Merge remote-tracking branch 'origin/master' into haskell-updates

doc/languages-frameworks/ruby.section.md

@@ -201,6 +201,19 @@ $ nix-shell --run 'ruby -rpg -e "puts PG.library_version"'
 
 Of course for this use-case one could also use overlays since the configuration for `pg` depends on the `postgresql` alias, but for demonstration purposes this has to suffice.
 
+### Platform-specific gems
+
+Right now, bundix has some issues with pre-built, platform-specific gems: [bundix PR #68](https://github.com/nix-community/bundix/pull/68).
+Until this is solved, you can tell bundler to not use platform-specific gems and instead build them from source each time:
+- globally (will be set in `~/.config/.bundle/config`):
+```shell
+$ bundle config set force_ruby_platform true
+```
+- locally (will be set in `<project-root>/.bundle/config`):
+```shell
+$ bundle config set --local force_ruby_platform true
+```
+
 ### Adding a gem to the default gemset {#adding-a-gem-to-the-default-gemset}
 
 Now that you know how to get a working Ruby environment with Nix, it's time to go forward and start actually developing with Ruby. We will first have a look at how Ruby gems are packaged on Nix. Then, we will look at how you can use development mode with your code.

maintainers/maintainer-list.nix

@@ -278,6 +278,12 @@
     githubId = 1250775;
     name = "Adolfo E. García Castro";
   };
+  AdsonCicilioti = {
+    name = "Adson Cicilioti";
+    email = "adson.cicilioti@live.com";
+    github = "AdsonCicilioti";
+    githubId = 6278398;
+  };
   adsr = {
     email = "as@php.net";
     github = "adsr";
@@ -13383,4 +13389,10 @@
     github = "vdot0x23";
     githubId = 40716069;
   };
+  jpagex = {
+    name = "Jérémy Pagé";
+    email = "contact@jeremypage.me";
+    github = "jpagex";
+    githubId = 635768;
+  };
 }

nixos/doc/manual/default.nix

@@ -161,7 +161,7 @@ let
 in rec {
   inherit generatedSources;
 
-  inherit (optionsDoc) optionsJSON optionsXML optionsDocBook;
+  inherit (optionsDoc) optionsJSON optionsDocBook;
 
   # Generate the NixOS manual.
   manualHTML = runCommand "nixos-manual-html"

nixos/lib/make-options-doc/default.nix

@@ -24,18 +24,25 @@
 }:
 
 let
-  # Replace functions by the string <function>
+  # Make a value safe for JSON. Functions are replaced by the string "<function>",
-  substFunction = x:
+  # derivations are replaced with an attrset
-    if builtins.isAttrs x then lib.mapAttrs (name: substFunction) x
+  # { _type = "derivation"; name = <name of that derivation>; }.
-    else if builtins.isList x then map substFunction x
+  # We need to handle derivations specially because consumers want to know about them,
+  # but we can't easily use the type,name subset of keys (since type is often used as
+  # a module option and might cause confusion). Use _type,name instead to the same
+  # effect, since _type is already used by the module system.
+  substSpecial = x:
+    if lib.isDerivation x then { _type = "derivation"; name = x.name; }
+    else if builtins.isAttrs x then lib.mapAttrs (name: substSpecial) x
+    else if builtins.isList x then map substSpecial x
     else if lib.isFunction x then "<function>"
     else x;
 
-  optionsListDesc = lib.flip map optionsListVisible
+  optionsList = lib.flip map optionsListVisible
    (opt: transformOptions opt
-    // lib.optionalAttrs (opt ? example) { example = substFunction opt.example; }
+    // lib.optionalAttrs (opt ? example) { example = substSpecial opt.example; }
-    // lib.optionalAttrs (opt ? default) { default = substFunction opt.default; }
+    // lib.optionalAttrs (opt ? default) { default = substSpecial opt.default; }
-    // lib.optionalAttrs (opt ? type) { type = substFunction opt.type; }
+    // lib.optionalAttrs (opt ? type) { type = substSpecial opt.type; }
     // lib.optionalAttrs (opt ? relatedPackages && opt.relatedPackages != []) { relatedPackages = genRelatedPackages opt.relatedPackages opt.name; }
    );
 
@@ -69,96 +76,25 @@ let
         + "</listitem>";
     in "<itemizedlist>${lib.concatStringsSep "\n" (map (p: describe (unpack p)) packages)}</itemizedlist>";
 
-  # Custom "less" that pushes up all the things ending in ".enable*"
-  # and ".package*"
-  optionLess = a: b:
-    let
-      ise = lib.hasPrefix "enable";
-      isp = lib.hasPrefix "package";
-      cmp = lib.splitByAndCompare ise lib.compare
-                                 (lib.splitByAndCompare isp lib.compare lib.compare);
-    in lib.compareLists cmp a.loc b.loc < 0;
-
   # Remove invisible and internal options.
   optionsListVisible = lib.filter (opt: opt.visible && !opt.internal) (lib.optionAttrSetToDocList options);
 
-  # Customly sort option list for the man page.
-  # Always ensure that the sort order matches sortXML.py!
-  optionsList = lib.sort optionLess optionsListDesc;
-
-  # Convert the list of options into an XML file.
-  # This file is *not* sorted sorted to save on eval time, since the docbook XML
-  # and the manpage depend on it and thus we evaluate this on every system rebuild.
-  optionsXML = builtins.toFile "options.xml" (builtins.toXML optionsListDesc);
-
   optionsNix = builtins.listToAttrs (map (o: { name = o.name; value = removeAttrs o ["name" "visible" "internal"]; }) optionsList);
 
-  # TODO: declarations: link to github
+in rec {
-  singleAsciiDoc = name: value: ''
-    == ${name}
-
-    ${value.description}
-
-    [discrete]
-    === details
-
-    Type:: ${value.type}
-    ${ if lib.hasAttr "default" value
-       then ''
-        Default::
-        +
-        ----
-        ${builtins.toJSON value.default}
-        ----
-      ''
-      else "No Default:: {blank}"
-    }
-    ${ if value.readOnly
-       then "Read Only:: {blank}"
-      else ""
-    }
-    ${ if lib.hasAttr "example" value
-       then ''
-        Example::
-        +
-        ----
-        ${builtins.toJSON value.example}
-        ----
-      ''
-      else "No Example:: {blank}"
-    }
-  '';
-
-  singleMDDoc = name: value: ''
-    ## ${lib.escape [ "<" ">" ] name}
-    ${value.description}
-
-    ${lib.optionalString (value ? type) ''
-      *_Type_*:
-      ${value.type}
-    ''}
-
-    ${lib.optionalString (value ? default) ''
-      *_Default_*
-      ```
-      ${builtins.toJSON value.default}
-      ```
-    ''}
-
-    ${lib.optionalString (value ? example) ''
-      *_Example_*
-      ```
-      ${builtins.toJSON value.example}
-      ```
-    ''}
-  '';
-
-in {
   inherit optionsNix;
 
-  optionsAsciiDoc = lib.concatStringsSep "\n" (lib.mapAttrsToList singleAsciiDoc optionsNix);
+  optionsAsciiDoc = pkgs.runCommand "options.adoc" {} ''
+    ${pkgs.python3Minimal}/bin/python ${./generateAsciiDoc.py} \
+      < ${optionsJSON}/share/doc/nixos/options.json \
+      > $out
+  '';
 
-  optionsMDDoc = lib.concatStringsSep "\n" (lib.mapAttrsToList singleMDDoc optionsNix);
+  optionsCommonMark = pkgs.runCommand "options.md" {} ''
+    ${pkgs.python3Minimal}/bin/python ${./generateCommonMark.py} \
+      < ${optionsJSON}/share/doc/nixos/options.json \
+      > $out
+  '';
 
   optionsJSON = pkgs.runCommand "options.json"
     { meta.description = "List of NixOS options in JSON format";
@@ -176,7 +112,18 @@ in {
       mkdir -p $out/nix-support
       echo "file json $dst/options.json" >> $out/nix-support/hydra-build-products
       echo "file json-br $dst/options.json.br" >> $out/nix-support/hydra-build-products
-    ''; # */
+    '';
+
+  # Convert options.json into an XML file.
+  # The actual generation of the xml file is done in nix purely for the convenience
+  # of not having to generate the xml some other way
+  optionsXML = pkgs.runCommand "options.xml" {} ''
+    ${pkgs.nix}/bin/nix-instantiate \
+      --store dummy:// \
+      --eval --xml --strict ${./optionsJSONtoXML.nix} \
+      --argstr file ${optionsJSON}/share/doc/nixos/options.json \
+      > "$out"
+  '';
 
   optionsDocBook = pkgs.runCommand "options-docbook.xml" {} ''
     optionsXML=${optionsXML}

nixos/lib/make-options-doc/generateAsciiDoc.py

@@ -0,0 +1,37 @@
+import json
+import sys
+
+options = json.load(sys.stdin)
+# TODO: declarations: link to github
+for (name, value) in options.items():
+    print(f'== {name}')
+    print()
+    print(value['description'])
+    print()
+    print('[discrete]')
+    print('=== details')
+    print()
+    print(f'Type:: {value["type"]}')
+    if 'default' in value:
+        print('Default::')
+        print('+')
+        print('----')
+        print(json.dumps(value['default'], ensure_ascii=False, separators=(',', ':')))
+        print('----')
+        print()
+    else:
+        print('No Default:: {blank}')
+    if value['readOnly']:
+        print('Read Only:: {blank}')
+    else:
+        print()
+    if 'example' in value:
+        print('Example::')
+        print('+')
+        print('----')
+        print(json.dumps(value['example'], ensure_ascii=False, separators=(',', ':')))
+        print('----')
+        print()
+    else:
+        print('No Example:: {blank}')
+    print()

nixos/lib/make-options-doc/generateCommonMark.py

@@ -0,0 +1,27 @@
+import json
+import sys
+
+options = json.load(sys.stdin)
+for (name, value) in options.items():
+    print('##', name.replace('<', '\\<').replace('>', '\\>'))
+    print(value['description'])
+    print()
+    if 'type' in value:
+        print('*_Type_*:')
+        print(value['type'])
+        print()
+    print()
+    if 'default' in value:
+        print('*_Default_*')
+        print('```')
+        print(json.dumps(value['default'], ensure_ascii=False, separators=(',', ':')))
+        print('```')
+    print()
+    print()
+    if 'example' in value:
+        print('*_Example_*')
+        print('```')
+        print(json.dumps(value['example'], ensure_ascii=False, separators=(',', ':')))
+        print('```')
+    print()
+    print()

nixos/lib/make-options-doc/options-to-docbook.xsl

@@ -189,7 +189,7 @@
   </xsl:template>
 
 
-  <xsl:template match="derivation">
+  <xsl:template match="attrs[attr[@name = '_type' and string[@value = 'derivation']]]">
     <replaceable>(build of <xsl:value-of select="attr[@name = 'name']/string/@value" />)</replaceable>
   </xsl:template>
 

nixos/lib/make-options-doc/optionsJSONtoXML.nix

@@ -0,0 +1,6 @@
+{ file }:
+
+builtins.attrValues
+  (builtins.mapAttrs
+    (name: def: def // { inherit name; })
+    (builtins.fromJSON (builtins.readFile file)))

nixos/lib/make-options-doc/sortXML.py

@@ -19,7 +19,6 @@ def sortKey(opt):
         for p in opt.findall('attr[@name="loc"]/list/string')
     ]
 
-# always ensure that the sort order matches the order used in the nix expression!
 options.sort(key=sortKey)
 
 doc = ET.Element("expr")

nixos/lib/make-squashfs.nix

@@ -21,8 +21,15 @@ stdenv.mkDerivation {
       # for nix-store --load-db.
       cp $closureInfo/registration nix-path-registration
 
+      # 64 cores on i686 does not work
+      # fails with FATAL ERROR: mangle2:: xz compress failed with error code 5
+      if ((NIX_BUILD_CORES > 48)); then
+        NIX_BUILD_CORES=48
+      fi
+
       # Generate the squashfs image.
       mksquashfs nix-path-registration $(cat $closureInfo/store-paths) $out \
-        -no-hardlinks -keep-as-directory -all-root -b 1048576 -comp ${comp}
+        -no-hardlinks -keep-as-directory -all-root -b 1048576 -comp ${comp} \
+        -processors $NIX_BUILD_CORES
     '';
 }

nixos/lib/systemd-unit-options.nix

@@ -1,7 +1,7 @@
-{ config, lib }:
+{ lib, systemdUtils }:
 
+with systemdUtils.lib;
 with lib;
-with import ./systemd-lib.nix { inherit config lib pkgs; };
 
 let
   checkService = checkUnitConfig "Service" [

nixos/lib/utils.nix

@@ -1,4 +1,4 @@
-pkgs: with pkgs.lib;
+{ lib, config, pkgs }: with lib;
 
 rec {
 
@@ -165,4 +165,9 @@ rec {
       ${builtins.toJSON set}
       EOF
     '';
+
+  systemdUtils = {
+    lib = import ./systemd-lib.nix { inherit lib config pkgs; };
+    unitOptions = import ./systemd-unit-options.nix { inherit lib systemdUtils; };
+  };
 }

nixos/modules/hardware/pcmcia.nix

@@ -35,6 +35,7 @@ in
 
       config = mkOption {
         default = null;
+        type = types.nullOr types.path;
         description = ''
           Path to the configuration file which maps the memory, IRQs
           and ports used by the PCMCIA hardware.

nixos/modules/misc/extra-arguments.nix

@@ -1,7 +1,7 @@
-{ pkgs, ... }:
+{ lib, config, pkgs, ... }:
 
 {
   _module.args = {
-    utils = import ../../lib/utils.nix pkgs;
+    utils = import ../../lib/utils.nix { inherit lib config pkgs; };
   };
 }

nixos/modules/programs/dconf.nix

@@ -60,7 +60,7 @@ in
     environment.systemPackages = [ pkgs.dconf ];
 
     # Needed for unwrapped applications
-    environment.sessionVariables.GIO_EXTRA_MODULES = mkIf cfg.enable [ "${pkgs.dconf.lib}/lib/gio/modules" ];
+    environment.variables.GIO_EXTRA_MODULES = mkIf cfg.enable [ "${pkgs.dconf.lib}/lib/gio/modules" ];
   };
 
 }

nixos/modules/security/systemd-confinement.nix

@@ -1,11 +1,9 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, utils, ... }:
 
 let
   toplevelConfig = config;
   inherit (lib) types;
-  inherit (import ../system/boot/systemd-lib.nix {
+  inherit (utils.systemdUtils.lib) mkPathSafeName;
-    inherit config pkgs lib;
-  }) mkPathSafeName;
 in {
   options.systemd.services = lib.mkOption {
     type = types.attrsOf (types.submodule ({ name, config, ... }: {

nixos/modules/services/backup/restic.nix

@@ -1,10 +1,10 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, utils, ... }:
 
 with lib;
 
 let
   # Type for a valid systemd unit option. Needed for correctly passing "timerConfig" to "systemd.timers"
-  unitOption = (import ../../system/boot/systemd-unit-options.nix { inherit config lib; }).unitOption;
+  inherit (utils.systemdUtils.unitOptions) unitOption;
 in
 {
   options.services.restic.backups = mkOption {

nixos/modules/services/desktops/gnome/glib-networking.nix

@@ -38,7 +38,7 @@ with lib;
 
     systemd.packages = [ pkgs.glib-networking ];
 
-    environment.sessionVariables.GIO_EXTRA_MODULES = [ "${pkgs.glib-networking.out}/lib/gio/modules" ];
+    environment.variables.GIO_EXTRA_MODULES = [ "${pkgs.glib-networking.out}/lib/gio/modules" ];
 
   };
 

nixos/modules/services/desktops/gvfs.nix

@@ -57,7 +57,7 @@ in
     services.udev.packages = [ pkgs.libmtp.bin ];
 
     # Needed for unwrapped applications
-    environment.sessionVariables.GIO_EXTRA_MODULES = [ "${cfg.package}/lib/gio/modules" ];
+    environment.variables.GIO_EXTRA_MODULES = [ "${cfg.package}/lib/gio/modules" ];
 
   };
 

nixos/modules/services/development/hoogle.nix

@@ -40,6 +40,7 @@ in {
 
     haskellPackages = mkOption {
       description = "Which haskell package set to use.";
+      type = types.attrs;
       default = pkgs.haskellPackages;
       defaultText = literalExpression "pkgs.haskellPackages";
     };

nixos/modules/services/misc/dysnomia.nix

@@ -104,31 +104,37 @@ in
       properties = mkOption {
         description = "An attribute set in which each attribute represents a machine property. Optionally, these values can be shell substitutions.";
         default = {};
+        type = types.attrs;
       };
 
       containers = mkOption {
         description = "An attribute set in which each key represents a container and each value an attribute set providing its configuration properties";
         default = {};
+        type = types.attrsOf types.attrs;
       };
 
       components = mkOption {
         description = "An atttribute set in which each key represents a container and each value an attribute set in which each key represents a component and each value a derivation constructing its initial state";
         default = {};
+        type = types.attrsOf types.attrs;
       };
 
       extraContainerProperties = mkOption {
         description = "An attribute set providing additional container settings in addition to the default properties";
         default = {};
+        type = types.attrs;
       };
 
       extraContainerPaths = mkOption {
         description = "A list of paths containing additional container configurations that are added to the search folders";
         default = [];
+        type = types.listOf types.path;
       };
 
       extraModulePaths = mkOption {
         description = "A list of paths containing additional modules that are added to the search folders";
         default = [];
+        type = types.listOf types.path;
       };
 
       enableLegacyModules = mkOption {

nixos/modules/services/web-apps/discourse.nix

@@ -621,12 +621,13 @@ in
 
       max_user_api_reqs_per_minute = 20;
       max_user_api_reqs_per_day = 2880;
-      max_admin_api_reqs_per_key_per_minute = 60;
+      max_admin_api_reqs_per_minute = 60;
       max_reqs_per_ip_per_minute = 200;
       max_reqs_per_ip_per_10_seconds = 50;
       max_asset_reqs_per_ip_per_10_seconds = 200;
       max_reqs_per_ip_mode = "block";
       max_reqs_rate_limit_on_private = false;
+      skip_per_ip_rate_limit_trust_level = 1;
       force_anonymous_min_queue_seconds = 1;
       force_anonymous_min_per_10_seconds = 3;
       background_requests_max_queue_length = 0.5;
@@ -646,6 +647,9 @@ in
       enable_email_sync_demon = false;
       max_digests_enqueued_per_30_mins_per_site = 10000;
       cluster_name = null;
+      multisite_config_path = "config/multisite.yml";
+      enable_long_polling = null;
+      long_polling_interval = null;
     };
 
     services.redis.enable = lib.mkDefault (cfg.redis.host == "localhost");
@@ -825,7 +829,7 @@ in
 
       appendHttpConfig = ''
         # inactive means we keep stuff around for 1440m minutes regardless of last access (1 week)
-        # levels means it is a 2 deep heirarchy cause we can have lots of files
+        # levels means it is a 2 deep hierarchy cause we can have lots of files
         # max_size limits the size of the cache
         proxy_cache_path /var/cache/nginx inactive=1440m levels=1:2 keys_zone=discourse:10m max_size=600m;
 
@@ -837,7 +841,7 @@ in
         inherit (cfg) sslCertificate sslCertificateKey enableACME;
         forceSSL = lib.mkDefault tlsEnabled;
 
-        root = "/run/discourse/public";
+        root = "${cfg.package}/share/discourse/public";
 
         locations =
           let
@@ -889,7 +893,7 @@ in
               "~ ^/uploads/" = proxy {
                 extraConfig = cache_1y + ''
                   proxy_set_header X-Sendfile-Type X-Accel-Redirect;
-                  proxy_set_header X-Accel-Mapping /run/discourse/public/=/downloads/;
+                  proxy_set_header X-Accel-Mapping ${cfg.package}/share/discourse/public/=/downloads/;
 
                   # custom CSS
                   location ~ /stylesheet-cache/ {
@@ -911,7 +915,7 @@ in
               "~ ^/admin/backups/" = proxy {
                 extraConfig = ''
                   proxy_set_header X-Sendfile-Type X-Accel-Redirect;
-                  proxy_set_header X-Accel-Mapping /run/discourse/public/=/downloads/;
+                  proxy_set_header X-Accel-Mapping ${cfg.package}/share/discourse/public/=/downloads/;
                 '';
               };
               "~ ^/(svg-sprite/|letter_avatar/|letter_avatar_proxy/|user_avatar|highlight-js|stylesheets|theme-javascripts|favicon/proxied|service-worker)" = proxy {
@@ -938,7 +942,7 @@ in
               };
               "/downloads/".extraConfig = ''
                 internal;
-                alias /run/discourse/public/;
+                alias ${cfg.package}/share/discourse/public/;
               '';
             };
       };

nixos/modules/services/web-apps/discourse.xml

@@ -297,7 +297,7 @@ services.discourse = {
       the script:
       <programlisting language="bash">
 ./update.py update-plugins
-</programlisting>.
+</programlisting>
     </para>
 
     <para>

nixos/modules/services/x11/window-managers/xmonad.nix

@@ -39,10 +39,12 @@ in {
   options = {
     services.xserver.windowManager.xmonad = {
       enable = mkEnableOption "xmonad";
+
       haskellPackages = mkOption {
         default = pkgs.haskellPackages;
         defaultText = literalExpression "pkgs.haskellPackages";
         example = literalExpression "pkgs.haskell.packages.ghc784";
+        type = types.attrs;
         description = ''
           haskellPackages used to build Xmonad and other packages.
           This can be used to change the GHC version used to build

nixos/modules/system/boot/networkd.nix

@@ -1,8 +1,8 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, utils, ... }:
 
+with utils.systemdUtils.unitOptions;
+with utils.systemdUtils.lib;
 with lib;
-with import ./systemd-unit-options.nix { inherit config lib; };
-with import ./systemd-lib.nix { inherit config lib pkgs; };
 
 let
 

nixos/modules/system/boot/stage-1-init.sh

@@ -119,6 +119,18 @@ specialMount() {
 }
 source @earlyMountScript@
 
+# Copy initrd secrets from /.initrd-secrets to their actual destinations
+if [ -d "/.initrd-secrets" ]; then
+    #
+    # Secrets are named by their full destination pathname and stored
+    # under /.initrd-secrets/
+    #
+    for secret in $(cd "/.initrd-secrets"; find . -type f); do
+        mkdir -p $(dirname "/$secret")
+        cp "/.initrd-secrets/$secret" "$secret"
+    done
+fi
+
 # Log the script output to /dev/kmsg or /run/log/stage-1-init.log.
 mkdir -p /tmp
 mkfifo /tmp/stage-1-init.log.fifo

nixos/modules/system/boot/stage-1.nix

@@ -411,8 +411,8 @@ let
         ${lib.concatStringsSep "\n" (mapAttrsToList (dest: source:
             let source' = if source == null then dest else toString source; in
               ''
-                mkdir -p $(dirname "$tmp/${dest}")
+                mkdir -p $(dirname "$tmp/.initrd-secrets/${dest}")
-                cp -a ${source'} "$tmp/${dest}"
+                cp -a ${source'} "$tmp/.initrd-secrets/${dest}"
               ''
           ) config.boot.initrd.secrets)
          }

nixos/modules/system/boot/systemd-nspawn.nix

@@ -1,8 +1,8 @@
-{ config, lib , pkgs, ...}:
+{ config, lib, pkgs, utils, ...}:
 
+with utils.systemdUtils.unitOptions;
+with utils.systemdUtils.lib;
 with lib;
-with import ./systemd-unit-options.nix { inherit config lib; };
-with import ./systemd-lib.nix { inherit config lib pkgs; };
 
 let
   cfg = config.systemd.nspawn;

nixos/modules/system/boot/systemd.nix

@@ -1,9 +1,9 @@
 { config, lib, pkgs, utils, ... }:
 
 with utils;
+with systemdUtils.unitOptions;
+with systemdUtils.lib;
 with lib;
-with import ./systemd-unit-options.nix { inherit config lib; };
-with import ./systemd-lib.nix { inherit config lib pkgs; };
 
 let
 

nixos/modules/tasks/snapraid.nix

@@ -207,7 +207,7 @@ in
             SystemCallArchitectures = "native";
             SystemCallFilter = "@system-service";
             SystemCallErrorNumber = "EPERM";
-            CapabilityBoundingSet = "CAP_DAC_OVERRIDE" ++
+            CapabilityBoundingSet = "CAP_DAC_OVERRIDE" +
               lib.optionalString cfg.touchBeforeSync " CAP_FOWNER";
 
             ProtectSystem = "strict";

nixos/tests/brscan5.nix

@@ -23,6 +23,7 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     };
 
   testScript = ''
+    import re
     # sane loads libsane-brother5.so.1 successfully, and scanimage doesn't die
     strace = machine.succeed('strace scanimage -L 2>&1').split("\n")
     regexp = 'openat\(.*libsane-brother5.so.1", O_RDONLY|O_CLOEXEC\) = \d\d*$'

nixos/tests/initrd-secrets.nix

@@ -13,7 +13,12 @@ let
 
     machine = { ... }: {
       virtualisation.useBootLoader = true;
-      boot.initrd.secrets."/test" = secretInStore;
+      boot.initrd.secrets = {
+        "/test" = secretInStore;
+
+        # This should *not* need to be copied in postMountCommands
+        "/run/keys/test" = secretInStore;
+      };
       boot.initrd.postMountCommands = ''
         cp /test /mnt-root/secret-from-initramfs
       '';
@@ -26,7 +31,8 @@ let
       start_all()
       machine.wait_for_unit("multi-user.target")
       machine.succeed(
-          "cmp ${secretInStore} /secret-from-initramfs"
+          "cmp ${secretInStore} /secret-from-initramfs",
+          "cmp ${secretInStore} /run/keys/test",
       )
     '';
   };

pkgs/applications/audio/netease-music-tui/default.nix

@@ -2,13 +2,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "netease-music-tui";
-  version = "0.1.3";
+  version = "0.1.4";
 
   src = fetchFromGitHub {
     owner = "betta-cyber";
     repo = "netease-music-tui";
     rev = "v${version}";
-    sha256 = "09355a6d197ckayh9833y39dsarklgpgrq3raapiv25z59di30qq";
+    sha256 = "sha256-ILJkejRKG2DRXgR6O2tAFbrbd8HtnLZJmITq7hF41DQ=";
   };
 
   cargoPatches = [ ./cargo-lock.patch ];
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ alsa-lib openssl ];
 
-  cargoSha256 = "1pca0sz4rz8qls6k2vhf70ixhnvgk81c4hbx81q3pv106g5k205f";
+  cargoSha256 = "sha256-/JQDUtSSkuO9nrYVSkQOaZjps1BUuH8Bc1SMyDSSJS4=";
 
   meta = with lib; {
     homepage = "https://github.com/betta-cyber/netease-music-tui";

pkgs/applications/audio/padthv1/default.nix

@@ -2,11 +2,11 @@
 
 mkDerivation rec {
   pname = "padthv1";
-  version = "0.9.18";
+  version = "0.9.23";
 
   src = fetchurl {
     url = "mirror://sourceforge/padthv1/${pname}-${version}.tar.gz";
-    sha256 = "1karrprb3ijrbiwpr43rl3nxnzc33lnmwrd1832psgr3flnr9fp5";
+    sha256 = "sha256-9yFfvlskOYnGraou2S3Qffl8RoYJqE0wnDlOP8mxQgg=";
   };
 
   buildInputs = [ libjack2 alsa-lib libsndfile liblo lv2 qt5.qtbase qt5.qttools fftwFloat ];

pkgs/applications/blockchains/elements/default.nix

@@ -24,11 +24,11 @@
 with lib;
 stdenv.mkDerivation rec {
   pname = if withGui then "elements" else "elementsd";
-  version = "0.21.0";
+  version = "0.21.0.1";
 
   src = fetchurl {
     url = "https://github.com/ElementsProject/elements/archive/elements-${version}.tar.gz";
-    sha256 = "0d9mcb0nw9qqhv0jhpddi9i4iry3w7b5jifsl5kpcw82qrkvgfgj";
+    sha256 = "00a2lrn77mfmr5dvrqwplk20gaxxq4cd9gcx667hgmfmmz1v6r6b";
   };
 
   nativeBuildInputs =

pkgs/applications/blockchains/ergo/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ergo";
-  version = "4.0.15";
+  version = "4.0.16";
 
   src = fetchurl {
     url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "sha256-4omuu/9EeywWDkk//4TTal/1siCe/4YMmEsIefBxsuY=";
+    sha256 = "sha256-cdfpXJtN/JXQNBnCyTIvJLQQhjzDV3+l4WoASII9uuU=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/editors/emacs/elisp-packages/bqn-mode/default.nix

@@ -5,13 +5,13 @@
 
 trivialBuild {
   pname = "bqn-mode";
-  version = "0.pre+unstable=2021-10-26";
+  version = "0.pre+unstable=2021-12-04";
 
   src = fetchFromGitHub {
-    owner = "AndersonTorres";
+    owner = "museoa";
     repo = "bqn-mode";
-    rev = "89d6928d0653518c97bcb06ae156f8b1de1b8768";
+    rev = "38fba1193e0d1101f3b90bd76e419c011651ad6f";
-    sha256 = "0pnvfssglaqbjw6hw7vf7vffzjdbqscqhyl62vknml29yl7mjq05";
+    sha256 = "0fdfz3kmrdgmx2i6fgrrj1cvapvrgnc3ahnwx3aayrpl1f091439";
   };
 
   meta = with lib; {

pkgs/applications/editors/gnome-builder/default.nix

@@ -39,13 +39,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-builder";
-  version = "41.2";
+  version = "41.3";
 
   outputs = [ "out" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "VjF7Vn94Yd2gNzKVsk6U7fSRnMlV+0XtYqyllGIY4BI=";
+    sha256 = "4iUPyOnp8gAsRS5ZUNgmhXNNPESAs1Fnq1CKyHAlCeE=";
   };
 
   nativeBuildInputs = [

pkgs/applications/graphics/pdfcpu/default.nix

@@ -2,19 +2,25 @@
 
 buildGoModule rec {
   pname = "pdfcpu";
-  version = "0.3.12";
+  version = "0.3.13";
 
   src = fetchFromGitHub {
     owner = "pdfcpu";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Ts4FJWUeWHVfeBEetgACYMGEsDLHm5JOEEn7EtQduPU=";
+    sha256 = "sha256-CFKo8YEAXAniX+jL2A0naJUOn3KAWwcrPsabdiZevhI=";
   };
 
   vendorSha256 = "sha256-p/2Bu5h2P3ebgvSC12jdR2Zpd27xCFwtB/KZV0AULAM=";
 
   # No tests
   doCheck = false;
+  doInstallCheck = true;
+  installCheckPhase = ''
+    export HOME=$(mktemp -d)
+    echo checking the version print of pdfcpu
+    $out/bin/pdfcpu version | grep ${version}
+  '';
 
   subPackages = [ "cmd/pdfcpu" ];
 

pkgs/applications/misc/calibre/default.nix

@@ -27,14 +27,14 @@
 
 mkDerivation rec {
   pname = "calibre";
-  version = "5.31.1";
+  version = "5.33.2";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-3LGEWuHms54ji9GWSyLl8cFWIRBqHY1Jf/CNPJOywrU=";
+    sha256 = "sha256-wtt3ucCaFq9wLk79CeCz20tMM6AbLtZ4Ln6TxOx0dvI=";
   };
 
-  # https://sources.debian.org/patches/calibre/5.31.1+dfsg-1
+  # https://sources.debian.org/patches/calibre/5.33.2+dfsg-1
   patches = [
     #  allow for plugin update check, but no calibre version check
     (fetchpatch {

pkgs/applications/misc/gnome-passwordsafe/default.nix

@@ -17,16 +17,16 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "gnome-passwordsafe";
-  version = "5.0";
+  version = "5.1";
   format = "other";
   strictDeps = false; # https://github.com/NixOS/nixpkgs/issues/56943
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
-    repo = "PasswordSafe";
+    repo = "secrets";
     rev = version;
-    sha256 = "8EFKLNK7rZlYL2g/7FmaC5r5hcdblsnod/aB8NYiBvY=";
+    sha256 = "sha256-RgpkLoqhwCdaPZxC1Qe0MpLtYLevNCOxbvwEEI0cpE0=";
   };
 
   nativeBuildInputs = [
@@ -58,7 +58,7 @@ python3Packages.buildPythonApplication rec {
   meta = with lib; {
     broken = stdenv.hostPlatform.isStatic; # libpwquality doesn't provide bindings when static
     description = "Password manager for GNOME which makes use of the KeePass v.4 format";
-    homepage = "https://gitlab.gnome.org/World/PasswordSafe";
+    homepage = "https://gitlab.gnome.org/World/secrets";
     license = licenses.gpl3Only;
     platforms = platforms.linux;
     maintainers = with maintainers; [ mvnetbiz ];

pkgs/applications/misc/gpxsee/default.nix

@@ -1,14 +1,14 @@
-{ lib, stdenv, mkDerivation, fetchFromGitHub, qmake, qttools, qttranslations, substituteAll }:
+{ lib, stdenv, fetchFromGitHub, qmake, qttools, qttranslations, qtlocation, wrapQtAppsHook, substituteAll }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "gpxsee";
-  version = "9.12";
+  version = "10.0";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     rev = version;
-    sha256 = "sha256-hIDphwmS4UNSTvE+Icupipo6AmT2fiPdaufT/I3EeJ4=";
+    sha256 = "sha256-XACexj91TLd/i2GoFr0zZ3Yqcg+KjKoWWPfCGsEIR04=";
   };
 
   patches = (substituteAll {
@@ -17,7 +17,9 @@ mkDerivation rec {
     inherit qttranslations;
   });
 
-  nativeBuildInputs = [ qmake qttools ];
+  buildInputs = [ qtlocation ];
+
+  nativeBuildInputs = [ qmake qttools wrapQtAppsHook ];
 
   preConfigure = ''
     lrelease gpxsee.pro

pkgs/applications/misc/jp2a/default.nix

@@ -11,14 +11,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.1.0";
+  version = "1.1.1";
   pname = "jp2a";
 
   src = fetchFromGitHub {
     owner = "Talinx";
     repo = "jp2a";
     rev = "v${version}";
-    sha256 = "1dz2mrhl45f0vwyfx7qc3665xma78q024c10lfsgn6farrr0c2lb";
+    sha256 = "sha256-CUyJMVvzXniK5fdZBuWUK9GLSGJyL5Zig49ikGOGRTw=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];

pkgs/applications/misc/navi/default.nix

@@ -1,17 +1,17 @@
-{ stdenv, fetchFromGitHub, fzf, lib, makeWrapper, rustPlatform, wget, libiconv }:
+{ stdenv, fetchFromGitHub, lib, makeWrapper, rustPlatform, wget, libiconv, withFzf ? true, fzf }:
 
 rustPlatform.buildRustPackage rec {
   pname = "navi";
-  version = "2.17.0";
+  version = "2.18.0";
 
   src = fetchFromGitHub {
     owner = "denisidoro";
     repo = "navi";
     rev = "v${version}";
-    sha256 = "sha256-WH8FfQ7cD4aFUi9iE0tR/B+5oWy8tMVmMLxusDwXF7w=";
+    sha256 = "sha256-JG0MZrvpx+cAFcZJK05GUI10PG53UmxjJjveAZA7k/M=";
   };
 
-  cargoSha256 = "sha256-TH9DNCoUVqH5g05Z4Vdv7F8CCLnaYezupI5FeJhYTaQ=";
+  cargoSha256 = "sha256-S2DBzeir6+JS1jfVxCQ68v4Rl7UBpghbtE+wdu341xw=";
 
   nativeBuildInputs = [ makeWrapper ];
 
@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage rec {
   postInstall = ''
     wrapProgram $out/bin/navi \
       --prefix PATH : "$out/bin" \
-      --prefix PATH : ${lib.makeBinPath [ fzf wget ]}
+      --prefix PATH : ${lib.makeBinPath([ wget ] ++ lib.optionals withFzf [ fzf ])}
   '';
 
   checkFlags = [

pkgs/applications/misc/nwg-panel/default.nix

@@ -13,13 +13,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nwg-panel";
-  version = "0.4.3";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-panel";
     rev = "v${version}";
-    sha256 = "1ihwrs0h2kcw0jw9zq43a9m1qaxllqmbvz0wyv73sgh9zsid5733";
+    sha256 = "16qpl8dyvll6zy45q8nrg4n6g6n72pj9425gdxv2wfq96mcxfmbl";
   };
 
   # No tests

pkgs/applications/misc/orca/default.nix

@@ -34,13 +34,13 @@
 
 buildPythonApplication rec {
   pname = "orca";
-  version = "41.0";
+  version = "41.1";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "dpflFEXhn9d05osWCtr2aHuAgXLeBBdgLhaXZra21L0=";
+    sha256 = "H9ArmQlPCfbnLfd54actzkFCfsguJFpOqDIzqX7tonE=";
   };
 
   patches = [

pkgs/applications/misc/otpclient/default.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "otpclient";
-  version = "2.4.4";
+  version = "2.4.7";
 
   src = fetchFromGitHub {
     owner = "paolostivanin";
     repo = pname;
     rev = "v${version}";
-    sha256 = "0zjvhcx9q8nsf97zikddxriky0kghi4j4i7312s94pl8c7kb4abr";
+    sha256 = "sha256-UR7h+btmOSnpjkrQMiABcM1tOFjOhNVWuKYDF9qXfFo=";
   };
 
   buildInputs = [ gtk3 jansson libgcrypt libzip libpng libcotp zbar ];

pkgs/applications/misc/tut/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "tut";
-  version = "0.0.41";
+  version = "0.0.42";
 
   src = fetchFromGitHub {
     owner = "RasmusLindroth";
     repo = pname;
     rev = version;
-    sha256 = "sha256-13d3EE/rswcHRALUfL46qpKYJUDwGiou5kUz+nCC8VQ=";
+    sha256 = "sha256-zWhG9lzerzDqqFN8IG5JSv3voLzvtp/gg6jBisbodMc=";
   };
 
-  vendorSha256 = "sha256-RtvzQvZIFdLo24U9IWcoL9qnf4/q/+1UCrb7dcRKEIE=";
+  vendorSha256 = "sha256-kMGEAN/I2XsIc6zCDbhbbstYlyjDpXQsOPUzjaJqJBk=";
 
   meta = with lib; {
     description = "A TUI for Mastodon with vim inspired keys";

pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -31,22 +31,22 @@
     }
   },
   "dev": {
-    "version": "98.0.4736.0",
+    "version": "98.0.4750.0",
-    "sha256": "1bakzvzx0604k20p16lxmbl0s8za6fy4akng35c1kzf350jznq7n",
+    "sha256": "0qygnmb1wlbarni2pdfs1xl50ggvf0211c6mj7341wwsbd0bpkgr",
-    "sha256bin64": "09adpl6b43fzlms081c1bs3vrlwrm3kq0mfcqff4q33i0wb5wl25",
+    "sha256bin64": "1psbh5xwlgr4ain4s9vk7d0kdbbd14v29f95ai5i4d2d3cpj2319",
     "deps": {
       "gn": {
-        "version": "2021-11-24",
+        "version": "2021-12-03",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "b79031308cc878488202beb99883ec1f2efd9a6d",
+        "rev": "e0afadf7a743d5b14737bd454df45d5f1caf0d23",
-        "sha256": "1fdn48y0nvs2qm67qvp1i75d9278ddi5v3bpxgjf28zrh9yragwd"
+        "sha256": "00pxhfikscghgm79zckh9j00jgjmdy6hixkpfq5vmgc0xpxif78v"
       }
     }
   },
   "ungoogled-chromium": {
-    "version": "96.0.4664.45",
+    "version": "96.0.4664.93",
-    "sha256": "01q4fsf2cbx6g9nnaihvc5jj3ap8jq2gf16pnhf7ixzbhgcnm328",
+    "sha256": "14rlm91pzpdll6x2r1sxdswiv19h1ykxcq0csi9k9g0a9s71yyvw",
-    "sha256bin64": "0546i4yd1jahv088hjxpq0jc393pscvl5ap3s2qw5jrybliyfd2g",
+    "sha256bin64": "15233njj6ln7q3c112ssfh9s4m3shhp920zw8648z9dr7k8512qb",
     "deps": {
       "gn": {
         "version": "2021-09-24",
@@ -55,8 +55,8 @@
         "sha256": "0y4414h8jqsbz5af6pn91c0vkfp4s281s85g992xfyl785c5zbsi"
       },
       "ungoogled-patches": {
-        "rev": "96.0.4664.45-1",
+        "rev": "96.0.4664.93-1",
-        "sha256": "1k0kf5ika1sz489bcbn485kmdq1xp7ssa80gbqrpd60xihkhnrm3"
+        "sha256": "0r8cwriaxbmzy9sxa6mx71h8n1a0x7pdx3kmqc1sg97b2qwmg15r"
       }
     }
   }

pkgs/applications/networking/browsers/firefox/common.nix

@@ -132,13 +132,8 @@ buildStdenv.mkDerivation ({
   patches = [
   ] ++
   lib.optional (lib.versionAtLeast version "86") ./env_var_for_system_dir-ff86.patch ++
-  lib.optional (lib.versionAtLeast version "90") ./no-buildconfig-ffx90.patch ++
+  lib.optional (lib.versionAtLeast version "90" && lib.versionOlder version "95") ./no-buildconfig-ffx90.patch ++
-  # This fixes a race condition causing deadlock.
+  lib.optional (lib.versionAtLeast version "95") ./no-buildconfig-ffx95.patch ++
-  # https://phabricator.services.mozilla.com/D128657
-  lib.optional (lib.versionAtLeast version "94") (fetchpatch {
-    url = "https://raw.githubusercontent.com/archlinux/svntogit-packages/9c7f25d45bb1dd6b1a865780bc249cdaa619aa83/trunk/0002-Bug-1735905-Upgrade-cubeb-pulse-to-fix-a-race-condit.patch";
-    sha256 = "l4bMK/YDXcDpIjPy9DPuUSFyDpzVQca201A4h9eav5g=";
-  }) ++
   patches;
 
   # Ignore trivial whitespace changes in patches, this fixes compatibility of
@@ -297,6 +292,7 @@ buildStdenv.mkDerivation ({
   ++ lib.optionals enableDebugSymbols [ "--disable-strip" "--disable-install-strip" ]
 
   ++ lib.optional enableOfficialBranding "--enable-official-branding"
+  ++ lib.optional (lib.versionAtLeast version "95") "--without-wasm-sandboxed-libraries"
   ++ extraConfigureFlags;
 
   postConfigure = ''

pkgs/applications/networking/browsers/firefox/no-buildconfig-ffx95.patch

@@ -0,0 +1,27 @@
+diff --git a/docshell/base/nsAboutRedirector.cpp b/docshell/base/nsAboutRedirector.cpp
+index 038136a..1709f1f 100644
+--- a/docshell/base/nsAboutRedirector.cpp
++++ b/docshell/base/nsAboutRedirector.cpp
+@@ -66,9 +66,6 @@ static const RedirEntry kRedirMap[] = {
+     {"about", "chrome://global/content/aboutAbout.html", 0},
+     {"addons", "chrome://mozapps/content/extensions/aboutaddons.html",
+      nsIAboutModule::ALLOW_SCRIPT | nsIAboutModule::IS_SECURE_CHROME_UI},
+-    {"buildconfig", "chrome://global/content/buildconfig.html",
+-     nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT |
+-         nsIAboutModule::IS_SECURE_CHROME_UI},
+     {"checkerboard", "chrome://global/content/aboutCheckerboard.html",
+      nsIAboutModule::URI_SAFE_FOR_UNTRUSTED_CONTENT |
+          nsIAboutModule::ALLOW_SCRIPT},
+diff --git a/toolkit/content/jar.mn b/toolkit/content/jar.mn
+index 9ac4305..916b4ad 100644
+--- a/toolkit/content/jar.mn
++++ b/toolkit/content/jar.mn
+@@ -39,8 +39,6 @@ toolkit.jar:
+    content/global/plugins.html
+    content/global/plugins.css
+    content/global/plugins.js
+-*   content/global/buildconfig.html
+-   content/global/buildconfig.css
+    content/global/contentAreaUtils.js
+    content/global/datepicker.xhtml
+ #ifndef MOZ_FENNEC

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -7,10 +7,10 @@ in
 rec {
   firefox = common rec {
     pname = "firefox";
-    version = "94.0.2";
+    version = "95.0";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "00ce4f6be711e1f309828e030163e61bbd9fe3364a8e852e644177c93832078877dea1a516719b106a52c0d8462193ed52c1d3cc7ae34ea021eb1dd0f5b685e2";
+      sha512 = "350672a2cd99195c67dafc0e71c6eaf1e23e85a5fe92775697119a054f17c34a736035e23d7f2bb404b544f0f144efef3843cfc293596a6e61d1ea36efc3a724";
     };
 
     meta = {
@@ -32,10 +32,10 @@ rec {
 
   firefox-esr-91 = common rec {
     pname = "firefox-esr";
-    version = "91.3.0esr";
+    version = "91.4.0esr";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "7cf6efd165acc134bf576715580c103a2fc10ab928ede4c18f69908c62a04eb0f60affa8ceafd5883b393c31b85cae6821d0ae063c9e78117456d475947deaa9";
+      sha512 = "781bf62a0e1215cad7d90de7c822978997bfeaf71bde4e7124a732921d130762c6654417c708a299726039d1603ff5e0796106118ad4b2ddef4e9dac84887765";
     };
 
     meta = {

pkgs/applications/networking/browsers/lagrange/default.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lagrange";
-  version = "1.9.1";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "skyjake";
     repo = "lagrange";
     rev = "v${version}";
-    sha256 = "sha256-5mZbx9L7YDG2VwrF/iFhYCw8R/0FOnZz9cRkA5Wl9MA=";
+    sha256 = "sha256-ZiG3KSEk4l9FFxfftQNb1UHQV//SlK8thp5Tr8ek5v4=";
     fetchSubmodules = true;
   };
 

pkgs/applications/networking/cluster/fluxctl/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "fluxctl";
-  version = "1.24.1";
+  version = "1.24.3";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = "flux";
     rev = version;
-    sha256 = "sha256-lgcEkOu4iaLg+tP826Qpgmn0ogOpr62o1iWlv1yLbBQ=";
+    sha256 = "sha256-i86WwSR14hxaXWMesvG2mG8nqXd97M3TekK2FLTLL+Y=";
   };
 
-  vendorSha256 = "sha256-NQonBTHToGPo7QsChvuVM/jbV5FK71HMJfe5fe1gZYw=";
+  vendorSha256 = "sha256-Fw3/SMO66eExlDNcIaHM+G2kB4zb1Cih7kp8xfel/iY=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/networking/cluster/istioctl/default.nix

@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "istioctl";
-  version = "1.11.4";
+  version = "1.11.5";
 
   src = fetchFromGitHub {
     owner = "istio";
     repo = "istio";
     rev = version;
-    sha256 = "sha256-DkZRRjnTWziAL6WSPy5V8fgjpRO2g3Ew25j3F47pDnk=";
+    sha256 = "sha256-GngjZnE6G/7Iz/BFUKciZAnk/FjcSngt9H+M23E3hHk=";
   };
-  vendorSha256 = "sha256-kioicA4vdWuv0mvpjZRH0r1EuosS06Q3hIEkxdV4/1A=";
+  vendorSha256 = "sha256-MzlDChyuEVfcfS0DLf/FqKXk3qzsqwO3ZBVJlZqrNhg=";
 
   doCheck = false;
 

pkgs/applications/networking/cluster/kube3d/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kube3d";
-  version = "5.0.3";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "rancher";
     repo = "k3d";
     rev = "v${version}";
-    sha256 = "sha256-BUQG+Nq5BsL+4oBksL8Im9CtNFvwuaW/HebMp9VoORo=";
+    sha256 = "sha256-xtYoyA5tcCjNbDysZn5yFQtMKLIu6DOHKH5vDMDCrZQ=";
   };
 
   vendorSha256 = null;

pkgs/applications/networking/cluster/octant/default.nix

@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "octant";
-  version = "0.24.0";
+  version = "0.25.0";
 
   src =
     let
@@ -19,10 +19,10 @@ stdenv.mkDerivation rec {
       };
     in
     fetchsrc version {
-      x86_64-linux = "sha256-fvGVcp6SpHY0UuWurRuypDXbWEs565bK1Peg0Q4Y0m8=";
+      x86_64-linux = "sha256-woBmYDOOh3AQH0RZJtMCrOfjFBrpMPzv22cVZ2/xHZo=";
-      aarch64-linux = "sha256-7h8l4Pm34UCZ5NhD1scM1c5sM4ePGLDRGAQBfI5vSHI=";
+      aarch64-linux = "sha256-3YUUdOZULjJZqVJP0aO/d1WulXlpwf012NYJ6Mc2qp8=";
-      x86_64-darwin = "sha256-2S+D5Gg98GEL5L6bC8ZUSEJXFs74ZaZlNkYHYJYZvqw=";
+      x86_64-darwin = "sha256-9lbMyEid4I1fRLkLwGbmrB2OkycnGBPUU5wEdVZoTLo=";
-      aarch64-darwin = "sha256-rEhMX+v2sjsmc1p22uscjIyhcnpv2fWjgEnU+lUq9RE=";
+      aarch64-darwin = "sha256-Q0ZkQX9FpzEc6WC3mRoYfg9oW3fvLB1/Ksa64TDlSgo=";
     };
 
   dontConfigure = true;

pkgs/applications/networking/gmailctl/default.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "gmailctl";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "mbrt";
     repo = "gmailctl";
     rev = "v${version}";
-    sha256 = "sha256-1gOixuOvPHEjnnDNNda9sktnhffovOfeG4XDrLRRMlE=";
+    sha256 = "sha256-JuE8+OW+qM6tir4A25tN2GTXQIkcKVE4uKbZNSTcNlA=";
   };
 
   nativeBuildInputs = [
@@ -26,7 +26,7 @@ buildGoModule rec {
       --zsh <($out/bin/gmailctl completion zsh)
   '';
 
-  vendorSha256 = "sha256-Yv3OGHFOmenst/ujUgvCaSEjwwBf3W9n+55ztVhuWjo=";
+  vendorSha256 = "sha256-zEWEcv6G/9tmM6/+lhMFkyew3r/pvQRjvh74BENTYI4=";
 
   doCheck = false;
 

pkgs/applications/networking/instant-messengers/psi-plus/default.nix

@@ -42,13 +42,13 @@ assert enablePsiMedia -> enablePlugins;
 
 mkDerivation rec {
   pname = "psi-plus";
-  version = "1.5.1576";
+  version = "1.5.1582";
 
   src = fetchFromGitHub {
     owner = "psi-plus";
     repo = "psi-plus-snapshots";
     rev = version;
-    sha256 = "15iqa8hd4p968sp79zsi32g7bhamgg267pk2bxspl646viv91f6g";
+    sha256 = "sha256-ZMJxGxwDuY2fW+W68JiH0X+FpowdAPm70EQ9pHNnrG4=";
   };
 
   cmakeFlags = [

pkgs/applications/networking/mailreaders/evolution/evolution/default.nix

@@ -42,11 +42,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.42.1";
+  version = "3.42.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "RlMq46E6aIV3GtEiNLlBQRZ67HRyOn7tE9293a767kU=";
+    sha256 = "C+QT8W3WjsjUNCpPJpVlryp0oZpb+hxcv2Y1I6W1ujg=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/p2p/tixati/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tixati";
-  version = "2.85";
+  version = "2.86";
 
   src = fetchurl {
     url = "https://download2.tixati.com/download/tixati-${version}-1.x86_64.manualinstall.tar.gz";
-    sha256 = "sha256-grmJ52x2NcsgXw5BWrEGF9+7TYS/45HgHUXuZB+hVK4=";
+    sha256 = "sha256-E5jZnjIdYRzkZ9hN7gKzIIjC0k2nN47yDptsMYrsvIA=";
   };
 
   installPhase = ''

pkgs/applications/networking/protonmail-bridge/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "protonmail-bridge";
-  version = "1.8.7";
+  version = "1.8.10";
 
   src = fetchFromGitHub {
     owner = "ProtonMail";
     repo = "proton-bridge";
     rev = "br-${version}";
-    sha256 = "sha256-bynPuAdeX4WxYdbjMkR9ANuYWYOINB0OHnKTmIrCB6E=";
+    sha256 = "sha256-T6pFfGKG4VNcZ6EYEU5A5V91PlZZDylTNSNbah/pwS4=";
   };
 
-  vendorSha256 = "sha256-g2vl1Ctxr2U+D/k9u9oXuZ1OWaABIJs0gmfhWh13ZFM=";
+  vendorSha256 = "sha256-hRGedgdQlky9UBqsVTSbgAgii1skF/MA21ZQ0+goaM4=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/applications/science/misc/openmvg/default.nix

@@ -8,14 +8,14 @@
 , enableDocs ? false }:
 
 stdenv.mkDerivation rec {
-  version = "1.6";
+  version = "2.0";
   pname = "openmvg";
 
   src = fetchFromGitHub {
     owner = "openmvg";
     repo = "openmvg";
     rev = "v${version}";
-    sha256 = "0mrsi0dzgi7cjzn13r9xv7rnc8c9a4h8ip78xy88m9xsyr21wd1h";
+    sha256 = "sha256-6F/xUgZpqY+v6CpwTBhIXI4JdT8HVB0P5JzOL66AVd8=";
     fetchSubmodules = true;
   };
 

pkgs/applications/version-management/git-and-tools/delta/default.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "delta";
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "dandavison";
     repo = pname;
     rev = version;
-    sha256 = "sha256-coxETvB/uKTgg5VFlvcFmbNj95paDWkpq0zUIeR9//8=";
+    sha256 = "sha256-GboG7Ia27CTisY0YCFiAhzoCMxMAXlCeAPll19+JoxM=";
   };
 
-  cargoSha256 = "sha256-V6px+OGe9vHg/OgiEbT+TG1PmUIgWPVuv+AD176W0Bo=";
+  cargoSha256 = "sha256-JEIMZFDEWaKXfe4OzaAxMop0XYQAcz8L7hcTBD8DJio=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/version-management/git-and-tools/subgit/default.nix

@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "subgit";
-  version = "3.3.11";
+  version = "3.3.12";
 
   meta = {
     description = "A tool for a smooth, stress-free SVN to Git migration";
@@ -22,6 +22,6 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://subgit.com/download/subgit-${version}.zip";
-    sha256 = "sha256-ltTpmXPCIGTmVDxKc6oelMEzQWXRbIf0NESzRugaXo0=";
+    sha256 = "sha256-Mdjm7rkF/iw3HBftCgXrbFCG00g/RowFcF/oeKLyzL0=";
   };
 }

pkgs/applications/version-management/git-repo/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "git-repo";
-  version = "2.18";
+  version = "2.19";
 
   src = fetchFromGitHub {
     owner = "android";
     repo = "tools_repo";
     rev = "v${version}";
-    sha256 = "sha256-eW+FjTsTWzHxyNlsP5dvV3TFtEz4cLWwyF4bmqsDW2k=";
+    sha256 = "sha256-aJnerKeZobgw3e4s7D7de7/nP6vwymLpeKnrLmPzDow=";
   };
 
   # Fix 'NameError: name 'ssl' is not defined'

pkgs/applications/virtualization/podman/default.nix

@@ -17,13 +17,13 @@
 
 buildGoModule rec {
   pname = "podman";
-  version = "3.4.2";
+  version = "3.4.3";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    sha256 = "sha256-VkKFlOm5r+a9+4em1oisjXNwK9mCCCPViql6g0O7PWw=";
+    sha256 = "sha256-SZHonZdUTJisFMjvUBst1HErvKWEcYZYhK++G+S4sEg=";
   };
 
   vendorSha256 = null;

pkgs/applications/window-managers/i3/status-rust.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "i3status-rust";
-  version = "0.20.6";
+  version = "0.20.7";
 
   src = fetchFromGitHub {
     owner = "greshake";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-FLMfXloAAIz/9KAtKFfB8uokQz/J8R+WsGarq/5cblo=";
+    sha256 = "sha256-7RfDNjTUQtVZUeRGBnd2ygSkFJOoPrNF/Bwy8GWo7To=";
   };
 
-  cargoSha256 = "sha256-UVAF2rz0y6h3/rcTJ+31mMyJDLG7q40n6vBK8Wxultg=";
+  cargoSha256 = "sha256-alZJm2/hhloKQn7QeUA2IMgGl86Lz8xNpZkoMHCcjVI=";
 
   nativeBuildInputs = [ pkg-config makeWrapper ];
 

pkgs/data/icons/bibata-cursors/default.nix

@@ -1,51 +1,54 @@
-{ lib, stdenvNoCC, fetchFromGitHub, gnome-themes-extra, inkscape, xcursorgen, python3 }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchurl
+, clickgen
+, unzip
+}:
 
-let
+stdenv.mkDerivation rec {
-  py = python3.withPackages(ps: [ ps.pillow ]);
-in stdenvNoCC.mkDerivation rec {
   pname = "bibata-cursors";
-  version = "0.4.2";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
-    owner = "KaizIqbal";
+    owner = "ful1e5";
     repo = "Bibata_Cursor";
     rev = "v${version}";
-    sha256 = "1f7i5jkl21fvrr45zpcj40avkc7camjb1ddrrdlaabbplgz5mcgn";
+    sha256 = "1q2wdbrmdnr9mwiilm5cc9im3zwbl7yaj1zpy5wwn44ypq3hcngy";
   };
 
-  postPatch = ''
+  bitmaps = fetchurl {
-    patchShebangs .
+    url = "https://github.com/ful1e5/Bibata_Cursor/releases/download/v${version}/bitmaps.zip";
-    substituteInPlace build.sh --replace "sudo" ""
+    sha256 = "1pcn6par0f0syyhzpzmqr3c6b9ri4lprkdd2ncwzdas01p2d9v1i";
+  };
 
-    # Don't generate windows cursors,
+  nativeBuildInputs = [ unzip ];
-    # they aren't used and aren't installed
-    # by the project's install script anyway.
-    echo "exit 0" > w32-make.sh
-  '';
 
-  nativeBuildInputs  = [
+  buildInputs = [ clickgen ];
-    gnome-themes-extra
-    inkscape
-    xcursorgen
-    py
-  ];
 
   buildPhase = ''
-    HOME="$NIX_BUILD_ROOT" ./build.sh
+    mkdir bitmaps
+    unzip $bitmaps -d bitmaps
+    rm -rf themes
+    cd builder && make build_unix
   '';
 
   installPhase = ''
     install -dm 0755 $out/share/icons
-    for x in Bibata_*; do
+    cd ../
-      cp -pr $x/out/X11/$x $out/share/icons/
+    cp -rf themes/* $out/share/icons/
-    done
+  '';
+
+  postPatch = ''
+    substituteInPlace "builder/Makefile" \
+      --replace "/bin/bash" "bash"
   '';
 
   meta = with lib; {
-    description = "Material Based Cursor";
+    description = "Material Based Cursor Theme";
-    homepage = "https://github.com/KaizIqbal/Bibata_Cursor";
+    homepage = "https://github.com/ful1e5/Bibata_Cursor";
     license = licenses.gpl3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ rawkode ];
+    maintainers = with maintainers; [ rawkode AdsonCicilioti ];
   };
 }

pkgs/data/icons/bibata-cursors/extra.nix

@@ -1,51 +1,54 @@
-{ lib, stdenvNoCC, fetchFromGitHub, gnome-themes-extra, inkscape, xcursorgen, python3 }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, fetchurl
+, clickgen
+, unzip
+}:
 
-let
+stdenv.mkDerivation rec {
-  py = python3.withPackages(ps: [ ps.pillow ]);
-in stdenvNoCC.mkDerivation rec {
   pname = "bibata-extra-cursors";
-  version = "0.3";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
-    owner = "KaizIqbal";
+    owner = "ful1e5";
     repo = "Bibata_Extra_Cursor";
     rev = "v${version}";
-    sha256 = "1bh945hvakbh985jkr6g6x0myw3k49pvn24m1clvqdv35v65nfxk";
+    sha256 = "0wndl4c547k99y0gq922hn7z1mwdgxvvyjfm6757g6shfbcmkz7m";
   };
 
-  postPatch = ''
+  bitmaps = fetchurl {
-    patchShebangs .
+    url = "https://github.com/ful1e5/Bibata_Extra_Cursor/releases/download/v${version}/bitmaps.zip";
-    substituteInPlace build.sh --replace "sudo" ""
+    sha256 = "0vf14ln53wigaq3dkqdk5avarqplsq751nlv72da04ms6gqjfhdl";
+  };
 
-    # Don't generate windows cursors,
+  nativeBuildInputs = [ unzip ];
-    # they aren't used and aren't installed
-    # by the project's install script anyway.
-    echo "exit 0" > w32-make.sh
-  '';
 
-  nativeBuildInputs  = [
+  buildInputs = [ clickgen ];
-    gnome-themes-extra
-    inkscape
-    xcursorgen
-    py
-  ];
 
   buildPhase = ''
-    HOME="$NIX_BUILD_ROOT" ./build.sh
+    mkdir bitmaps
+    unzip $bitmaps -d bitmaps
+    rm -rf themes
+    cd builder && make build_unix
   '';
 
   installPhase = ''
     install -dm 0755 $out/share/icons
-    for x in Bibata_*; do
+    cd ../
-      cp -pr $x/out/X11/$x $out/share/icons/
+    cp -rf themes/* $out/share/icons/
-    done
+  '';
+
+  postPatch = ''
+    substituteInPlace "builder/Makefile" \
+      --replace "/bin/bash" "bash"
   '';
 
   meta = with lib; {
-    description = "Cursors Based on Bibata";
+    description = "Material Based Cursor Theme";
-    homepage = "https://github.com/KaizIqbal/Bibata_Extra_Cursor";
+    homepage = "https://github.com/ful1e5/Bibata_Extra_Cursor";
     license = licenses.gpl3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ dtzWill ];
+    maintainers = with maintainers; [ dtzWill AdsonCicilioti ];
   };
 }

pkgs/data/icons/bibata-cursors/translucent.nix

@@ -1,31 +1,16 @@
-{ lib, stdenvNoCC, fetchFromGitHub, gnome-themes-extra, inkscape, xcursorgen }:
+{ lib, stdenv, fetchFromGitHub }:
 
-stdenvNoCC.mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "bibata-cursors-translucent";
-  version = "unstable-2019-09-13";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "Silicasandwhich";
     repo = "Bibata_Cursor_Translucent";
-    rev = "2eed979d817148817ea6bca15c594809aa9c2cb9";
+    rev = "v${version}";
-    sha256 = "1s688v40xx9jbvfncb4kgfnnxkmknji7igqx7c4q1ly9s7imbd1f";
+    sha256 = "1ddnwqkxricnd731blckcxvksbgql8k4pfiz65591p81n5095k8y";
   };
 
-  postPatch = ''
-    patchShebangs .
-    substituteInPlace build.sh --replace "gksu " ""
-  '';
-
-  nativeBuildInputs  = [
-    gnome-themes-extra
-    inkscape
-    xcursorgen
-  ];
-
-  buildPhase = ''
-    HOME="$NIX_BUILD_ROOT" ./build.sh
-  '';
-
   installPhase = ''
     install -dm 0755 $out/share/icons
     cp -pr Bibata_* $out/share/icons/
@@ -36,6 +21,6 @@ stdenvNoCC.mkDerivation rec {
     homepage = "https://github.com/Silicasandwhich/Bibata_Cursor_Translucent";
     license = licenses.gpl3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ dtzWill ];
+    maintainers = with maintainers; [ dtzWill AdsonCicilioti ];
   };
 }

pkgs/data/icons/papirus-icon-theme/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "papirus-icon-theme";
-  version = "20211001";
+  version = "20211201";
 
   src = fetchFromGitHub {
     owner = "PapirusDevelopmentTeam";
     repo = pname;
     rev = version;
-    sha256 = "sha256-OVG/bKWOdSxOXVvtMOITnCDoGNSc+zPNZ/XOablfSEE=";
+    sha256 = "sha256-lcwQALFQ4zkgDLCX1uthAP3QZwP7UcWcPSOU+UTDykE=";
   };
 
   nativeBuildInputs = [ gtk3 ];

pkgs/data/misc/scowl/default.nix

@@ -4,13 +4,13 @@
 
 stdenv.mkDerivation rec {
   pname = "scowl";
-  version = "2019.10.06";
+  version = "2020.12.07";
 
   src = fetchFromGitHub {
     owner = "en-wl";
     repo = "wordlist";
     rev = "rel-${version}";
-    sha256 = "1daag7h63gdijp1lv3v93bx5kmcb5zsyydsd57kv0a6kk3vs819x";
+    sha256 = "sha256-J61jhpnZcXMnoGlSuSCrKDZnnyp3Snjr+fUpTVKX64g=";
   };
 
   postPatch = ''

pkgs/desktops/gnome/core/gnome-calculator/default.nix

@@ -26,11 +26,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-calculator";
-  version = "41.0";
+  version = "41.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-calculator/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "pm3AS9hYfnbWc3Wmrvp5VTtWnJvfeOvcKBfxwK3j3Jk=";
+    sha256 = "AmdhSv2yXTi3hBG0Lrq3vFDBtjQMxJu2jA5DLX3fijQ=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/gnome/core/gnome-terminal/default.nix

@@ -27,11 +27,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-terminal";
-  version = "3.42.1";
+  version = "3.42.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-terminal/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "wxmxQFUBuMdpPmFvSOztQWldLnhhSMpfnie8fZj0rrE=";
+    sha256 = "ipyOXvejpzskapR+EZC7COyYk1r4YM8LOqL79GBoF6A=";
   };
 
   nativeBuildInputs = [

pkgs/development/beam-modules/elixir-ls/default.nix

@@ -2,23 +2,25 @@
 # Based on the work of Hauleth
 # None of this would have happened without him
 
-mixRelease rec {
+let
   pname = "elixir-ls";
-  version = "0.8.1";
+  pinData = lib.importJSON ./pin.json;
-  inherit elixir;
+  version = pinData.version;
-
   src = fetchFromGitHub {
     owner = "elixir-lsp";
     repo = "elixir-ls";
     rev = "v${version}";
-    sha256 = "sha256-KlZq12RCor9GrwA8QMP3R+jUQ/xFHRjkLwwkvthiMU0=";
+    sha256 = pinData.sha256;
     fetchSubmodules = true;
   };
+in
+mixRelease  {
+  inherit pname version src elixir;
 
   mixFodDeps = fetchMixDeps {
     pname = "mix-deps-${pname}";
     inherit src version elixir;
-    sha256 = "sha256-OzjToAg+q/ybCyqzNFk28OBsItjFTbdPi416EPh2qX0=";
+    sha256 = pinData.depsSha256;
   };
 
   # elixir_ls is an umbrella app

pkgs/development/beam-modules/elixir-ls/pin.json

@@ -0,0 +1,5 @@
+{
+  "version": "0.9.0",
+  "sha256": "sha256-dHHmA9TAM5YEfbUoujgy1XLzdh7zGWhR9SsFoTnKX48=",
+  "depsSha256": "sha256-YkZ/tp537ULKfXka4IdD+RgLlXuv6ayxdYn9KFyXrr4="
+}

pkgs/development/beam-modules/elixir-ls/update.sh

@@ -2,31 +2,30 @@
 #! nix-shell -i oil -p jq sd nix-prefetch-github ripgrep
 
 # TODO set to `verbose` or `extdebug` once implemented in oil
-shopt --set xtrace
+set -x
 
-var directory = $(dirname $0 | xargs realpath)
+const directory = $(dirname $0 | xargs realpath)
-var owner = "elixir-lsp"
+const owner = "elixir-lsp"
-var repo = "elixir-ls"
+const repo = "elixir-ls"
-var latest_rev = $(curl -q https://api.github.com/repos/${owner}/${repo}/releases/latest | \
+const latest_rev = $(curl -q https://api.github.com/repos/${owner}/${repo}/releases/latest | \
   jq -r '.tag_name')
-var latest_version = $(echo $latest_rev | sd 'v' '')
+const latest_version = $(echo $latest_rev | sd 'v' '')
-var current_version = $(nix-instantiate -A elixir_ls.version --eval --json | jq -r)
+const current_version = $(jq -r '.version' $directory/pin.json)
-if ("$latest_version" == "$current_version") {
+if ("$latest_version" === "$current_version") {
   echo "elixir-ls is already up-to-date"
   return 0
 } else {
-  var tarball_meta = $(nix-prefetch-github $owner $repo --rev "$latest_rev")
+  const tarball_meta = $(nix-prefetch-github $owner $repo --rev "$latest_rev")
-  var tarball_hash = "sha256-$(echo $tarball_meta | jq -r '.sha256')"
+  const tarball_hash = "sha256-$(echo $tarball_meta | jq -r '.sha256')"
-  var sha256s = $(rg '"sha256-.+"' $directory/default.nix | sd '.+"(.+)";' '$1' )
+  const sha256s = $(rg '"sha256-.+"' $directory/default.nix | sd '.+"(.+)";' '$1' )
-  echo $sha256s | read --line :github_sha256
-  echo $sha256s | tail -n 1 | read --line :old_mix_sha256
-  sd 'version = ".+"' "version = \"$latest_version\"" "$directory/default.nix"
-  sd "sha256 = \"$github_sha256\"" "sha256 = \"$tarball_hash\"" "$directory/default.nix"
-  sd "sha256 = \"$old_mix_sha256\"" "sha256 = \"\"" "$directory/default.nix"
 
-  var new_mix_hash = $(nix-build -A elixir_ls.mixFodDeps 2>&1 | \
+  jq ".version = \"$latest_version\" | \
+      .\"sha256\" = \"$tarball_hash\" | \
+      .\"depsSha256\" = \"\"" $directory/pin.json | sponge $directory/pin.json
+
+  const new_mix_hash = $(nix-build -A elixir_ls.mixFodDeps 2>&1 | \
     tail -n 1 | \
     sd '\s+got:\s+' '')
 
-  sd "sha256 = \"\"" "sha256 = \"$new_mix_hash\"" "$directory/default.nix"
+  jq ".depsSha256 = \"$new_mix_hash\"" $directory/pin.json | sponge $directory/pin.json
 }

pkgs/development/compilers/elm/default.nix

@@ -2,7 +2,7 @@
 , haskell, haskellPackages, nodejs
 , fetchurl, fetchpatch, makeWrapper, writeScriptBin
   # Rust dependecies
-, curl, rustPlatform, openssl, pkg-config, Security
+, curl, rustPlatform, openssl, pkg-config, Security, darwin
 }:
 let
   fetchElmDeps = import ./fetchElmDeps.nix { inherit stdenv lib fetchurl; };
@@ -111,6 +111,17 @@ let
         maintainers = [ maintainers.turbomack ];
       };
     };
+
+    elm-test-rs = import ./packages/elm-test-rs.nix {
+      inherit lib rustPlatform fetchurl openssl stdenv Security darwin;
+    } // {
+      meta = with lib; {
+        description = "Fast and portable executable to run your Elm tests";
+        homepage = "https://github.com/mpizenberg/elm-test-rs";
+        license = licenses.bsd3;
+        maintainers = [ maintainers.jpagex ];
+      };
+    };
   };
 
   elmNodePackages = with elmLib;

pkgs/development/compilers/elm/packages/elm-test-rs.nix

@@ -0,0 +1,18 @@
+{ lib, rustPlatform, fetchurl, openssl, stdenv, Security, darwin }:
+rustPlatform.buildRustPackage rec {
+  pname = "elm-test-rs";
+  version = "2.0";
+
+  src = fetchurl {
+    url = "https://github.com/mpizenberg/elm-test-rs/archive/v${version}.tar.gz";
+    sha256 = "sha256:1manr42w613r9vyji7pxx5gb08jcgkdxv29qqylrqlwxa8d5dcid";
+  };
+
+  buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security darwin.apple_sdk.frameworks.CoreServices ];
+
+  cargoSha256 = "sha256:1dpdlzv96kpc25yf5jgsz9qldghyw35x382qpxhkadkn5dryzjvd";
+  verifyCargoDeps = true;
+
+  # Tests perform networking and therefore can't work in sandbox
+  doCheck = false;
+}

pkgs/development/compilers/polyml/default.nix

@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "polyml";
-  version = "5.8.2";
+  version = "5.9";
 
   prePatch = lib.optionalString stdenv.isDarwin ''
     substituteInPlace configure.ac --replace stdc++ c++
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
     owner = "polyml";
     repo = "polyml";
     rev = "v${version}";
-    sha256 = "0vvla816g9rk9aa75gq63rb7bf6yla27p8wh1s1ycgq2in2zk0py";
+    sha256 = "sha256-4oo4AB54CivhS99RuZVTP9+Ic0CDpsBb+OiHvOhmZnM=";
   };
 
   meta = with lib; {

pkgs/development/compilers/qbe/default.nix

@@ -6,12 +6,12 @@
 
 stdenv.mkDerivation rec {
   pname = "qbe";
-  version = "unstable-2021-11-10";
+  version = "unstable-2021-11-22";
 
   src = fetchgit {
     url = "git://c9x.me/qbe.git";
-    rev = "b0f16dad64d14f36ffe235b2e9cca96aa3ce35ba";
+    rev = "bf153b359e9ce3ebef9bca899eb7ed5bd9045c11";
-    sha256 = "sha256-oPgr8PDxGNqIWxWsvVr9B8oN0Io/pUuzgIkZfY/qD+o=";
+    sha256 = "sha256-13Mvq4VWZxlye/kncJibCnfSECx4PeHMYLuX0xMkN3A=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];

pkgs/development/coq-modules/mathcomp-bigenough/default.nix

@@ -6,9 +6,15 @@ with lib; mkCoqDerivation {
   pname = "bigenough";
   owner = "math-comp";
 
-  release = { "1.0.0".sha256 = "10g0gp3hk7wri7lijkrqna263346wwf6a3hbd4qr9gn8hmsx70wg"; };
+  release = {
+    "1.0.0".sha256 = "10g0gp3hk7wri7lijkrqna263346wwf6a3hbd4qr9gn8hmsx70wg";
+    "1.0.1".sha256 = "sha256:02f4dv4rz72liciwxb2k7acwx6lgqz4381mqyq5854p3nbyn06aw";
+  };
   inherit version;
-  defaultVersion = "1.0.0";
+  defaultVersion = with versions; switch coq.version [
+    { case = range "8.10" "8.15"; out = "1.0.1"; }
+    { case = range "8.5"  "8.14"; out = "1.0.0"; }
+  ] null;
 
   propagatedBuildInputs = [ mathcomp.ssreflect ];
 

pkgs/development/interpreters/bqn/dzaima-bqn/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dbqn" + lib.optionalString buildNativeImage "-native";
-  version = "0.pre+date=2021-10-08";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "dzaima";
     repo = "BQN";
-    rev = "0001109a1c5a420421b368c79d34b1e93bfe606e";
+    rev = "v${version}";
-    hash = "sha256-riHHclTLkrVbtzmcz9ungAIc7kaoFHS77+SNatsfNhc=";
+    sha256 = "1kxzxz2hrd1871281s4rsi569qk314aqfmng9pkqn8gv9nqhmph0";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/agg/default.nix

@@ -32,10 +32,12 @@ stdenv.mkDerivation rec {
     sh autogen.sh
   '';
 
-  configureFlags = lib.optionals stdenv.isLinux [
+  configureFlags = [
+    (lib.strings.enableFeature stdenv.isLinux "platform")
+    "--enable-examples=no"
+  ] ++ lib.optionals stdenv.isLinux [
     "--x-includes=${lib.getDev libX11}/include"
     "--x-libraries=${lib.getLib libX11}/lib"
-    "--enable-examples=no"
   ];
 
   # libtool --tag=CXX --mode=link g++ -g -O2 libexamples.la ../src/platform/X11/libaggplatformX11.la ../src/libagg.la -o alpha_mask2 alpha_mask2.o

pkgs/development/libraries/cpp-utilities/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cpp-utilities";
-  version = "5.11.2";
+  version = "5.11.3";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-my4799a9XFXWl9Xyq6gRfw4YTOCEWJgTvRKz0mVqrkQ=";
+    sha256 = "sha256-a/fuzZ8crmyO87QzIKuYPk0LC3EvvHZrWO17LtWu77I=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/ethash/default.nix

@@ -2,14 +2,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ethash";
-  version = "0.7.1";
+  version = "0.8.0";
 
   src =
     fetchFromGitHub {
       owner = "chfast";
       repo = "ethash";
       rev = "v${version}";
-      sha256 = "sha256-ba8SBtJd0ERunO9KpJZkutkO6ZnZOEGzWn2IjO1Uu28=";
+      sha256 = "sha256-4SJk4niSpLPjymwTCD0kHOrqpMf+vE3J/O7DiffUSJ4=";
     };
 
   nativeBuildInputs = [

pkgs/development/libraries/ip2location-c/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ip2location-c";
-  version = "8.4.0";
+  version = "8.4.1";
 
   src = fetchFromGitHub {
     owner = "chrislim2888";
     repo = "IP2Location-C-Library";
     rev = version;
-    sha256 = "0rqjgmv62s7abiiqi3ff3ff838qx4pzr509irmzvqlflnkxxi0q6";
+    sha256 = "sha256-a2ekDi8+08Mm/OsWZbahcpFMPNqmv+cECAONQLynhSY=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/libime/default.nix

@@ -18,21 +18,21 @@ let
     url = "https://download.fcitx-im.org/data/lm_sc.3gm.arpa-${arpaVer}.tar.bz2";
     sha256 = "0bqy3l7mif0yygjrcm65qallszgn17mvgyxhvz7a54zaamyan6vm";
   };
-  dictVer = "20210402";
+  dictVer = "20211021";
   dict = fetchurl {
     url = "https://download.fcitx-im.org/data/dict.utf8-${dictVer}.tar.xz";
-    sha256 = "sha256-gYz7tama5bQMJwe2FYc09KEBlkRIU0AMvWsUUFWS2A0=";
+    sha256 = "sha256-MAWX5vf3n3iEgP1mXeige/6QInBItafjn0D0OmKpgd8=";
   };
 in
 stdenv.mkDerivation rec {
   pname = "libime";
-  version = "1.0.7";
+  version = "1.0.10";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = "libime";
     rev = version;
-    sha256 = "sha256-q/SXS6pT4vBkCkCTarPVHrZPXijYnc2t51YGRvzQ0FY=";
+    sha256 = "sha256-dHlya2vC3ugslP0K2oIHadcZQTmzt+tzNMkLy8V5M1Q=";
     fetchSubmodules = true;
   };
 

pkgs/development/libraries/libplctag/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libplctag";
-  version = "2.4.2";
+  version = "2.4.6";
 
   src = fetchFromGitHub {
     owner = "libplctag";
     repo = "libplctag";
     rev = "v${version}";
-    sha256 = "sha256-LyFCKWOjqSHWGBm2p52R/eYuPjtf5IfqqMtrLCNWIV8=";
+    sha256 = "sha256-e7WDXaFu4ujrxqSvAq2Y2MbUR1ItlKOYm9dNSPbdaMo=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/libsidplayfp/default.nix

@@ -16,14 +16,14 @@
 
 stdenv.mkDerivation rec {
   pname = "libsidplayfp";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "libsidplayfp";
     repo = "libsidplayfp";
     rev = "v${version}";
     fetchSubmodules = true;
-    sha256 = "sha256-NtT6NaNs43gp8sgPNkRj85PBbpaG7hdUctDF564nZIk=";
+    sha256 = "sha256-Cu5mZzsqAO4X4Y8QAn851zIFPVPwxj5pB+jvA62L108=";
   };
 
   postPatch = ''

pkgs/development/libraries/libspf2/default.nix

@@ -1,29 +1,18 @@
-{ lib, stdenv, fetchurl, autoreconfHook }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook }:
 
 with lib;
 
 stdenv.mkDerivation rec {
   pname = "libspf2";
-  version = "1.2.10";
+  version = "2.2.12";
 
-  src = fetchurl {
+  src = fetchFromGitHub {
-    url = "https://www.libspf2.org/spf/libspf2-${version}.tar.gz";
+    owner = "helsinki-systems";
-    sha256 = "1j91p0qiipzf89qxq4m1wqhdf01hpn1h5xj4djbs51z23bl3s7nr";
+    repo = "libspf2";
+    rev = "v${version}";
+    sha256 = "03iiaafdcwh220pqignk407h6klrakwz0zkb8iwk6nkwipkwvhsx";
   };
 
-  patches = [
-    (fetchurl {
-      name = "0001-gcc-variadic-macros.patch";
-      url = "https://github.com/shevek/libspf2/commit/5852828582f556e73751076ad092f72acf7fc8b6.patch";
-      sha256 = "1v6ashqzpr0xidxq0vpkjd8wd66cj8df01kyzj678ljzcrax35hk";
-    })
-    (fetchurl {
-      name = "0002-CVE-2021-20314.patch";
-      url = "https://github.com/shevek/libspf2/commit/c37b7c13c30e225183899364b9f2efdfa85552ef.patch";
-      sha256 = "190nnh7mlz6328829ba6jajad16s3md8kraspn81qnvhwh0nkiak";
-    })
-  ];
-
   postPatch = ''
     # disable static bins compilation
     sed -i \
@@ -42,7 +31,7 @@ stdenv.mkDerivation rec {
     description = "Implementation of the Sender Policy Framework for SMTP authorization";
     homepage = "https://www.libspf2.org";
     license = with licenses; [ lgpl21Plus bsd2 ];
-    maintainers = with maintainers; [ pacien ];
+    maintainers = with maintainers; [ pacien ajs124 das_j ];
     platforms = platforms.all;
   };
 }

pkgs/development/libraries/oatpp/default.nix

@@ -5,13 +5,13 @@
 
 stdenv.mkDerivation rec {
   pname = "oatpp";
-  version = "1.2.5";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "oatpp";
     repo = "oatpp";
     rev = version;
-    sha256 = "sha256-Vtdz03scx0hvY1yeM7yfSxCVKzi84OQ1Oh9b922movE=";
+    sha256 = "sha256-k6RPg53z9iTrrKZXOm5Ga9qxI32mHgB+4d6y+IUvJC0=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/libraries/odpic/default.nix

@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, fixDarwinDylibNames, oracle-instantclient, libaio }:
 
 let
-  version = "4.2.1";
+  version = "4.3.0";
   libPath = lib.makeLibraryPath [ oracle-instantclient.lib ];
 
 in stdenv.mkDerivation {
@@ -13,7 +13,7 @@ in stdenv.mkDerivation {
     owner = "oracle";
     repo = "odpi";
     rev = "v${version}";
-    sha256 = "sha256-jdDMG6+bvsKQkHSpUrwtwU/ngq1iINcUhWu2b9lJgPY=";
+    sha256 = "sha256-oL2yehjP8JJxU19VY4e/ueh2xjo1yp4X7FGslqCXO8A=";
   };
 
   nativeBuildInputs = lib.optional stdenv.isDarwin fixDarwinDylibNames;

pkgs/development/libraries/osip/default.nix

@@ -1,9 +1,9 @@
 {lib, stdenv, fetchurl}:
 stdenv.mkDerivation rec {
-  version = "5.2.0";
+  version = "5.3.0";
   src = fetchurl {
     url = "mirror://gnu/osip/libosip2-${version}.tar.gz";
-    sha256 = "0xdk3cszkzb8nb757gl47slrr13mf6xz43ab4k343fv8llp8pd2g";
+    sha256 = "sha256-9HJZFsIs9RSWnvsVw8IHIz1kc5OD99QpVgOLePbK6Mg=";
   };
   pname = "libosip2";
 

pkgs/development/libraries/qtutilities/default.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qtutilities";
-  version = "6.5.1";
+  version = "6.5.2";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-J5yPezXU+AIvmLTBs4lWU35DvfP+0EuuhOJpxAzwRtw=";
+    sha256 = "sha256-/2gw6k6RUYBRnKJ85C8sDBCCcBEfkRU+MCgWi5/Z2hc=";
   };
 
   buildInputs = [ qtbase cpp-utilities ];

pkgs/development/libraries/quazip/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "quazip";
-  version = "1.1";
+  version = "1.2";
 
   src = fetchFromGitHub {
     owner = "stachenov";
     repo = pname;
     rev = "v${version}";
-    sha256 = "06srglrj6jvy5ngmidlgx03i0d5w91yhi7sf846wql00v8rvhc5h";
+    sha256 = "sha256-fsEMmbatTB1s8JnUYE18/vj2FZ2b40zHoOlL2OVplLc=";
   };
 
   buildInputs = [ zlib qtbase ];

pkgs/development/libraries/rocksdb/default.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rocksdb";
-  version = "6.26.0";
+  version = "6.26.1";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = pname;
     rev = "v${version}";
-    sha256 = "1nd8ixj249qiw089piw28aly0zmlla2k62gd6axd0bs2wfc4zma8";
+    sha256 = "sha256-Tx809Q/Mn5C9LbtmTlJN9eDGWPDpJSRhnyNxA4Kq1Fc=";
   };
 
   nativeBuildInputs = [ cmake ninja ];