sidekiq-cron = {
    dependencies = ["fugit" "sidekiq"];
@ -5351,10 +5328,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1pdb0szrj4mbczhlx2inszpj54rgnayvy2f2fff4q7jll2iz61i0";
+      sha256 = "1vg0zjfgibdcgkzb4c25v0f4v6v8mvpzvgcag194rwglmkkyrwkx";
      type = "gem";
    };
-    version = "0.12.0";
+    version = "1.0.7";
  };
  test_file_finder = {
    dependencies = ["faraday"];
@ -5824,10 +5801,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1i3rs4kcj0jba8idxla3s6xd1xfln3k8b4cb1dik2lda3ifnp3dh";
+      sha256 = "0a3bwxd9v3ghrxzjc4vxmf4xa18c6m4xqy5wb0yk5c6b9psc7052";
      type = "gem";
    };
-    version = "0.7.3";
+    version = "0.7.5";
  };
  websocket-extensions = {
    groups = ["default" "test"];
--- a/pkgs/applications/video/ustreamer/default.nix
+++ b/pkgs/applications/video/ustreamer/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "ustreamer";
-  version = "3.27";
+  version = "4.6";

  src = fetchFromGitHub {
    owner = "pikvm";
    repo = "ustreamer";
    rev = "v${version}";
-    sha256 = "1max2171abdpix0wq7mdkji5lvkfzisj166qfgmqkkwc2nh721iw";
+    sha256 = "sha256-FBgnE9EKZf3aYrGNf9cday9r4Q7Ztu7g+0LnFKAhvrI=";
  };

  buildInputs = [ libbsd libevent libjpeg ];
--- a/pkgs/build-support/node/fetch-yarn-deps/default.nix
+++ b/pkgs/build-support/node/fetch-yarn-deps/default.nix
@ -49,7 +49,7 @@ in {
      hash_ =
        if hash != "" then { outputHashAlgo = null; outputHash = hash; }
        else if sha256 != "" then { outputHashAlgo = "sha256"; outputHash = sha256; }
-        else throw "fetchYarnDeps requires a hash";
+        else { outputHashAlgo = "sha256"; outputHash = lib.fakeSha256; };
    in stdenv.mkDerivation {
      inherit name;

--- a/pkgs/build-support/node/fetch-yarn-deps/index.js
+++ b/pkgs/build-support/node/fetch-yarn-deps/index.js
@ -18,6 +18,20 @@ const exec = async (...args) => {
 	return res
 }

+// This has to match the logic in pkgs/development/tools/yarn2nix-moretea/yarn2nix/lib/urlToName.js
+// so that fixup_yarn_lock produces the same paths
+const urlToName = url => {
+  const isCodeloadGitTarballUrl = url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')
+
+  if (url.startsWith('git+') || isCodeloadGitTarballUrl) {
+    return path.basename(url)
+  } else {
+    return url
+      .replace(/https:\/\/(.)*(.com)\//g, '') // prevents having long directory names
+      .replace(/[@/%:-]/g, '_') // replace @ and : and - and % characters with underscore
+  }
+}
+
 const downloadFileHttps = (fileName, url, expectedHash) => {
 	return new Promise((resolve, reject) => {
 		https.get(url, (res) => {
@ -61,19 +75,18 @@ const downloadGit = async (fileName, url, rev) => {
 const downloadPkg = (pkg, verbose) => {
 	const [ url, hash ] = pkg.resolved.split('#')
 	if (verbose) console.log('downloading ' + url)
+	const fileName = urlToName(url)
 	if (url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')) {
-		const fileName = path.basename(url)
 		const s = url.split('/')
 		downloadGit(fileName, `https://github.com/${s[3]}/${s[4]}.git`, s[6])
 	} else if (url.startsWith('https://')) {
-		const fileName = url
-			.replace(/https:\/\/(.)*(.com)\//g, '') // prevents having long directory names
-			.replace(/[@/%:-]/g, '_') // replace @ and : and - and % characters with underscore
-
 		return downloadFileHttps(fileName, url, hash)
-	} else if (url.startsWith('git+')) {
-		const fileName = path.basename(url)
+	} else if (url.startsWith('git:')) {
 		return downloadGit(fileName, url.replace(/^git\+/, ''), hash)
+	} else if (url.startsWith('git+')) {
+		return downloadGit(fileName, url.replace(/^git\+/, ''), hash)
+	} else if (url.startsWith('file:')) {
+		console.warn(`ignoring unsupported file:path url "${url}"`)
 	} else {
 		throw new Error('don\'t know how to download "' + url + '"')
 	}
--- a/pkgs/build-support/trivial-builders.nix
+++ b/pkgs/build-support/trivial-builders.nix
@ -465,6 +465,88 @@ rec {
    '';


+  /*
+   * Extract a string's references to derivations and paths (its
+   * context) and write them to a text file, removing the input string
+   * itself from the dependency graph. This is useful when you want to
+   * make a derivation depend on the string's references, but not its
+   * contents (to avoid unnecessary rebuilds, for example).
+   *
+   * Note that this only works as intended on Nix >= 2.3.
+   */
+  writeStringReferencesToFile = string:
+    /*
+    * The basic operation this performs is to copy the string context
+    * from `string' to a second string and wrap that string in a
+    * derivation. However, that alone is not enough, since nothing in the
+    * string refers to the output paths of the derivations/paths in its
+    * context, meaning they'll be considered build-time dependencies and
+    * removed from the wrapper derivation's closure. Putting the
+    * necessary output paths in the new string is however not very
+    * straightforward - the attrset returned by `getContext' contains
+    * only references to derivations' .drv-paths, not their output
+    * paths. In order to "convert" them, we try to extract the
+    * corresponding paths from the original string using regex.
+    */
+    let
+      # Taken from https://github.com/NixOS/nix/blob/130284b8508dad3c70e8160b15f3d62042fc730a/src/libutil/hash.cc#L84
+      nixHashChars = "0123456789abcdfghijklmnpqrsvwxyz";
+      context = builtins.getContext string;
+      derivations = lib.filterAttrs (n: v: v ? outputs) context;
+      # Objects copied from outside of the store, such as paths and
+      # `builtins.fetch*`ed ones
+      sources = lib.attrNames (lib.filterAttrs (n: v: v ? path) context);
+      packages =
+        lib.mapAttrs'
+          (name: value:
+            {
+              inherit value;
+              name = lib.head (builtins.match "${builtins.storeDir}/[${nixHashChars}]+-(.*)\.drv" name);
+            })
+          derivations;
+      # The syntax of output paths differs between outputs named `out`
+      # and other, explicitly named ones. For explicitly named ones,
+      # the output name is suffixed as `-name`, but `out` outputs
+      # aren't suffixed at all, and thus aren't easily distinguished
+      # from named output paths. Therefore, we find all the named ones
+      # first so we can use them to remove false matches when looking
+      # for `out` outputs (see the definition of `outputPaths`).
+      namedOutputPaths =
+        lib.flatten
+          (lib.mapAttrsToList
+            (name: value:
+              (map
+                (output:
+                  lib.filter
+                    lib.isList
+                    (builtins.split "(${builtins.storeDir}/[${nixHashChars}]+-${name}-${output})" string))
+                (lib.remove "out" value.outputs)))
+            packages);
+      # Only `out` outputs
+      outputPaths =
+        lib.flatten
+          (lib.mapAttrsToList
+            (name: value:
+              if lib.elem "out" value.outputs then
+                lib.filter
+                  (x: lib.isList x &&
+                      # If the matched path is in `namedOutputPaths`,
+                      # it's a partial match of an output path where
+                      # the output name isn't `out`
+                      lib.all (o: !lib.hasPrefix (lib.head x) o) namedOutputPaths)
+                  (builtins.split "(${builtins.storeDir}/[${nixHashChars}]+-${name})" string)
+              else
+                [])
+            packages);
+      allPaths = lib.concatStringsSep "\n" (lib.unique (sources ++ namedOutputPaths ++ outputPaths));
+      allPathsWithContext = builtins.appendContext allPaths context;
+    in
+      if builtins ? getContext then
+        writeText "string-references" allPathsWithContext
+      else
+        writeDirectReferencesToFile (writeText "string-file" string);
+
+
  /* Print an error message if the file with the specified name and
   * hash doesn't exist in the Nix store. This function should only
   * be used by non-redistributable software with an unfree license
--- a/pkgs/build-support/trivial-builders/test.nix
+++ b/pkgs/build-support/trivial-builders/test.nix
@ -38,11 +38,27 @@ nixosTest {
      DIRECT_REFS = invokeSamples ./test/invoke-writeDirectReferencesToFile.nix;
    };
  };
-  testScript = ''
-    machine.succeed("""
-      ${./test.sh} 2>/dev/console
-    """)
-  '';
+  testScript =
+    let
+      sample = import ./test/sample.nix { inherit pkgs; };
+      samplePaths = lib.unique (lib.attrValues sample);
+      sampleText = pkgs.writeText "sample-text" (lib.concatStringsSep "\n" samplePaths);
+      stringReferencesText =
+        pkgs.writeStringReferencesToFile
+          ((lib.concatMapStringsSep "fillertext"
+            (d: "${d}")
+            (lib.attrValues sample)) + ''
+              STORE=${builtins.storeDir};\nsystemctl start bar-foo.service
+            '');
+    in ''
+      machine.succeed("""
+        ${./test.sh} 2>/dev/console
+      """)
+      machine.succeed("""
+        echo >&2 Testing string references...
+        diff -U3 <(sort ${stringReferencesText}) <(sort ${sampleText})
+      """)
+    '';
  meta = {
    license = lib.licenses.mit; # nixpkgs license
    maintainers = with lib.maintainers; [
--- a/pkgs/build-support/trivial-builders/test/sample.nix
+++ b/pkgs/build-support/trivial-builders/test/sample.nix
@ -2,6 +2,7 @@
 let
  inherit (pkgs)
    figlet
+    zlib
    hello
    writeText
    ;
@ -9,8 +10,13 @@ in
 {
  hello = hello;
  figlet = figlet;
+  zlib = zlib;
+  zlib-dev = zlib.dev;
  norefs = writeText "hi" "hello";
+  norefsDup = writeText "hi" "hello";
  helloRef = writeText "hi" "hello ${hello}";
+  helloRefDup = writeText "hi" "hello ${hello}";
+  path = ./invoke-writeReferencesToFile.nix;
  helloFigletRef = writeText "hi" "hello ${hello} ${figlet}";
  inherit (pkgs)
    emptyFile
--- a/pkgs/data/documentation/execline-man-pages/default.nix
+++ b/pkgs/data/documentation/execline-man-pages/default.nix
@ -2,8 +2,8 @@

 buildManPages {
  pname = "execline-man-pages";
-  version = "2.8.1.0.1";
-  sha256 = "0d3lzxy7wv91q3nr6bw1wfmrfj285i15wmj4c8v9k9pxjg42iwwx";
+  version = "2.8.1.0.2";
+  sha256 = "1fl3pyjh9328l1h2b6s08j048jl4pfyyc24mjs45qx545kcp65q4";
  description = "Port of the documentation for the execline suite to mdoc";
  maintainers = [ lib.maintainers.sternenseemann ];
 }
--- a/pkgs/data/documentation/s6-man-pages/default.nix
+++ b/pkgs/data/documentation/s6-man-pages/default.nix
@ -2,8 +2,8 @@

 buildManPages {
  pname = "s6-man-pages";
-  version = "2.11.0.0.1";
-  sha256 = "00nxlpdf0kkdadyv84vj5w66y926pccqls8prkbip3zmcmnqgghs";
+  version = "2.11.0.0.2";
+  sha256 = "1ddab4l4wwrg2jdcrdqp1rx8dzbzbdsvx4mzayraxva4q97d1g9r";
  description = "Port of the documentation for the s6 supervision suite to mdoc";
  maintainers = [ lib.maintainers.sternenseemann ];
 }
--- a/pkgs/data/documentation/s6-networking-man-pages/default.nix
+++ b/pkgs/data/documentation/s6-networking-man-pages/default.nix
@ -2,8 +2,8 @@

 buildManPages {
  pname = "s6-networking-man-pages";
-  version = "2.5.0.0.1";
-  sha256 = "02xvyby23b2x30jxd4nw9c5629j4hdaxq9sph3qhajlhl53yiyf2";
+  version = "2.5.0.0.2";
+  sha256 = "1ix8qrivp9prw0m401d7s9vkxhw16a4sxfhrs7abf9qqhs2zkd1r";
  description = "Port of the documentation for the s6-networking suite to mdoc";
  maintainers = [ lib.maintainers.sternenseemann ];
 }
--- a/pkgs/desktops/gnome/core/epiphany/default.nix
+++ b/pkgs/desktops/gnome/core/epiphany/default.nix
@ -3,6 +3,7 @@
 , ninja
 , gettext
 , fetchurl
+, fetchpatch
 , pkg-config
 , gtk3
 , glib
@ -46,12 +47,30 @@ stdenv.mkDerivation rec {
    sha256 = "s50YJUkllbC3TF1qZoaoV/lBnfpMAvgBPCl7yHDibdA=";
  };

-  patches = lib.optionals withPantheon [
-    # Make this respect dark mode settings from Pantheon
+  patches = [
+    # tab-view: Update close button position on startup
+    # https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/1025
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/epiphany/-/commit/6e9d6d3cf7fa7ddf21a70e9816a5cd4767a79523.patch";
+      sha256 = "sha256-lBVliGCIKwTvsYnWjAcmJxhTg1HS/2x4wlOh+4sx/xQ=";
+    })
+  ] ++ lib.optionals withPantheon [
+    # Pantheon specific patches for epiphany
    # https://github.com/elementary/browser
-    # The patch currently differs from upstream (updated for epiphany 40 and 41).
-    ./pantheon-dark-style.patch
-    ./pantheon-navigation-buttons.patch
+    #
+    # Make this respect dark mode settings from Pantheon
+    # https://github.com/elementary/browser/pull/21
+    # https://github.com/elementary/browser/pull/41
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/elementary/browser/cc17559a7ac6effe593712b4f3d0bbefde6e3b62/dark-style.patch";
+      sha256 = "sha256-RzMUc9P51UN3tRFefzRtMniXR9duOOmLj5eu5gL2TEQ=";
+    })
+    # Patch to unlink nav buttons
+    # https://github.com/elementary/browser/pull/18
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/elementary/browser/cc17559a7ac6effe593712b4f3d0bbefde6e3b62/navigation-buttons.patch";
+      sha256 = "sha256-G1/JUjn/8DyO9sgL/5Kq205KbTOs4EMi4Vf3cJ8FHXU=";
+    })
  ];

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/core/epiphany/pantheon-dark-style.patch
+++ b/pkgs/desktops/gnome/core/epiphany/pantheon-dark-style.patch
@ -1,76 +0,0 @@
-diff --git a/meson.build b/meson.build
-index de9cbfa850..647f617605 100644
--- a/meson.build
-+++ b/meson.build
-@@ -92,6 +92,7 @@ iso_codes_dep = dependency('iso-codes', version: '>= 0.35')
- json_glib_dep = dependency('json-glib-1.0', version: '>= 1.6')
- libarchive_dep = dependency('libarchive')
- libdazzle_dep = dependency('libdazzle-1.0', version: '>= 3.37.1')
-+libgranite_dep = dependency('granite', version: '>= 6.0.0')
- libhandy_dep = dependency('libhandy-1', version: '>= 1.1.0')
- libsecret_dep = dependency('libsecret-1', version: '>= 0.19.0')
- libsoup_dep = dependency('libsoup-2.4', version: '>= 2.48.0')
-diff --git a/src/ephy-shell.c b/src/ephy-shell.c
-index 650531da86..b9d1355e86 100644
--- a/src/ephy-shell.c
-+++ b/src/ephy-shell.c
-@@ -50,6 +50,7 @@
- 
- #include <glib/gi18n.h>
- #include <gtk/gtk.h>
-+#include <granite.h>
- #include <handy.h>
- 
- struct _EphyShell {
-@@ -483,6 +484,20 @@ run_in_background_set_mapping (const GValue       *value,
-   return g_variant_new_boolean (g_variant_get_boolean (var));
- }
- 
-+static void
-+ephy_shell_set_prefers_color_scheme (EphyShell *shell)
-+{
-+    GtkSettings* gtk_settings = gtk_settings_get_default ();
-+    GraniteSettings* granite_settings = granite_settings_get_default ();
-+
-+    g_object_set (
-+        gtk_settings,
-+        "gtk-application-prefer-dark-theme",
-+        granite_settings_get_prefers_color_scheme (granite_settings) == GRANITE_SETTINGS_COLOR_SCHEME_DARK,
-+        NULL
-+    );
-+}
-+
- static void
- ephy_shell_startup (GApplication *application)
- {
-@@ -490,11 +505,18 @@ ephy_shell_startup (GApplication *application)
-   EphyShell *shell = EPHY_SHELL (application);
-   EphyEmbedShellMode mode;
-   GAction *action;
-+  GraniteSettings* granite_settings = granite_settings_get_default ();
- 
-   G_APPLICATION_CLASS (ephy_shell_parent_class)->startup (application);
- 
-   hdy_init ();
- 
-+  ephy_shell_set_prefers_color_scheme (shell);
-+
-+  g_signal_connect (granite_settings, "notify::prefers-color-scheme",
-+    G_CALLBACK (ephy_shell_set_prefers_color_scheme), shell
-+  );
-+
-   /* If we are under Pantheon set the icon-theme and cursor-theme accordingly. */
-   if (is_desktop_pantheon ()) {
-     GtkSettings *settings = gtk_settings_get_default ();
-diff --git a/src/meson.build b/src/meson.build
-index 5bf3eb92ec..d17b1b6d93 100644
--- a/src/meson.build
-+++ b/src/meson.build
-@@ -74,6 +74,7 @@ libephymain_deps = [
-   gdk_dep,
-   gvdb_dep,
-   libarchive_dep,
-+  libgranite_dep,
-   libhandy_dep
- ]
- 
--- a/pkgs/desktops/gnome/core/epiphany/pantheon-navigation-buttons.patch
+++ b/pkgs/desktops/gnome/core/epiphany/pantheon-navigation-buttons.patch
@ -1,12 +0,0 @@
-diff --git a/src/resources/gtk/action-bar-start.ui b/src/resources/gtk/action-bar-start.ui
-index e604b9601f..2bfe244d53 100644
--- a/src/resources/gtk/action-bar-start.ui
-+++ b/src/resources/gtk/action-bar-start.ui
-@@ -7,7 +7,6 @@
-         <property name="visible">True</property>
-         <property name="orientation">horizontal</property>
-         <style>
-          <class name="linked"/>
-           <class name="navigation-box"/>
-         </style>
-         <child>
--- a/pkgs/desktops/pantheon/apps/appcenter/default.nix
+++ b/pkgs/desktops/pantheon/apps/appcenter/default.nix
@ -30,24 +30,15 @@

 stdenv.mkDerivation rec {
  pname = "appcenter";
-  version = "3.8.0";
+  version = "3.8.1";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "07lkdpnjj9pxbq8h794qjiidvnysvzx0132w98r1wg9k7ca170bj";
+    sha256 = "sha256-d7DGyAC8itBxTfuabDPN16W4S4d42s5UPp8AusZfy5k=";
  };

-  patches = [
-    # Try to remove other backends to make flatpak backend work.
-    # https://github.com/NixOS/nixpkgs/issues/70214
-    ./flatpak-only.patch
-    # The homepage banner does not show up on first run,
-    # has issues with app icon and mouse scrolling.
-    ./drop-homepage-banner.patch
-  ];
-
  passthru = {
    updateScript = nix-update-script {
      attrPath = "pantheon.${pname}";
--- a/pkgs/desktops/pantheon/apps/appcenter/drop-homepage-banner.patch
+++ b/pkgs/desktops/pantheon/apps/appcenter/drop-homepage-banner.patch
@ -1,234 +0,0 @@
-From b1e09653d755ca6ffd03a1e3e67750e6bcc2bc6f Mon Sep 17 00:00:00 2001
-From: Bobby Rong <rjl931189261@126.com>
-Date: Wed, 22 Sep 2021 11:54:48 +0800
-Subject: [PATCH 2/2] Drop homepage banner
-
---
- src/Views/Homepage.vala | 181 +---------------------------------------
- 1 file changed, 1 insertion(+), 180 deletions(-)
-
-diff --git a/src/Views/Homepage.vala b/src/Views/Homepage.vala
-index 576fc02c..80a1d221 100644
--- a/src/Views/Homepage.vala
-+++ b/src/Views/Homepage.vala
-@@ -31,67 +31,12 @@ public class AppCenter.Homepage : AbstractView {
-     public bool viewing_package { get; private set; default = false; }
- 
-     public AppStream.Category currently_viewed_category;
-    private Hdy.Carousel banner_carousel;
-    private Gtk.Revealer banner_revealer;
-    private Gtk.FlowBox recently_updated_carousel;
-    private Gtk.Revealer recently_updated_revealer;
-
-    private uint banner_timeout_id;
- 
-     construct {
-        banner_carousel = new Hdy.Carousel () {
-            allow_long_swipes = true
-        };
-
-        var banner_event_box = new Gtk.EventBox ();
-        banner_event_box.events |= Gdk.EventMask.ENTER_NOTIFY_MASK;
-        banner_event_box.events |= Gdk.EventMask.LEAVE_NOTIFY_MASK;
-        banner_event_box.add (banner_carousel);
-
-        var banner_dots = new Hdy.CarouselIndicatorDots () {
-            carousel = banner_carousel
-        };
-
-        var banner_grid = new Gtk.Grid () {
-            orientation = Gtk.Orientation.VERTICAL
-        };
-        banner_grid.add (banner_event_box);
-        banner_grid.add (banner_dots);
-
-        banner_revealer = new Gtk.Revealer ();
-        banner_revealer.add (banner_grid);
-
-        var recently_updated_label = new Granite.HeaderLabel (_("Recently Updated")) {
-            margin_start = 12
-        };
-
-        recently_updated_carousel = new Gtk.FlowBox () {
-            activate_on_single_click = true,
-            column_spacing = 12,
-            row_spacing = 12,
-            homogeneous = true,
-            max_children_per_line = 5,
-            min_children_per_line = 3
-        };
-
-        var recently_updated_grid = new Gtk.Grid () {
-            margin_end = 12,
-            margin_start = 12
-        };
-        recently_updated_grid.attach (recently_updated_label, 0, 0);
-        recently_updated_grid.attach (recently_updated_carousel, 0, 1);
-
-        recently_updated_revealer = new Gtk.Revealer ();
-        recently_updated_revealer.add (recently_updated_grid );
-
-        var categories_label = new Granite.HeaderLabel (_("Categories")) {
-            margin_start = 24,
-            margin_top = 24
-        };
-
-         category_flow = new Widgets.CategoryFlowBox () {
-             margin_start = 12,
-             margin_end =12,
-+            margin_top = 12,
-             valign = Gtk.Align.START
-         };
- 
-@@ -99,9 +44,6 @@ public class AppCenter.Homepage : AbstractView {
-             column_spacing = 24,
-             orientation = Gtk.Orientation.VERTICAL
-         };
-        grid.add (banner_revealer);
-        grid.add (recently_updated_revealer);
-        grid.add (categories_label);
-         grid.add (category_flow);
- 
-         scrolled_window = new Gtk.ScrolledWindow (null, null) {
-@@ -111,19 +53,6 @@ public class AppCenter.Homepage : AbstractView {
- 
-         add (scrolled_window);
- 
-        var local_package = App.local_package;
-        if (local_package != null) {
-            var banner = new Widgets.Banner (local_package);
-
-            banner_carousel.prepend (banner);
-
-            banner.clicked.connect (() => {
-                show_package (local_package);
-            });
-        }
-
-        load_banners_and_carousels.begin ();
-
-         category_flow.child_activated.connect ((child) => {
-             var item = child as Widgets.CategoryItem;
-             if (item != null) {
-@@ -159,94 +88,8 @@ public class AppCenter.Homepage : AbstractView {
-                         }
-                     }
-                 }
-
-                return GLib.Source.REMOVE;
-             });
-         });
-
-        banner_event_box.enter_notify_event.connect (() => {
-            banner_timeout_stop ();
-        });
-
-        banner_event_box.leave_notify_event.connect (() => {
-            banner_timeout_start ();
-        });
-
-        recently_updated_carousel.child_activated.connect ((child) => {
-            var package_row_grid = (AppCenter.Widgets.ListPackageRowGrid) child.get_child ();
-
-            show_package (package_row_grid.package);
-        });
-    }
-
-    private async void load_banners_and_carousels () {
-        unowned var fp_client = AppCenterCore.FlatpakBackend.get_default ();
-        var packages_by_release_date = fp_client.get_featured_packages_by_release_date ();
-        var packages_in_banner = new Gee.LinkedList<AppCenterCore.Package> ();
-
-        int package_count = 0;
-        foreach (var package in packages_by_release_date) {
-            if (package_count >= MAX_PACKAGES_IN_BANNER) {
-                break;
-            }
-
-            var installed = false;
-            foreach (var origin_package in package.origin_packages) {
-                try {
-                    if (yield origin_package.backend.is_package_installed (origin_package)) {
-                        installed = true;
-                        break;
-                    }
-                } catch (Error e) {
-                    continue;
-                }
-            }
-
-            if (!installed) {
-                packages_in_banner.add (package);
-                package_count++;
-            }
-        }
-
-        foreach (var package in packages_in_banner) {
-            var banner = new Widgets.Banner (package);
-            banner.clicked.connect (() => {
-                show_package (package);
-            });
-
-            banner_carousel.add (banner);
-        }
-
-        banner_carousel.show_all ();
-        banner_revealer.reveal_child = true;
-        banner_timeout_start ();
-
-        foreach (var package in packages_by_release_date) {
-            if (recently_updated_carousel.get_children ().length () >= MAX_PACKAGES_IN_CAROUSEL) {
-                break;
-            }
-
-            var installed = false;
-            foreach (var origin_package in package.origin_packages) {
-                try {
-                    if (yield origin_package.backend.is_package_installed (origin_package)) {
-                        installed = true;
-                        break;
-                    }
-                } catch (Error e) {
-                    continue;
-                }
-            }
-
-            if (!installed && !(package in packages_in_banner) && !package.is_explicit) {
-                var package_row = new AppCenter.Widgets.ListPackageRowGrid (package);
-                recently_updated_carousel.add (package_row);
-            }
-        }
-        recently_updated_carousel.show_all ();
-        recently_updated_revealer.reveal_child = recently_updated_carousel.get_children ().length () > 0;
-
-        page_loaded ();
-     }
- 
-     public override void show_package (
-@@ -307,26 +150,4 @@ public class AppCenter.Homepage : AbstractView {
-         var apps = client.get_applications_for_category (category);
-         app_list_view.add_packages (apps);
-     }
-
-    private void banner_timeout_start () {
-        banner_timeout_id = Timeout.add (MILLISECONDS_BETWEEN_BANNER_ITEMS, () => {
-            var new_index = (uint) banner_carousel.position + 1;
-            var max_index = banner_carousel.n_pages - 1; // 0-based index
-
-            if (banner_carousel.position >= max_index) {
-                new_index = 0;
-            }
-
-            banner_carousel.switch_child (new_index, Granite.TRANSITION_DURATION_OPEN);
-
-            return Source.CONTINUE;
-        });
-    }
-
-    private void banner_timeout_stop () {
-        if (banner_timeout_id != 0) {
-            Source.remove (banner_timeout_id);
-            banner_timeout_id = 0;
-        }
-    }
- }
--- a/pkgs/desktops/pantheon/apps/appcenter/flatpak-only.patch
+++ b/pkgs/desktops/pantheon/apps/appcenter/flatpak-only.patch
@ -1,162 +0,0 @@
-From 5d3f20b49a89b55e39339a0f90ae7f846356b0e1 Mon Sep 17 00:00:00 2001
-From: Bobby Rong <rjl931189261@126.com>
-Date: Wed, 22 Sep 2021 11:54:24 +0800
-Subject: [PATCH 1/2] Drop PackageKitBackend and UbuntuDriversBackend
-
---
- src/Application.vala            | 14 ---------
- src/Core/BackendAggregator.vala |  2 --
- src/Core/UpdateManager.vala     | 56 ---------------------------------
- src/MainWindow.vala             | 17 ----------
- 4 files changed, 89 deletions(-)
-
-diff --git a/src/Application.vala b/src/Application.vala
-index 65fae5aa..9d42b14f 100644
--- a/src/Application.vala
-+++ b/src/Application.vala
-@@ -167,10 +167,6 @@ public class AppCenter.App : Gtk.Application {
- 
-         var client = AppCenterCore.Client.get_default ();
- 
-        if (fake_update_packages != null) {
-            AppCenterCore.PackageKitBackend.get_default ().fake_packages = fake_update_packages;
-        }
-
-         if (silent) {
-             NetworkMonitor.get_default ().network_changed.connect ((available) => {
-                 schedule_cache_update (!available);
-@@ -183,16 +179,6 @@ public class AppCenter.App : Gtk.Application {
-             return;
-         }
- 
-        if (local_path != null) {
-            var file = File.new_for_commandline_arg (local_path);
-
-            try {
-                local_package = AppCenterCore.PackageKitBackend.get_default ().add_local_component_file (file);
-            } catch (Error e) {
-                warning ("Failed to load local AppStream XML file: %s", e.message);
-            }
-        }
-
-         if (main_window == null) {
-             main_window = new MainWindow (this);
- 
-diff --git a/src/Core/BackendAggregator.vala b/src/Core/BackendAggregator.vala
-index 2f8bdedf..b705ca87 100644
--- a/src/Core/BackendAggregator.vala
-+++ b/src/Core/BackendAggregator.vala
-@@ -26,8 +26,6 @@ public class AppCenterCore.BackendAggregator : Backend, Object {
- 
-     construct {
-         backends = new Gee.ArrayList<unowned Backend> ();
-        backends.add (PackageKitBackend.get_default ());
-        backends.add (UbuntuDriversBackend.get_default ());
-         backends.add (FlatpakBackend.get_default ());
- 
-         unowned Gtk.Application app = (Gtk.Application) GLib.Application.get_default ();
-diff --git a/src/Core/UpdateManager.vala b/src/Core/UpdateManager.vala
-index 29fa397a..ce42dd57 100644
--- a/src/Core/UpdateManager.vala
-+++ b/src/Core/UpdateManager.vala
-@@ -53,42 +53,9 @@ public class AppCenterCore.UpdateManager : Object {
-             installed_package.update_state ();
-         }
- 
-        Pk.Results pk_updates;
-        unowned PackageKitBackend client = PackageKitBackend.get_default ();
-        try {
-            pk_updates = yield client.get_updates (cancellable);
-        } catch (Error e) {
-            warning ("Unable to get updates from PackageKit backend: %s", e.message);
-            return 0;
-        }
-
-         uint os_count = 0;
-         string os_desc = "";
- 
-        var package_array = pk_updates.get_package_array ();
-        debug ("PackageKit backend reports %d updates", package_array.length);
-
-        package_array.foreach ((pk_package) => {
-            var pkg_name = pk_package.get_name ();
-            var appcenter_package = client.lookup_package_by_id (pkg_name);
-            if (appcenter_package != null) {
-                debug ("Added %s to app updates", pkg_name);
-                apps_with_updates.add (appcenter_package);
-                appcenter_package.latest_version = pk_package.get_version ();
-            } else {
-                debug ("Added %s to OS updates", pkg_name);
-                os_count++;
-                unowned string pkg_summary = pk_package.get_summary ();
-                unowned string pkg_version = pk_package.get_version ();
-                os_desc += Markup.printf_escaped (
-                    "<li>%s\n\t%s\n\t%s</li>\n",
-                    pkg_name,
-                    pkg_summary,
-                    _("Version: %s").printf (pkg_version)
-                );
-            }
-        });
-
-         os_updates.component.set_pkgnames ({});
-         os_updates.change_information.clear_update_info ();
- 
-@@ -160,29 +127,6 @@ public class AppCenterCore.UpdateManager : Object {
-             count += 1;
-         }
- 
-        pk_updates.get_details_array ().foreach ((pk_detail) => {
-            var pk_package = new Pk.Package ();
-            try {
-                pk_package.set_id (pk_detail.get_package_id ());
-                var pkg_name = pk_package.get_name ();
-                var appcenter_package = client.lookup_package_by_id (pkg_name);
-                    if (appcenter_package != null) {
-                        appcenter_package.change_information.updatable_packages.@set (client, pk_package.get_id ());
-                        appcenter_package.change_information.size += pk_detail.size;
-                        appcenter_package.update_state ();
-                    } else {
-                        var pkgnames = os_updates.component.pkgnames;
-                        pkgnames += pkg_name;
-                        os_updates.component.pkgnames = pkgnames;
-
-                        os_updates.change_information.updatable_packages.@set (client, pk_package.get_id ());
-                        os_updates.change_information.size += pk_detail.size;
-                    }
-            } catch (Error e) {
-                critical (e.message);
-            }
-        });
-
-         os_updates.update_state ();
-         return count;
-     }
-diff --git a/src/MainWindow.vala b/src/MainWindow.vala
-index a32ce47b..b9f8594a 100644
--- a/src/MainWindow.vala
-+++ b/src/MainWindow.vala
-@@ -292,23 +292,6 @@ public class AppCenter.MainWindow : Hdy.ApplicationWindow {
-     }
- 
-     public override bool delete_event (Gdk.EventAny event) {
-        unowned AppCenterCore.PackageKitBackend client = AppCenterCore.PackageKitBackend.get_default ();
-        if (client.working) {
-            if (task_finished_connection != 0U) {
-                client.disconnect (task_finished_connection);
-            }
-
-            hide ();
-            task_finished_connection = client.notify["working"].connect (() => {
-                if (!visible && !client.working) {
-                    destroy ();
-                }
-            });
-
-            AppCenterCore.Client.get_default ().cancel_updates (false); //Timeouts keep running
-            return true;
-        }
-
-         return false;
-     }
- 
--- a/pkgs/desktops/pantheon/apps/elementary-calculator/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-calculator/default.nix
@ -21,7 +21,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-calculator";
-  version = "1.7.0";
+  version = "1.7.1";

  repoName = "calculator";

@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "1kl2iximcmbk8inklb2xav7dp08lp5pn9xxa59327zw13gdy8fkf";
+    sha256 = "sha256-GoQFWhEhUBVLYL1vsIIBMT8pKc0dK/ploiGfUtJAJQU=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/elementary-calendar/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-calendar/default.nix
@ -28,7 +28,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-calendar";
-  version = "6.0.2";
+  version = "6.0.3";

  repoName = "calendar";

@ -36,13 +36,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "16xp8gfgpyz9xpjsxm6jlk4skkknj65g0q4x0qvw9sg9f1p6a514";
-  };
-
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
+    sha256 = "sha256-+RQUiJLuCIbmcbtsOCfF9HYFrxtldZMbg2vg/a/IOaY=";
  };

  nativeBuildInputs = [
@ -78,6 +72,12 @@ stdenv.mkDerivation rec {
    patchShebangs meson/post_install.py
  '';

+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
  meta = with lib; {
    description = "Desktop calendar app designed for elementary OS";
    homepage = "https://github.com/elementary/calendar";
--- a/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-camera/default.nix
@ -25,7 +25,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-camera";
-  version = "6.0.0";
+  version = "6.0.1";

  repoName = "camera";

@ -33,13 +33,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "1z5c6pkc7psglxwzby5idsdxvplpi28ckjxrwdngnr22knfdcgag";
-  };
-
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
+    sha256 = "sha256-OdBinryF6XTcvtY4A1wdDVazjf/VritEGF97ts6d4RY=";
  };

  nativeBuildInputs = [
@ -75,6 +69,12 @@ stdenv.mkDerivation rec {
    patchShebangs meson/post_install.py
  '';

+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
  meta = with lib; {
    description = "Camera app designed for elementary OS";
    homepage = "https://github.com/elementary/camera";
--- a/pkgs/desktops/pantheon/apps/elementary-mail/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-mail/default.nix
@ -1,6 +1,5 @@
 { lib, stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , pantheon
 , pkg-config
@ -26,7 +25,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-mail";
-  version = "6.2.0";
+  version = "6.3.0";

  repoName = "mail";

@ -34,7 +33,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "1ab620zhwqqjq1bs1alvpcw9jmdxjij0ywczvwbg8gqvcsc80lkn";
+    sha256 = "sha256-lIVAMTtRrzJI5Qcd6y24ZmtzFWeTSbcKiEhG8hLC+PM=";
  };

  passthru = {
@ -43,12 +42,6 @@ stdenv.mkDerivation rec {
    };
  };

-  patches = [
-    # The app stuck when loading gravatar, temporarily reverts part
-    # of https://github.com/elementary/mail/pull/600 to fix this
-    ./revert-fix-warning.patch
-  ];
-
  nativeBuildInputs = [
    appstream
    desktop-file-utils
--- a/pkgs/desktops/pantheon/apps/elementary-mail/revert-fix-warning.patch
+++ b/pkgs/desktops/pantheon/apps/elementary-mail/revert-fix-warning.patch
@ -1,55 +0,0 @@
-From 9e61e9493e78b83b9599886561ee596c096030ed Mon Sep 17 00:00:00 2001
-From: Bobby Rong <rjl931189261@126.com>
-Date: Thu, 29 Jul 2021 13:57:21 +0800
-Subject: [PATCH] Partly revert "Fix Warnings in Vala Code (#600)"
-
-This partly reverts commit 9477c24201d3c9c3c7bcc650e0290daa0ee1ab21.
---
- src/MessageList/MessageListItem.vala | 27 ++++++++++++++++++++++++++-
- 1 file changed, 26 insertions(+), 1 deletion(-)
-
-diff --git a/src/MessageList/MessageListItem.vala b/src/MessageList/MessageListItem.vala
-index 96b61027..a7ef8f9e 100644
--- a/src/MessageList/MessageListItem.vala
-+++ b/src/MessageList/MessageListItem.vala
-@@ -290,7 +290,7 @@ public class Mail.MessageListItem : Gtk.ListBoxRow {
-         expanded = false;
-         show_all ();
- 
-        avatar.set_loadable_icon (new GravatarIcon (parsed_address, get_style_context ().get_scale ()));
-+        download_gravatar.begin (parsed_address, avatar.size);
- 
-         /* Override default handler to stop event propagation. Otherwise clicking the menu will
-            expand or collapse the MessageListItem. */
-@@ -348,6 +348,31 @@ public class Mail.MessageListItem : Gtk.ListBoxRow {
-         });
-     }
- 
-+    private async void download_gravatar (string address, int size) {
-+        if (avatars[address] == null) {
-+            var uri = "https://secure.gravatar.com/avatar/%s?d=404&s=%d".printf (
-+                Checksum.compute_for_string (ChecksumType.MD5, address.strip ().down ()),
-+                size * get_style_context ().get_scale ()
-+            );
-+
-+            var server_file = File.new_for_uri (uri);
-+            var path = Path.build_filename (Environment.get_tmp_dir (), server_file.get_basename ());
-+            var local_file = File.new_for_path (path);
-+
-+            try {
-+                yield server_file.copy_async (local_file, FileCopyFlags.OVERWRITE, Priority.DEFAULT, null);
-+                avatars[address] = new Gdk.Pixbuf.from_file_at_scale (path, size, size, true);
-+            } catch (Error e) {
-+                debug ("Unable to fetch gravatar: %s", e.message);
-+                return;
-+            }
-+        }
-+
-+        avatar.set_image_load_func (() => {
-+            return avatars[address];
-+        });
-+    }
-+
-     private void add_inline_composer (ComposerWidget.Type composer_type) {
-         var message_list_box = (MessageListBox) get_parent ();
-         message_list_box.add_inline_composer.begin (composer_type, this);
--- a/pkgs/desktops/pantheon/apps/elementary-photos/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-photos/default.nix
@ -1,6 +1,5 @@
 { lib, stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , pantheon
 , meson
@ -35,7 +34,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-photos";
-  version = "2.7.2";
+  version = "2.7.3";

  repoName = "photos";

@ -43,18 +42,9 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "1zq9zfsc987vvrzadw9xqi3rlbi4jv2s82axkgy7ijm3ibi58ddc";
+    sha256 = "sha256-ja4ElW0FNm9oNyn+00SdI2Cxep6LyWTYM8Blc6bnuiY=";
  };

-  patches = [
-    # Fix build with vala 0.54
-    # https://github.com/elementary/photos/pull/650
-    (fetchpatch {
-      url = "https://github.com/elementary/photos/commit/bc7feca8caa4c8fc076a759a2d36e26e93c75596.patch";
-      sha256 = "sha256-iOHYKV7rSAuMm4ZhoJWjlpu96zlxwTosQe+z/iEVFR8=";
-    })
-  ];
-
  nativeBuildInputs = [
    appstream
    desktop-file-utils
--- a/pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix
@ -19,7 +19,7 @@

 stdenv.mkDerivation rec {
  pname = "elementary-screenshot";
-  version = "6.0.0";
+  version = "6.0.1";

  repoName = "screenshot";

@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "1fvsl9zdkv7bgx3jpy7pr9lflm4ckr3swdby379mdxn2x6kxji0x";
+    sha256 = "sha256-MDmk+0IUCe6PSV5QOjjDRedv7X3lcBJ04jn9cE9DP3M=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/about/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/about/default.nix
@ -15,6 +15,7 @@
 , switchboard
 , fwupd
 , appstream
+, nixos-artwork
 }:

 stdenv.mkDerivation rec {
@ -53,9 +54,11 @@ stdenv.mkDerivation rec {
  ];

  patches = [
-    # The NixOS logo is not centered in the circular background and path
-    # to the background is hardcoded, we will drop the background.
-    ./remove-logo-background.patch
+    # Use NixOS's default wallpaper
+    (substituteAll {
+      src = ./fix-background-path.patch;
+      default_wallpaper = "${nixos-artwork.wallpapers.simple-dark-gray.gnomeFilePath}";
+    })
  ];

  meta = with lib; {
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/about/fix-background-path.patch
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/about/fix-background-path.patch
@ -0,0 +1,13 @@
+diff --git a/src/Views/OperatingSystemView.vala b/src/Views/OperatingSystemView.vala
+index fdb92e7e..4161538e 100644
+--- a/src/Views/OperatingSystemView.vala
+++ b/src/Views/OperatingSystemView.vala
+@@ -47,7 +47,7 @@ public class About.OperatingSystemView : Gtk.Grid {
+         };
+         logo.set_image_load_func ((size) => {
+             try {
+-                return new Gdk.Pixbuf.from_file_at_scale ("/usr/share/backgrounds/elementaryos-default", -1, size, true);
+                return new Gdk.Pixbuf.from_file_at_scale ("@default_wallpaper@", -1, size, true);
+             } catch (Error e) {
+                 critical (e.message);
+             }
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/about/remove-logo-background.patch
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/about/remove-logo-background.patch
@ -1,36 +0,0 @@
-diff --git a/src/Views/OperatingSystemView.vala b/src/Views/OperatingSystemView.vala
-index fdb92e7..87bb3a4 100644
--- a/src/Views/OperatingSystemView.vala
-+++ b/src/Views/OperatingSystemView.vala
-@@ -39,21 +39,6 @@ public class About.OperatingSystemView : Gtk.Grid {
-             logo_icon_name = "distributor-logo";
-         }
- 
-        var logo = new Hdy.Avatar (128, "", false) {
-            // In case the wallpaper can't be loaded, we don't want an icon or text
-            icon_name = "invalid-icon-name",
-            // We need this for the shadow to not get clipped by Gtk.Overlay
-            margin = 6
-        };
-        logo.set_image_load_func ((size) => {
-            try {
-                return new Gdk.Pixbuf.from_file_at_scale ("/usr/share/backgrounds/elementaryos-default", -1, size, true);
-            } catch (Error e) {
-                critical (e.message);
-            }
-        });
-        logo.get_style_context ().add_provider (style_provider, Gtk.STYLE_PROVIDER_PRIORITY_APPLICATION);
-
-         var icon = new Gtk.Image () {
-             icon_name = logo_icon_name + "-symbolic",
-             // 128 minus 3px padding on each side
-@@ -65,8 +50,7 @@ public class About.OperatingSystemView : Gtk.Grid {
-         icon_style_context.add_provider (style_provider, Gtk.STYLE_PROVIDER_PRIORITY_APPLICATION);
- 
-         var logo_overlay = new Gtk.Overlay ();
-        logo_overlay.add (logo);
-        logo_overlay.add_overlay (icon);
-+        logo_overlay.add (icon);
- 
-         // Intentionally not using GLib.OsInfoKey.PRETTY_NAME here because we
-         // want more granular control over text formatting
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/display/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/display/default.nix
@ -7,6 +7,7 @@
 , pkg-config
 , vala
 , libgee
+, libhandy
 , granite
 , gtk3
 , switchboard
@ -14,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "switchboard-plug-display";
-  version = "2.3.1";
+  version = "2.3.2";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "1dqd34v124y71nnk0l617a53x652m0sb7b58465imr6ppyhx4vsv";
+    sha256 = "sha256-3sYZCazGnTjIi3Iry5673TMI13sD0GuY+46AK+NJH70=";
  };

  passthru = {
@ -40,6 +41,7 @@ stdenv.mkDerivation rec {
    granite
    gtk3
    libgee
+    libhandy
    switchboard
  ];

--- a/pkgs/desktops/pantheon/desktop/elementary-default-settings/default.nix
+++ b/pkgs/desktops/pantheon/desktop/elementary-default-settings/default.nix
@ -1,5 +1,7 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , pantheon
 , meson
@ -26,11 +28,14 @@ stdenv.mkDerivation rec {
    sha256 = "0gqnrm968j4v699yhhiyw5fqjy4zbvvrjci2v1jrlycn09c2yrwf";
  };

-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
+  patches = [
+    # Update gtk-theme-name and gtk-font-name for Pantheon 6
+    # https://github.com/elementary/default-settings/pull/252
+    (fetchpatch {
+      url = "https://github.com/elementary/default-settings/commit/be24c151492bb9115c75bd1a7abc88714240294a.patch";
+      sha256 = "sha256-EglFiN4CLbL8osfNGLvjD220Al35uBXuRNC9Ud3QYBI=";
+    })
+  ];

  nativeBuildInputs = [
    accountsservice
@ -80,6 +85,12 @@ stdenv.mkDerivation rec {
    rm -rf $out/share/applications
  '';

+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
  meta = with lib; {
    description = "Default settings and configuration files for elementary";
    homepage = "https://github.com/elementary/default-settings";
--- a/pkgs/desktops/pantheon/desktop/gala/default.nix
+++ b/pkgs/desktops/pantheon/desktop/gala/default.nix
@ -1,5 +1,7 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
+, fetchpatch
 , nix-update-script
 , pantheon
 , pkg-config
@ -38,11 +40,16 @@ stdenv.mkDerivation rec {
    sha256 = "1phnhj731kvk8ykmm33ypcxk8fkfny9k6kdapl582qh4d47wcy6f";
  };

-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
+  patches = [
+    ./plugins-dir.patch
+    # Multitasking view: Don't use smooth scroll events to handle mouse wheel
+    # Avoid breaking the multitasking view scroll once xf86-input-libinput 1.2.0 lands
+    # https://github.com/elementary/gala/pull/1266
+    (fetchpatch {
+      url = "https://github.com/elementary/gala/commit/d2dcfdefdf97c1b49654179a7acd01ebfe017308.patch";
+      sha256 = "sha256-2lKrCz3fSjrfKfysuUHzeUjhmMm84K47n882CLpfAyg=";
+    })
+  ];

  nativeBuildInputs = [
    desktop-file-utils
@ -73,15 +80,17 @@ stdenv.mkDerivation rec {
    mutter
  ];

-  patches = [
-    ./plugins-dir.patch
-  ];
-
  postPatch = ''
    chmod +x build-aux/meson/post_install.py
    patchShebangs build-aux/meson/post_install.py
  '';

+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
  meta =  with lib; {
    description = "A window & compositing manager based on mutter and designed by elementary for use with Pantheon";
    homepage = "https://github.com/elementary/gala";
--- a/pkgs/desktops/pantheon/desktop/wingpanel-indicators/applications-menu/default.nix
+++ b/pkgs/desktops/pantheon/desktop/wingpanel-indicators/applications-menu/default.nix
@ -26,7 +26,7 @@

 stdenv.mkDerivation rec {
  pname = "wingpanel-applications-menu";
-  version = "2.9.0";
+  version = "2.9.1";

  repoName = "applications-menu";

@ -34,14 +34,15 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "0mwjw2ghbdj336ax5srxbqnjprdhj1if7sm9k9idqkmifpzccs7i";
+    sha256 = "sha256-Q0ee8S8wWhK0Y16SWfE79Us6QD/oRE5Pxm3o//eb/po=";
  };

-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
-  };
+  patches = [
+    (substituteAll {
+      src = ./fix-paths.patch;
+      bc = "${bc}/bin/bc";
+    })
+  ];

  nativeBuildInputs = [
    gettext
@ -76,18 +77,17 @@ stdenv.mkDerivation rec {
    "--sysconfdir=${placeholder "out"}/etc"
  ];

-  patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
-      bc = "${bc}/bin/bc";
-    })
-  ];
-
  postPatch = ''
    chmod +x meson/post_install.py
    patchShebangs meson/post_install.py
  '';

+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
  meta = with lib; {
    description = "Lightweight and stylish app launcher for Pantheon";
    homepage = "https://github.com/elementary/applications-menu";
--- a/pkgs/desktops/pantheon/desktop/wingpanel-indicators/network/default.nix
+++ b/pkgs/desktops/pantheon/desktop/wingpanel-indicators/network/default.nix
@ -1,6 +1,6 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
-, fetchpatch
 , nix-update-script
 , substituteAll
 , pantheon
@ -14,18 +14,17 @@
 , libnma
 , wingpanel
 , libgee
-, elementary-capnet-assist
 }:

 stdenv.mkDerivation rec {
  pname = "wingpanel-indicator-network";
-  version = "2.3.0";
+  version = "2.3.1";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "0q5ad2sj0nmigrh1rykb2kvik3hzibzyafdvkkmjd6y92145lwl1";
+    sha256 = "sha256-xr1ZihWK8fU8M/rXRKk5dOjoQNe3aJO8ouKC/iVZ7Sk=";
  };

  passthru = {
@ -50,19 +49,6 @@ stdenv.mkDerivation rec {
    wingpanel
  ];

-  patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
-      elementary_capnet_assist = elementary-capnet-assist;
-    })
-    # Upstream code not respecting our localedir
-    # https://github.com/elementary/wingpanel-indicator-network/pull/228
-    (fetchpatch {
-      url = "https://github.com/elementary/wingpanel-indicator-network/commit/eacc7d46a94a980005e87e38e6c943143a09692a.patch";
-      sha256 = "1svg07fqmplchp1ass0h8qkr3g24pkw8dcsnd54ddmvnjzwrzz0a";
-    })
-  ];
-
  meta = with lib; {
    description = "Network Indicator for Wingpanel";
    homepage = "https://github.com/elementary/wingpanel-indicator-network";
--- a/pkgs/desktops/pantheon/desktop/wingpanel-indicators/network/fix-paths.patch
+++ b/pkgs/desktops/pantheon/desktop/wingpanel-indicators/network/fix-paths.patch
@ -1,13 +0,0 @@
-diff --git a/src/Indicator.vala b/src/Indicator.vala
-index 83ce932a..f95ed142 100644
--- a/src/Indicator.vala
-+++ b/src/Indicator.vala
-@@ -67,7 +67,7 @@ public class Network.Indicator : Wingpanel.Indicator {
- 
-             if (network_monitor.get_connectivity () == NetworkConnectivity.FULL || network_monitor.get_connectivity () == NetworkConnectivity.PORTAL) {
-                 try {
-                    var appinfo = AppInfo.create_from_commandline ("io.elementary.capnet-assist", null, AppInfoCreateFlags.NONE);
-+                    var appinfo = AppInfo.create_from_commandline ("@elementary_capnet_assist@/bin/io.elementary.capnet-assist", null, AppInfoCreateFlags.NONE);
-                     appinfo.launch (null, null);
-                 } catch (Error e) {
-                     warning ("%s\n", e.message);
--- a/pkgs/desktops/pantheon/desktop/wingpanel-indicators/notifications/default.nix
+++ b/pkgs/desktops/pantheon/desktop/wingpanel-indicators/notifications/default.nix
@ -16,19 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "wingpanel-indicator-notifications";
-  version = "6.0.1";
+  version = "6.0.2";

  src = fetchFromGitHub {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "1qrbg8l3ifz09jx6v5j7hmgw0hmirj6mh3z634yl1cadz45p8fc9";
-  };
-
-  passthru = {
-    updateScript = nix-update-script {
-      attrPath = "pantheon.${pname}";
-    };
+    sha256 = "sha256-ZuOZlfxtRq8ZcrXGe9wlFGwn2isdvMoXQveKKnEPFdo=";
  };

  nativeBuildInputs = [
@ -47,6 +41,12 @@ stdenv.mkDerivation rec {
    wingpanel
  ];

+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "pantheon.${pname}";
+    };
+  };
+
  meta = with lib; {
    description = "Notifications Indicator for Wingpanel";
    homepage = "https://github.com/elementary/wingpanel-indicator-notifications";
--- a/pkgs/desktops/pantheon/granite/default.nix
+++ b/pkgs/desktops/pantheon/granite/default.nix
@ -18,7 +18,7 @@

 stdenv.mkDerivation rec {
  pname = "granite";
-  version = "6.1.1";
+  version = "6.1.2";

  outputs = [ "out" "dev" ];

@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = pname;
    rev = version;
-    sha256 = "13c6xk014psvmll9qybdqviskllw4g150m2k4ikjbv59g0rfp7xq";
+    sha256 = "sha256-d48KQH8uwkSZWQEFSq1BD+TVUi9PWVVtMjKYmleRW58=";
  };

  passthru = {
--- a/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
+++ b/pkgs/desktops/pantheon/services/elementary-settings-daemon/default.nix
@ -15,12 +15,13 @@
 , gtk3
 , granite
 , libgee
+, systemd
 , wrapGAppsHook
 }:

 stdenv.mkDerivation rec {
  pname = "elementary-settings-daemon";
-  version = "1.0.0";
+  version = "1.1.0";

  repoName = "settings-daemon";

@ -28,7 +29,7 @@ stdenv.mkDerivation rec {
    owner = "elementary";
    repo = repoName;
    rev = version;
-    sha256 = "1masvy1f9z2cp8w5ajnhy4k9bzvzgfziqlm59bf146pdd2567hiw";
+    sha256 = "sha256-1Xp1uJzDFuGZlhJhKj00cYtb4Q1syMAm+82fTOtk0VI=";
  };

  nativeBuildInputs = [
@ -50,6 +51,7 @@ stdenv.mkDerivation rec {
    gtk3
    granite
    libgee
+    systemd
  ];

  postPatch = ''
--- a/pkgs/desktops/plasma-5/breeze-gtk.nix
+++ b/pkgs/desktops/plasma-5/breeze-gtk.nix
@ -6,6 +6,9 @@ mkDerivation {
  name = "breeze-gtk";
  nativeBuildInputs = [ extra-cmake-modules sassc python3 python3.pkgs.pycairo breeze-qt5 ];
  buildInputs = [ qtbase ];
+  patches = [
+    ./patches/0001-fix-add-executable-bit.patch
+  ];
  postPatch = ''
    sed -i cmake/FindGTKEngine.cmake \
      -e "s|\''${KDE_INSTALL_FULL_LIBDIR}|${getLib gtk2}/lib|"
--- a/pkgs/desktops/plasma-5/fetch.sh
+++ b/pkgs/desktops/plasma-5/fetch.sh
@ -1 +1 @@
-WGET_ARGS=( https://download.kde.org/stable/plasma/5.22.5/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.kde.org/stable/plasma/5.23.1/ -A '*.tar.xz' )
--- a/pkgs/desktops/plasma-5/kwayland-integration.nix
+++ b/pkgs/desktops/plasma-5/kwayland-integration.nix
@ -2,10 +2,11 @@
  mkDerivation, lib,
  extra-cmake-modules,
  kguiaddons, kidletime, kwayland, kwindowsystem, qtbase,
+  wayland-protocols, wayland-scanner, wayland
 }:

 mkDerivation {
  name = "kwayland-integration";
-  nativeBuildInputs = [ extra-cmake-modules ];
-  buildInputs = [ kguiaddons kidletime kwindowsystem kwayland qtbase ];
+  nativeBuildInputs = [ extra-cmake-modules wayland-scanner ];
+  buildInputs = [ kguiaddons kidletime kwindowsystem kwayland qtbase wayland-protocols wayland ];
 }
--- a/Show More
+++ b/Show More