Merge master into haskell-updates

2022-02-27 00:12:12 +00:00 · 2022-02-27 00:12:12 +00:00 · a40653e007
commit a40653e007
parent 140c56e116 6f21ff94fc
151 changed files with 21977 additions and 562 deletions
--- a/doc/languages-frameworks/coq.section.md
+++ b/doc/languages-frameworks/coq.section.md
@ -29,7 +29,8 @@ The recommended way of defining a derivation for a Coq library, is to use the `c
 * `releaseRev` (optional, defaults to `(v: v)`), provides a default mapping from release names to revision hashes/branch names/tags,
 * `displayVersion` (optional), provides a way to alter the computation of `name` from `pname`, by explaining how to display version numbers,
 * `namePrefix` (optional, defaults to `[ "coq" ]`), provides a way to alter the computation of `name` from `pname`, by explaining which dependencies must occur in `name`,
-* `extraBuildInputs` (optional), by default `buildInputs` just contains `coq`, this allows to add more build inputs,
+* `extraNativeBuildInputs` (optional), by default `nativeBuildInputs` just contains `coq`, this allows to add more native build inputs, `nativeBuildInputs` are executables and `buildInputs` are libraries and dependencies,
+* `extraBuildInputs` (optional), this allows to add more build inputs,
 * `mlPlugin` (optional, defaults to `false`). Some extensions (plugins) might require OCaml and sometimes other OCaml packages. Standard dependencies can be added by setting the current option to `true`. For a finer grain control, the `coq.ocamlPackages` attribute can be used in `extraBuildInputs` to depend on the same package set Coq was built against.
 * `useDune2ifVersion` (optional, default to `(x: false)` uses Dune2 to build the package if the provided predicate evaluates to true on the version, e.g. `useDune2if = versions.isGe "1.1"`  will use dune if the version of the package is greater or equal to `"1.1"`,
 * `useDune2` (optional, defaults to `false`) uses Dune2 to build the package if set to true, the presence of this attribute overrides the behavior of the previous one.
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -122,6 +122,13 @@
          <link xlink:href="options.html#opt-services.powerdns-admin.enable">services.powerdns-admin</link>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://github.com/postgres/pgadmin4">pgadmin4</link>,
+          an admin interface for the PostgreSQL database. Available at
+          <link xlink:href="options.html#opt-services.pgadmin.enable">services.pgadmin</link>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <link xlink:href="https://github.com/sezanzeb/input-remapper">input-remapper</link>,
@ -623,6 +630,13 @@
          <literal>otelcorecol</literal> and enjoy a 7x smaller binary.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>pkgs.pgadmin</literal> now refers to
+          <literal>pkgs.pgadmin4</literal>. If you still need pgadmin3,
+          use <literal>pkgs.pgadmin3</literal>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <literal>pkgs.noto-fonts-cjk</literal> is now deprecated in
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -39,6 +39,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [PowerDNS-Admin](https://github.com/ngoduykhanh/PowerDNS-Admin), a web interface for the PowerDNS server. Available at [services.powerdns-admin](options.html#opt-services.powerdns-admin.enable).

+- [pgadmin4](https://github.com/postgres/pgadmin4), an admin interface for the PostgreSQL database. Available at [services.pgadmin](options.html#opt-services.pgadmin.enable).
+
 - [input-remapper](https://github.com/sezanzeb/input-remapper), an easy to use tool to change the mapping of your input device buttons. Available at [services.input-remapper](options.html#opt-services.input-remapper.enable).

 - [InvoicePlane](https://invoiceplane.com), web application for managing and creating invoices. Available at [services.invoiceplane](options.html#opt-services.invoiceplane.enable).
@ -198,6 +200,8 @@ In addition to numerous new and upgraded packages, this release has the followin
  you should change the package you refer to. If you don't need them update your
  commands from `otelcontribcol` to `otelcorecol` and enjoy a 7x smaller binary.

+- `pkgs.pgadmin` now refers to `pkgs.pgadmin4`.
+  If you still need pgadmin3, use `pkgs.pgadmin3`.

 - `pkgs.noto-fonts-cjk` is now deprecated in favor of `pkgs.noto-fonts-cjk-sans`
  and `pkgs.noto-fonts-cjk-serif` because they each have different release
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -254,6 +254,7 @@
  ./security/tpm2.nix
  ./services/admin/meshcentral.nix
  ./services/admin/oxidized.nix
+  ./services/admin/pgadmin.nix
  ./services/admin/salt/master.nix
  ./services/admin/salt/minion.nix
  ./services/amqp/activemq/default.nix
--- a/nixos/modules/services/admin/pgadmin.nix
+++ b/nixos/modules/services/admin/pgadmin.nix
@ -0,0 +1,127 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  pkg = pkgs.pgadmin4;
+  cfg = config.services.pgadmin;
+
+  _base = with types; [ int bool str ];
+  base = with types; oneOf ([ (listOf (oneOf _base)) (attrsOf (oneOf _base)) ] ++ _base);
+
+  formatAttrset = attr:
+    "{${concatStringsSep "\n" (mapAttrsToList (key: value: "${builtins.toJSON key}: ${formatPyValue value},") attr)}}";
+
+  formatPyValue = value:
+    if builtins.isString value then builtins.toJSON value
+    else if value ? _expr then value._expr
+    else if builtins.isInt value then toString value
+    else if builtins.isBool value then (if value then "True" else "False")
+    else if builtins.isAttrs value then (formatAttrset value)
+    else if builtins.isList value then "[${concatStringsSep "\n" (map (v: "${formatPyValue v},") value)}]"
+    else throw "Unrecognized type";
+
+  formatPy = attrs:
+    concatStringsSep "\n" (mapAttrsToList (key: value: "${key} = ${formatPyValue value}") attrs);
+
+  pyType = with types; attrsOf (oneOf [ (attrsOf base) (listOf base) base ]);
+in
+{
+  options.services.pgadmin = {
+    enable = mkEnableOption "PostgreSQL Admin 4";
+
+    port = mkOption {
+      description = "Port for pgadmin4 to run on";
+      type = types.port;
+      default = 5050;
+    };
+
+    initialEmail = mkOption {
+      description = "Initial email for the pgAdmin account.";
+      type = types.str;
+    };
+
+    initialPasswordFile = mkOption {
+      description = ''
+        Initial password file for the pgAdmin account.
+        NOTE: Should be string not a store path, to prevent the password from being world readable.
+      '';
+      type = types.path;
+    };
+
+    openFirewall = mkEnableOption "firewall passthrough for pgadmin4";
+
+    settings = mkOption {
+      description = ''
+        Settings for pgadmin4.
+        <link xlink:href="https://www.pgadmin.org/docs/pgadmin4/development/config_py.html">Documentation</link>.
+      '';
+      type = pyType;
+      default= {};
+    };
+  };
+
+  config = mkIf (cfg.enable) {
+    networking.firewall.allowedTCPPorts = mkIf (cfg.openFirewall) [ cfg.port ];
+
+    services.pgadmin.settings = {
+      DEFAULT_SERVER_PORT = cfg.port;
+      SERVER_MODE = true;
+    } // (optionalAttrs cfg.openFirewall {
+      DEFAULT_SERVER = mkDefault "::";
+    });
+
+    systemd.services.pgadmin = {
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+      requires = [ "network.target" ];
+      # we're adding this optionally so just in case there's any race it'll be caught
+      # in case postgres doesn't start, pgadmin will just start normally
+      wants = [ "postgresql.service" ];
+
+      path = [ config.services.postgresql.package pkgs.coreutils pkgs.bash ];
+
+      preStart = ''
+        # NOTE: this is idempotent (aka running it twice has no effect)
+        (
+          # Email address:
+          echo ${escapeShellArg cfg.initialEmail}
+
+          # file might not contain newline. echo hack fixes that.
+          PW=$(cat ${escapeShellArg cfg.initialPasswordFile})
+
+          # Password:
+          echo "$PW"
+          # Retype password:
+          echo "$PW"
+        ) | ${pkg}/bin/pgadmin4-setup
+      '';
+
+      restartTriggers = [
+        "/etc/pgadmin/config_system.py"
+      ];
+
+      serviceConfig = {
+        User = "pgadmin";
+        DynamicUser = true;
+        LogsDirectory = "pgadmin";
+        StateDirectory = "pgadmin";
+        ExecStart = "${pkg}/bin/pgadmin4";
+      };
+    };
+
+    users.users.pgadmin = {
+      isSystemUser = true;
+      group = "pgadmin";
+    };
+
+    users.groups.pgadmin = {};
+
+    environment.etc."pgadmin/config_system.py" = {
+      text = formatPy cfg.settings;
+      mode = "0600";
+      user = "pgadmin";
+      group = "pgadmin";
+    };
+  };
+}
--- a/nixos/modules/services/networking/murmur.nix
+++ b/nixos/modules/services/networking/murmur.nix
@ -306,7 +306,7 @@ in
        Type = if forking then "forking" else "simple";
        PIDFile = mkIf forking "/run/murmur/murmurd.pid";
        EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
-        ExecStart = "${cfg.package}/bin/murmurd -ini /run/murmur/murmurd.ini";
+        ExecStart = "${cfg.package}/bin/mumble-server -ini /run/murmur/murmurd.ini";
        Restart = "always";
        RuntimeDirectory = "murmur";
        RuntimeDirectoryMode = "0700";
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -393,6 +393,8 @@ in
  pdns-recursor = handleTest ./pdns-recursor.nix {};
  peerflix = handleTest ./peerflix.nix {};
  peertube = handleTestOn ["x86_64-linux"] ./web-apps/peertube.nix {};
+  pgadmin4 = handleTest ./pgadmin4.nix {};
+  pgadmin4-standalone = handleTest ./pgadmin4-standalone.nix {};
  pgjwt = handleTest ./pgjwt.nix {};
  pgmanage = handleTest ./pgmanage.nix {};
  php = handleTest ./php {};
--- a/nixos/tests/pgadmin4-standalone.nix
+++ b/nixos/tests/pgadmin4-standalone.nix
@ -0,0 +1,43 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+  # This is seperate from pgadmin4 since we don't want both running at once
+
+  {
+    name = "pgadmin4-standalone";
+    meta.maintainers = with lib.maintainers; [ mkg20001 ];
+
+    nodes.machine = { pkgs, ... }: {
+      environment.systemPackages = with pkgs; [
+        curl
+      ];
+
+      services.postgresql = {
+        enable = true;
+
+        authentication = ''
+          host    all             all             localhost               trust
+        '';
+
+        ensureUsers = [
+          {
+            name = "postgres";
+            ensurePermissions = {
+              "DATABASE \"postgres\"" = "ALL PRIVILEGES";
+            };
+          }
+        ];
+      };
+
+      services.pgadmin = {
+        enable = true;
+        initialEmail = "bruh@localhost.de";
+        initialPasswordFile = pkgs.writeText "pw" "bruh2012!";
+      };
+    };
+
+    testScript = ''
+      machine.wait_for_unit("postgresql")
+      machine.wait_for_unit("pgadmin")
+
+      machine.wait_until_succeeds("curl -s localhost:5050")
+    '';
+  })
--- a/nixos/tests/pgadmin4.nix
+++ b/nixos/tests/pgadmin4.nix
@ -0,0 +1,142 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+
+  let
+    pgadmin4SrcDir = "/pgadmin";
+    pgadmin4Dir = "/var/lib/pgadmin";
+    pgadmin4LogDir = "/var/log/pgadmin";
+
+    python-with-needed-packages = pkgs.python3.withPackages (ps: with ps; [
+      selenium
+      testtools
+      testscenarios
+      flask
+      flask-babelex
+      flask-babel
+      flask-gravatar
+      flask_login
+      flask_mail
+      flask_migrate
+      flask_sqlalchemy
+      flask_wtf
+      flask-compress
+      passlib
+      pytz
+      simplejson
+      six
+      sqlparse
+      wtforms
+      flask-paranoid
+      psutil
+      psycopg2
+      python-dateutil
+      sqlalchemy
+      itsdangerous
+      flask-security-too
+      bcrypt
+      cryptography
+      sshtunnel
+      ldap3
+      gssapi
+      flask-socketio
+      eventlet
+      httpagentparser
+      user-agents
+      wheel
+      authlib
+      qrcode
+      pillow
+      pyotp
+    ]);
+  in
+  {
+    name = "pgadmin4";
+    meta.maintainers = with lib.maintainers; [ gador ];
+
+    nodes.machine = { pkgs, ... }: {
+      imports = [ ./common/x11.nix ];
+      environment.systemPackages = with pkgs; [
+        pgadmin4
+        postgresql
+        python-with-needed-packages
+        chromedriver
+        chromium
+      ];
+      services.postgresql = {
+        enable = true;
+        authentication = ''
+          host    all             all             localhost               trust
+        '';
+        ensureUsers = [
+          {
+            name = "postgres";
+            ensurePermissions = {
+              "DATABASE \"postgres\"" = "ALL PRIVILEGES";
+            };
+          }
+        ];
+      };
+    };
+
+    testScript = ''
+      machine.wait_for_unit("postgresql")
+
+      # pgadmin4 needs its data and log directories
+      machine.succeed(
+          "mkdir -p ${pgadmin4Dir} \
+          && mkdir -p ${pgadmin4LogDir} \
+          && mkdir -p ${pgadmin4SrcDir}"
+      )
+
+      machine.succeed(
+           "tar xvzf ${pkgs.pgadmin4.src} -C ${pgadmin4SrcDir}"
+      )
+
+      machine.wait_for_file("${pgadmin4SrcDir}/pgadmin4-${pkgs.pgadmin4.version}/README.md")
+
+      # set paths and config for tests
+      machine.succeed(
+           "cd ${pgadmin4SrcDir}/pgadmin4-${pkgs.pgadmin4.version} \
+           && cp -v web/regression/test_config.json.in web/regression/test_config.json \
+           && sed -i 's|PostgreSQL 9.4|PostgreSQL|' web/regression/test_config.json \
+           && sed -i 's|/opt/PostgreSQL/9.4/bin/|${pkgs.postgresql}/bin|' web/regression/test_config.json \
+           && sed -i 's|\"headless_chrome\": false|\"headless_chrome\": true|' web/regression/test_config.json"
+      )
+
+      # adapt chrome config to run within a sandbox without GUI
+      # see https://stackoverflow.com/questions/50642308/webdriverexception-unknown-error-devtoolsactiveport-file-doesnt-exist-while-t#50642913
+      # add chrome binary path. use spaces to satisfy python indention (tabs throw an error)
+      # this works for selenium 3 (currently used), but will need to be updated
+      # to work with "from selenium.webdriver.chrome.service import Service" in selenium 4
+      machine.succeed(
+           "cd ${pgadmin4SrcDir}/pgadmin4-${pkgs.pgadmin4.version} \
+           && sed -i '\|options.add_argument(\"--disable-infobars\")|a \ \ \ \ \ \ \ \ options.binary_location = \"${pkgs.chromium}/bin/chromium\"' web/regression/runtests.py \
+           && sed -i '\|options.add_argument(\"--no-sandbox\")|a \ \ \ \ \ \ \ \ options.add_argument(\"--headless\")' web/regression/runtests.py \
+           && sed -i '\|options.add_argument(\"--disable-infobars\")|a \ \ \ \ \ \ \ \ options.add_argument(\"--disable-dev-shm-usage\")' web/regression/runtests.py \
+           && sed -i 's|(chrome_options=options)|(executable_path=\"${pkgs.chromedriver}/bin/chromedriver\", chrome_options=options)|' web/regression/runtests.py \
+           && sed -i 's|driver_local.maximize_window()||' web/regression/runtests.py"
+      )
+
+      # don't bother to test LDAP authentification
+      with subtest("run browser test"):
+          machine.succeed(
+               'cd ${pgadmin4SrcDir}/pgadmin4-${pkgs.pgadmin4.version}/web \
+               && ${python-with-needed-packages.interpreter} regression/runtests.py --pkg browser --exclude \
+               browser.tests.test_ldap_login.LDAPLoginTestCase,browser.tests.test_ldap_login'
+          )
+
+      # fontconfig is necessary for chromium to run
+      # https://github.com/NixOS/nixpkgs/issues/136207
+      with subtest("run feature test"):
+          machine.succeed(
+              'cd ${pgadmin4SrcDir}/pgadmin4-${pkgs.pgadmin4.version}/web \
+               && export FONTCONFIG_FILE=${pkgs.makeFontsConf { fontDirectories = [];}} \
+               && ${python-with-needed-packages.interpreter} regression/runtests.py --pkg feature_tests'
+          )
+
+      with subtest("run resql test"):
+          machine.succeed(
+               'cd ${pgadmin4SrcDir}/pgadmin4-${pkgs.pgadmin4.version}/web \
+               && ${python-with-needed-packages.interpreter} regression/runtests.py --pkg resql'
+          )
+    '';
+  })
--- a/pkgs/applications/audio/carla/default.nix
+++ b/pkgs/applications/audio/carla/default.nix
@ -15,13 +15,13 @@ assert withGtk3 -> gtk3 != null;

 stdenv.mkDerivation rec {
  pname = "carla";
-  version = "2.4.1";
+  version = "2.4.2";

  src = fetchFromGitHub {
    owner = "falkTX";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-faVLPHPQ4voR/RHiPpUwnZK+5Jx0u4rJWuH5zlydzwY=";
+    sha256 = "sha256-A0QmyphjsNU06kh2f9rXrR+GkDEI5HqXRA9J82E6qJU=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/jamulus/default.nix
+++ b/pkgs/applications/audio/jamulus/default.nix
@ -3,12 +3,12 @@

 mkDerivation rec {
  pname = "jamulus";
-  version = "3.8.1";
+  version = "3.8.2";
  src = fetchFromGitHub {
    owner = "jamulussoftware";
    repo = "jamulus";
    rev = "r${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-QtlvcKVqKgRAO/leHy4CgvjNW49HAyZLI2JtKERP7HQ=";
+    sha256 = "sha256-K2HznkntDhp+I8DHJk5Cuh5cR8yjwfzX+pGGzS8yVLQ=";
  };

  nativeBuildInputs = [ pkg-config qmake ];
--- a/pkgs/applications/blockchains/erigon.nix
+++ b/pkgs/applications/blockchains/erigon.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "erigon";
-  version = "2022.02.02";
+  version = "2022.02.03";

  src = fetchFromGitHub {
    owner = "ledgerwatch";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-hFoIPlmNzG2oQON86OUY9Y8oRbqexPVo4e7+pTbh1Kk=";
+    sha256 = "sha256-M8rCLkKoCx+5Eg53HfK6Ui4UrYsujGd7G8ckONclhTM=";
  };

-  vendorSha256 = "sha256-vXIuXT7BIs7xjGq1DBk0/dGQ0ccxfrFGLn6E03MUvY4=";
+  vendorSha256 = "sha256-loYo1nAR1lARsfoY5Q+k/tgVBxNxcr++zwUjLN3TRLA=";
  proxyVendor = true;

  # Build errors in mdbx when format hardening is enabled:
--- a/pkgs/applications/blockchains/oxen/default.nix
+++ b/pkgs/applications/blockchains/oxen/default.nix
@ -59,9 +59,10 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Private cryptocurrency based on Monero";
-    homepage    = "https://oxen.io/";
-    license     = licenses.bsd3;
-    platforms   = platforms.all;
+    homepage = "https://oxen.io/";
+    license = licenses.bsd3;
+    platforms = platforms.all;
    maintainers = [ maintainers.viric ];
+    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/oxen.x86_64-darwin
  };
 }
--- a/pkgs/applications/editors/android-studio/common.nix
+++ b/pkgs/applications/editors/android-studio/common.nix
@ -159,9 +159,9 @@ let
  };

  desktopItem = makeDesktopItem {
-    name = drvName;
+    name = pname;
    exec = pname;
-    icon = drvName;
+    icon = pname;
    desktopName = "Android Studio (${channel} channel)";
    comment = "The official Android IDE";
    categories = [ "Development" "IDE" ];
@ -229,6 +229,6 @@ in runCommand
    echo -n "$startScript" > $out/bin/${pname}
    chmod +x $out/bin/${pname}

-    ln -s ${androidStudio}/bin/studio.png $out/share/pixmaps/${drvName}.png
+    ln -s ${androidStudio}/bin/studio.png $out/share/pixmaps/${pname}.png
    ln -s ${desktopItem}/share/applications $out/share/applications
  ''
--- a/pkgs/applications/graphics/ImageMagick/7.0.nix
+++ b/pkgs/applications/graphics/ImageMagick/7.0.nix
@ -1,9 +1,36 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, libtool
-, bzip2, zlib, libX11, libXext, libXt, fontconfig, freetype, ghostscript, libjpeg, djvulibre
-, lcms2, openexr, libjxl, libpng, liblqr1, libraw, librsvg, libtiff, libxml2, openjpeg, libwebp, libheif
-, potrace, ApplicationServices
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, libtool
+, bzip2
+, zlib
+, libX11
+, libXext
+, libXt
+, fontconfig
+, freetype
+, ghostscript
+, libjpeg
+, djvulibre
+, lcms2
+, openexr
+, libjxl
+, libpng
+, liblqr1
+, libraw
+, librsvg
+, libtiff
+, libxml2
+, openjpeg
+, libwebp
+, libheif
+, potrace
+, curl
+, ApplicationServices
 , Foundation
-, testVersion, imagemagick
+, testVersion
+, imagemagick
 }:

 let
@ -11,7 +38,7 @@ let
    if stdenv.hostPlatform.system == "i686-linux" then "i686"
    else if stdenv.hostPlatform.system == "x86_64-linux" || stdenv.hostPlatform.system == "x86_64-darwin" then "x86-64"
    else if stdenv.hostPlatform.system == "armv7l-linux" then "armv7l"
-    else if stdenv.hostPlatform.system == "aarch64-linux"  || stdenv.hostPlatform.system == "aarch64-darwin" then "aarch64"
+    else if stdenv.hostPlatform.system == "aarch64-linux" || stdenv.hostPlatform.system == "aarch64-darwin" then "aarch64"
    else if stdenv.hostPlatform.system == "powerpc64le-linux" then "ppc64le"
    else null;
 in
@ -41,18 +68,30 @@ stdenv.mkDerivation rec {
    # let's disable it for now to unbreak the imagemagick build.
    ++ lib.optional (libjxl != null && !stdenv.isAarch64) "--with-jxl"
    ++ lib.optionals (ghostscript != null)
-      [ "--with-gs-font-dir=${ghostscript}/share/ghostscript/fonts"
+      [
+        "--with-gs-font-dir=${ghostscript}/share/ghostscript/fonts"
        "--with-gslib"
      ]
    ++ lib.optionals stdenv.hostPlatform.isMinGW
      [ "--enable-static" "--disable-shared" ] # due to libxml2 being without DLLs ATM
-    ;
+  ;

  nativeBuildInputs = [ pkg-config libtool ];

  buildInputs =
-    [ zlib fontconfig freetype ghostscript potrace
-      liblqr1 libpng libraw libtiff libxml2 libheif djvulibre
+    [
+      zlib
+      fontconfig
+      freetype
+      ghostscript
+      potrace
+      liblqr1
+      libpng
+      libraw
+      libtiff
+      libxml2
+      libheif
+      djvulibre
    ]
    # libjxl is broken on aarch64 (see meta.broken in libjxl) for now,
    # let's disable it for now to unbreak the imagemagick build.
@ -66,10 +105,10 @@ stdenv.mkDerivation rec {
    ];

  propagatedBuildInputs =
-    [ bzip2 freetype libjpeg lcms2 ]
+    [ bzip2 freetype libjpeg lcms2 curl ]
    ++ lib.optionals (!stdenv.hostPlatform.isMinGW)
      [ libX11 libXext libXt libwebp ]
-    ;
+  ;

  postInstall = ''
    (cd "$dev/include" && ln -s ImageMagick* ImageMagick)
--- a/pkgs/applications/graphics/meshlab/default.nix
+++ b/pkgs/applications/graphics/meshlab/default.nix
@ -22,13 +22,13 @@

 mkDerivation rec {
  pname = "meshlab";
-  version = "2021.10";
+  version = "2022.02";

  src = fetchFromGitHub {
    owner = "cnr-isti-vclab";
    repo = "meshlab";
    rev = "Meshlab-${version}";
-    sha256 = "14rrd8qrf91k89y6w2mn1r9zcfnwd0mir6g4dlgvr04i77hj4lk4";
+    sha256 = "sha256-MP+jkiV6yS1T1eWClxM56kZWLXwu0g4w/zBHy6CSL6Y=";
    fetchSubmodules = true; # for vcglib
  };

--- a/pkgs/applications/misc/firefly-desktop/default.nix
+++ b/pkgs/applications/misc/firefly-desktop/default.nix
@ -2,10 +2,10 @@

 let
  pname = "firefly-desktop";
-  version = "1.2.0";
+  version = "1.3.3";
  src = fetchurl {
    url = "https://github.com/iotaledger/firefly/releases/download/desktop-${version}/${pname}-${version}.AppImage";
-    sha256 = "f3162efcf0407614fd1351af50e95ef180400b747a5cc6b82bc840828a15548d";
+    sha256 = "a052efa29aa692eeafc921a2be4a5cbf71ae0b4216bd4759ea179086fb44c6d6";
  };
  appimageContents = appimageTools.extractType2 { inherit pname version src; };

--- a/pkgs/applications/misc/mobilecoin-wallet/default.nix
+++ b/pkgs/applications/misc/mobilecoin-wallet/default.nix
@ -2,11 +2,11 @@

 let
  pname = "mobilecoin-wallet";
-  version = "1.4.1";
+  version = "1.5.0";
  name = "${pname}-${version}";
  src = fetchurl {
    url = "https://github.com/mobilecoinofficial/desktop-wallet/releases/download/v${version}/MobileCoin-Wallet-${version}.AppImage";
-    sha256 = "sha256-x5frHgkEz77pqSB6YANRtZmCzaK/RxRzMElLu49lxPk=";
+    sha256 = "sha256-zSTtnKvgcDSiicEDuVK2LN2d8WHiGReYI3XLBmm3Fbo=";
  };
  appimageContents = appimageTools.extractType2 { inherit name src; };

--- a/pkgs/applications/misc/rofi/default.nix
+++ b/pkgs/applications/misc/rofi/default.nix
@ -19,6 +19,8 @@
 , flex
 , librsvg
 , check
+, glib
+, buildPackages
 }:

 stdenv.mkDerivation rec {
@ -39,14 +41,13 @@ stdenv.mkDerivation rec {
    sed -i 's/~root/~nobody/g' test/helper-expand.c
  '';

-  nativeBuildInputs = [ meson ninja pkg-config ];
+  depsBuildBuild = [ buildPackages.stdenv.cc pkg-config glib ];
+  nativeBuildInputs = [ meson ninja pkg-config flex bison ];
  buildInputs = [
    libxkbcommon
    pango
    cairo
    git
-    bison
-    flex
    librsvg
    check
    libstartup_notification
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@ -207,8 +207,8 @@ in stdenv.mkDerivation {

    export XDG_DATA_DIRS=$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH\''${XDG_DATA_DIRS:+:}\$XDG_DATA_DIRS

-    # Mainly for xdg-open but also other xdg-* tools:
-    export PATH="${xdg-utils}/bin\''${PATH:+:}\$PATH"
+    # Mainly for xdg-open but also other xdg-* tools (this is only a fallback; \$PATH is suffixed so that other implementations can be used):
+    export PATH="\$PATH\''${PATH:+:}${xdg-utils}/bin"

    .
    w
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -19,9 +19,9 @@
    }
  },
  "beta": {
-    "version": "99.0.4844.35",
-    "sha256": "085vsfp08y4vmv73z37ncynvax645qm302h883skx9xk4yyjkynj",
-    "sha256bin64": "18kys3f0zjkrp1x2vkcc9vx6vhj5yfrpb88lli7ql6q9b0ijjjn4",
+    "version": "99.0.4844.45",
+    "sha256": "1j6s9r2k6zyyjk3f74k2103zlih96wrr2a83bk79fwc582af9505",
+    "sha256bin64": "0lqps8lf7yg9nn5z2iy6hfrx2df59hif8vhf0camx2lfmrkgw8qa",
    "deps": {
      "gn": {
        "version": "2022-01-10",
@ -32,9 +32,9 @@
    }
  },
  "dev": {
-    "version": "100.0.4892.0",
-    "sha256": "03f003prk0vqxac7l0sp3nfhh3adlrdx60dklm74v504ykdw84yn",
-    "sha256bin64": "00033b2iq3aw5pvgm5nbh99sz8mj98rj32h1m6iw2xxwqaij06qw",
+    "version": "100.0.4896.12",
+    "sha256": "07jd3d5jhs659wwxnbxk6h93pz8zaynrw72b0y9l6l824lip6hl2",
+    "sha256bin64": "0fnxq0vjn00zai94p8jgx69bag30zzlfl2vzn0zb65pr10fpac87",
    "deps": {
      "gn": {
        "version": "2022-01-21",
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@ -96,6 +96,7 @@ let
      urls = [
        "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
+        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz"
      ];
      sha256 = "03c3l720x4c6mfq56fyqspc5sxw0mz1ph48l5wph06dzw8wd5cfz";
    };
@ -104,6 +105,7 @@ let
      urls = [
        "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
+        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz"
      ];
      sha256 = "0llg1nl7x7y4kp0hr3bbhdfggaf8praizkvcpp88x2i2zc9sp5mx";
    };
--- a/pkgs/applications/networking/cluster/argo/default.nix
+++ b/pkgs/applications/networking/cluster/argo/default.nix
@ -1,11 +1,11 @@
-{ lib, buildGoModule, buildGoPackage, fetchFromGitHub, installShellFiles }:
+{ lib, buildGoModule, buildGoPackage, fetchFromGitHub, installShellFiles, pkgsBuildBuild, stdenv }:

 let
  # Argo can package a static server in the CLI using the `staticfiles` go module.
  # We build the CLI without the static server for simplicity, but the tool is still required for
  # compilation to succeed.
  # See: https://github.com/argoproj/argo/blob/d7690e32faf2ac5842468831daf1443283703c25/Makefile#L117
-  staticfiles = buildGoPackage rec {
+  staticfiles = pkgsBuildBuild.buildGoPackage rec {
    name = "staticfiles";
    src = fetchFromGitHub {
      owner = "bouk";
@ -54,7 +54,10 @@ buildGoModule rec {

  postInstall = ''
    for shell in bash zsh; do
-      $out/bin/argo completion $shell > argo.$shell
+      ${if (stdenv.buildPlatform == stdenv.hostPlatform)
+        then "$out/bin/argo"
+        else "${pkgsBuildBuild.argo}/bin/argo"
+      } completion $shell > argo.$shell
      installShellCompletion argo.$shell
    done
  '';
--- a/pkgs/applications/networking/cluster/bosh-cli/default.nix
+++ b/pkgs/applications/networking/cluster/bosh-cli/default.nix
@ -8,13 +8,13 @@
 buildGoModule rec {
  pname = "bosh-cli";

-  version = "6.4.16";
+  version = "6.4.17";

  src = fetchFromGitHub {
    owner = "cloudfoundry";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-yjW0XlMXa1MyNIud3uGm7RNj47B4Bp3DK9tvBrfqkoA=";
+    sha256 = "sha256-oVL7tBtdFJt6ktctSZiNZMd6g1LEWQ/Hra4rcGM6BnQ=";
  };
  vendorSha256 = null;

--- a/pkgs/applications/networking/cluster/istioctl/default.nix
+++ b/pkgs/applications/networking/cluster/istioctl/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "istioctl";
-  version = "1.13.0";
+  version = "1.13.1";

  src = fetchFromGitHub {
    owner = "istio";
    repo = "istio";
    rev = version;
-    sha256 = "sha256-f0e2jdiIMfakG97LqJCP5Jk41D93a6wxaChN7WwY5oA=";
+    sha256 = "sha256-lFuDFuzart7uvs6NGNvNYh7JRF5ROx0V8uYoThF2mIU=";
  };
-  vendorSha256 = "sha256-gukwJp+qLbNJlBL5SemrVD6mExPnX0+19tbw/b4SJ8s=";
+  vendorSha256 = "sha256-cVbQUWgreVy5m6OdS+Ik/xvUuedlI75gM9zq4qto+gY=";

  doCheck = false;

--- a/pkgs/applications/networking/cluster/minikube/default.nix
+++ b/pkgs/applications/networking/cluster/minikube/default.nix
@ -11,9 +11,9 @@

 buildGoModule rec {
  pname = "minikube";
-  version = "1.25.1";
+  version = "1.25.2";

-  vendorSha256 = "sha256-MnyXePsnhb1Tl76uAtVW/DLacE0etXREGsapgNiZbMo=";
+  vendorSha256 = "sha256-8QqRIWry15/xwBxEOexMEq57ol8riy+kW8WrQqr53Q8=";

  doCheck = false;

@ -21,7 +21,7 @@ buildGoModule rec {
    owner = "kubernetes";
    repo = "minikube";
    rev = "v${version}";
-    sha256 = "sha256-pRNOVN9u27im9fkUawJYjuGHTW0N7L5oJa3fQ6DUO+4=";
+    sha256 = "sha256-WIk4ibq7jcqao0Qiz3mz9yfHdxTUlvtPuEh4gApSDBg=";
  };

  nativeBuildInputs = [ installShellFiles pkg-config which ];
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.36.1";
+  version = "0.36.2";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-aGVhxyPm5GtYjJlFNiPNxkPtdGdOiYOSkRRTlzyF/lM=";
+    sha256 = "sha256-Iv9ZQoU/mMYdxBuPfoYc/zQXQ14FmDBfoFwxnESC6Ns=";
  };

  vendorSha256 = "sha256-tNgEepKqwiqXhmoRCIEg7VJw7Y0TGt+R+6dZzd8aECg=";
--- a/pkgs/applications/networking/cluster/velero/default.nix
+++ b/pkgs/applications/networking/cluster/velero/default.nix
@ -2,14 +2,14 @@

 buildGoModule rec {
  pname = "velero";
-  version = "1.7.1";
+  version = "1.8.0";


  src = fetchFromGitHub {
    owner = "vmware-tanzu";
    repo = "velero";
    rev = "v${version}";
-    sha256 = "sha256-Jz3Tp5FqpmPuBscRB0KleQxtCvB43qmeLZNtGPnjuL0=";
+    sha256 = "sha256-tQGAzQFrpCUAEzdd5vr4j2oIb6TKeN9DQm96TdP0n40=";
  };

  ldflags = [
@ -18,9 +18,9 @@ buildGoModule rec {
    "-X github.com/vmware-tanzu/velero/pkg/buildinfo.GitTreeState=clean"
  ];

-  vendorSha256 = "sha256-fX9FeoIkxxSi3dl5W2MZLz5vN1VHkPNpTBGRxGP5Qx8=";
+  vendorSha256 = "sha256-DyQ+MHRNZFg80Yz/SCxhnF4NVbIsyhz4mApx0+kgHoA=";

-  excludedPackages = [ "issue-template-gen" "crd-gen" "release-tools" "velero-restic-restore-helper" "v1" "v1beta1" ];
+  excludedPackages = [ "issue-template-gen" "release-tools" "v1" "velero-restic-restore-helper" ];

  doCheck = false; # Tests expect a running cluster see https://github.com/vmware-tanzu/velero/tree/main/test/e2e
  doInstallCheck = true;
--- a/pkgs/applications/networking/cluster/waypoint/default.nix
+++ b/pkgs/applications/networking/cluster/waypoint/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "waypoint";
-  version = "0.7.1";
+  version = "0.7.2";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1vcwzksixc9n016gf8zavkdk7ba33zkmymclvjwb32pwsanvzdz7";
+    sha256 = "sha256-ek3WOL1sNPAIkZN/cWDSmlNtN41VL3SKb7Qb4kew8vo=";
  };

-  vendorSha256 = "0v4xk1ia6zhh4h2rgpinfl0hs300lk84vabm35mjahch7kmvfhvb";
+  vendorSha256 = "sha256-a0O36zyQQSVrGXWpTdCkAAwNAXU23pcFJBB+o2KYnWw=";

  nativeBuildInputs = [ go-bindata installShellFiles ];

--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@ -11,15 +11,15 @@

 buildGoModule rec {
  pname = "werf";
-  version = "1.2.70";
+  version = "1.2.71";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    rev = "v${version}";
-    sha256 = "sha256-Qla1pTqzBUgazzCo4A51YtoEj2UoVBgs4p/GrTfxQFM=";
+    sha256 = "sha256-bDaxxeHeswuoEU7YACa3tU80DFnmuFvEPfAq+pANSWY=";
  };
-  vendorSha256 = "sha256-PNg4QEi9+LvYWWhj2B6OrP+SBanuINlSGZYCMNjOQv0=";
+  vendorSha256 = "sha256-75uCGxW6Gqfhk5oImz26fUR8BeGHkikXHGJcCH32MxQ=";
  proxyVendor = true;

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
+++ b/pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "evolution-ews";
-  version = "3.42.3";
+  version = "3.42.4";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "qgi2ycWlzY4PaiEMHu0Rd3bN2aqFcLtxkII1MzZXls4=";
+    sha256 = "gpIW4GBXT0GCtV7Q8EfdEeK56gCACi+PJ/jbwQkVQbk=";
  };

  nativeBuildInputs = [ cmake gettext intltool pkg-config ];
@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Evolution connector for Microsoft Exchange Server protocols";
    homepage = "https://gitlab.gnome.org/GNOME/evolution-ews";
-    license = "LGPL-2.1-only OR LGPL-3.0-only"; # https://gitlab.gnome.org/GNOME/evolution-ews/issues/111
+    license = licenses.lgpl21Plus; # https://gitlab.gnome.org/GNOME/evolution-ews/issues/111
    maintainers = [ maintainers.dasj19 ];
    platforms = platforms.linux;
  };
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@ -1,62 +1,39 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, qt5
+{ lib, stdenv, fetchFromGitHub, pkg-config, qt5, cmake
 , avahi, boost, libopus, libsndfile, protobuf, speex, libcap
 , alsa-lib, python3
 , rnnoise
-, jackSupport ? false, libjack2
-, speechdSupport ? false, speechd
-, pulseSupport ? false, libpulseaudio
-, iceSupport ? false, zeroc-ice
-, grpcSupport ? false, grpc, which
 , nixosTests
+, poco
+, flac
+, libogg
+, libvorbis
+, grpcSupport ? false, grpc, which
+, iceSupport ? true, zeroc-ice
+, jackSupport ? false, libjack2
+, pipewireSupport ? true, pipewire
+, pulseSupport ? true, libpulseaudio
+, speechdSupport ? false, speechd
 }:

 let
-  generic = overrides: source: qt5.mkDerivation (source // overrides // {
+  generic = overrides: source: stdenv.mkDerivation (source // overrides // {
    pname = overrides.type;
    version = source.version;

-    patches = (source.patches or [])
-      ++ [ ./fix-rnnoise-argument.patch ];
-
-    nativeBuildInputs = [ pkg-config python3 qt5.qmake ]
+    nativeBuildInputs = [ cmake pkg-config python3 qt5.wrapQtAppsHook qt5.qttools ]
      ++ (overrides.nativeBuildInputs or [ ]);

-    buildInputs = [ boost protobuf avahi ]
+    buildInputs = [ avahi boost poco protobuf ]
      ++ (overrides.buildInputs or [ ]);

-    qmakeFlags = [
-      "CONFIG+=c++11"
-      "CONFIG+=shared"
-      "CONFIG+=no-g15"
-      "CONFIG+=packaged"
-      "CONFIG+=no-update"
-      "CONFIG+=no-embed-qt-translations"
-      "CONFIG+=bundled-celt"
-      "CONFIG+=no-bundled-opus"
-      "CONFIG+=no-bundled-speex"
-      "DEFINES+=PLUGIN_PATH=${placeholder "out"}/lib/mumble"
-    ] ++ lib.optional (!speechdSupport) "CONFIG+=no-speechd"
-      ++ lib.optional jackSupport "CONFIG+=no-oss CONFIG+=no-alsa CONFIG+=jackaudio"
-      ++ (overrides.configureFlags or [ ]);
+    cmakeFlags = [
+      "-D g15=OFF"
+    ] ++ (overrides.configureFlags or [ ]);

    preConfigure = ''
       patchShebangs scripts
    '';

-    makeFlags = [ "release" ];
-
-    installPhase = ''
-      runHook preInstall
-
-      ${overrides.installPhase}
-
-      # doc stuff
-      mkdir -p $out/share/man/man1
-      install -Dm644 man/mum* $out/share/man/man1/
-
-      runHook postInstall
-    '';
-
    passthru.tests.connectivity = nixosTests.mumble;

    meta = with lib; {
@ -72,66 +49,63 @@ let
    type = "mumble";

    nativeBuildInputs = [ qt5.qttools ];
-    buildInputs = [ libopus libsndfile speex qt5.qtsvg rnnoise ]
-      ++ lib.optional stdenv.isLinux alsa-lib
+    buildInputs = [ flac libogg libopus libsndfile libvorbis qt5.qtsvg rnnoise speex ]
+      ++ lib.optional (!jackSupport) alsa-lib
      ++ lib.optional jackSupport libjack2
      ++ lib.optional speechdSupport speechd
-      ++ lib.optional pulseSupport libpulseaudio;
+      ++ lib.optional pulseSupport libpulseaudio
+      ++ lib.optional pipewireSupport pipewire;

    configureFlags = [
-      "CONFIG+=no-server"
-    ];
+      "-D server=OFF"
+      "-D bundled-celt=ON"
+      "-D bundled-opus=OFF"
+      "-D bundled-speex=OFF"
+      "-D bundled-rnnoise=OFF"
+      "-D bundle-qt-translations=OFF"
+      "-D update=OFF"
+      "-D overlay-xcompile=OFF"
+      "-D oss=OFF"
+    ] ++ lib.optional (!speechdSupport) "-D speechd=OFF"
+      ++ lib.optional (!pulseSupport) "-D pulseaudio=OFF"
+      ++ lib.optional (!pipewireSupport) "-D pipewire=OFF"
+      ++ lib.optional jackSupport "-D alsa=OFF -D jackaudio=ON";

    NIX_CFLAGS_COMPILE = lib.optional speechdSupport "-I${speechd}/include/speech-dispatcher";

-    installPhase = ''
-      # bin stuff
-      install -Dm755 release/mumble $out/bin/mumble
-      install -Dm755 scripts/mumble-overlay $out/bin/mumble-overlay
-
-      # lib stuff
-      mkdir -p $out/lib/mumble
-      cp -P release/libmumble.so* $out/lib
-      cp -P release/libcelt* $out/lib/mumble
-      cp -P release/plugins/* $out/lib/mumble
-
-      # icons
-      install -Dm644 scripts/mumble.desktop $out/share/applications/mumble.desktop
-      install -Dm644 icons/mumble.svg $out/share/icons/hicolor/scalable/apps/mumble.svg
+    postFixup = ''
+      wrapProgram $out/bin/mumble \
+        --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath (lib.optional pulseSupport libpulseaudio ++ lib.optional pipewireSupport pipewire)}"
    '';
  } source;

  server = source: generic {
    type = "murmur";

-    postPatch = lib.optionalString iceSupport ''
-      grep -Rl '/usr/share/Ice' . | xargs sed -i 's,/usr/share/Ice/,${zeroc-ice.dev}/share/ice/,g'
-    '';
-
    configureFlags = [
-      "CONFIG+=no-client"
-    ] ++ lib.optional (!iceSupport) "CONFIG+=no-ice"
-      ++ lib.optional grpcSupport "CONFIG+=grpc";
+      "-D client=OFF"
+    ] ++ lib.optional (!iceSupport) "-D ice=OFF"
+      ++ lib.optionals iceSupport [
+        "-D Ice_HOME=${lib.getDev zeroc-ice};${lib.getLib zeroc-ice}"
+        "-D CMAKE_PREFIX_PATH=${lib.getDev zeroc-ice};${lib.getLib zeroc-ice}"
+        "-D Ice_SLICE_DIR=${lib.getDev zeroc-ice}/share/ice/slice"
+      ]
+      ++ lib.optional grpcSupport "-D grpc=ON";

    buildInputs = [ libcap ]
      ++ lib.optional iceSupport zeroc-ice
      ++ lib.optionals grpcSupport [ grpc which ];
-
-    installPhase = ''
-      # bin stuff
-      install -Dm755 release/murmurd $out/bin/murmurd
-    '';
  } source;

  source = rec {
-    version = "1.3.4";
+    version = "unstable-1.4.231";

    # Needs submodules
    src = fetchFromGitHub {
      owner = "mumble-voip";
      repo = "mumble";
-      rev = version;
-      sha256 = "sha256-njovShQpW0JNeeE8VugdmGzDk3fKG8/fcJoBgdyTZug=";
+      rev = "9e0e274d6a9d8a9919267e747d05d0500d150560";
+      sha256 = "0whvb4nlf7gjf2v7wsaq0ir18mshhw5wi8c9q9qz43wnh42nn2qi";
      fetchSubmodules = true;
    };
  };
--- a/pkgs/applications/networking/mumble/fix-rnnoise-argument.patch
+++ b/pkgs/applications/networking/mumble/fix-rnnoise-argument.patch
@ -1,16 +0,0 @@
-nixpkgs has a more recent rnnoise than the one used by mumble, and rnnoise
-changed the argument rnnoise_create[1],
-
-[1] https://github.com/xiph/rnnoise/commit/231b9c02d14a74cb449a98004cb7a2cf1bdeca2f
-
--- old/src/mumble/AudioInput.cpp	2020-02-18 22:55:32.000000000 -0500
-+++ new/src/mumble/AudioInput.cpp	2020-02-18 22:58:08.000000000 -0500
-@@ -106,7 +106,7 @@
- #endif
- 
- #ifdef USE_RNNOISE
-	denoiseState = rnnoise_create();
-+	denoiseState = rnnoise_create(NULL);
- #endif
- 
- 	qWarning("AudioInput: %d bits/s, %d hz, %d sample", iAudioQuality, iSampleRate, iFrameSize);
--- a/pkgs/applications/networking/pjsip/default.nix
+++ b/pkgs/applications/networking/pjsip/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "pjsip";
-  version = "2.11.1";
+  version = "2.12";

  src = fetchFromGitHub {
    owner = pname;
    repo = "pjproject";
    rev = version;
-    sha256 = "sha256-mqtlxQDIFee93wpdn8oNWmMPDyjYTCmVqF6IJvJbRBM=";
+    sha256 = "sha256-snp9+PlffU9Ay8o42PM8SqyP60hu9nozp457HM+0bM8=";
  };

  patches = [
--- a/pkgs/applications/networking/remote/freerdp/default.nix
+++ b/pkgs/applications/networking/remote/freerdp/default.nix
@ -52,13 +52,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "freerdp";
-  version = "2.5.0";
+  version = "2.6.0";

  src = fetchFromGitHub {
    owner = "FreeRDP";
    repo = "FreeRDP";
    rev = version;
-    sha256 = "sha256-OLz/f4E+Haumw5Jaw+F1hiHz0jfcywhfK3fEUgLorao=";
+    sha256 = "sha256-gYHnorj2Up0aAVeltCCPOg/j3DY0ukWWNUU7uikvys0=";
  };

  postPatch = ''
--- a/pkgs/applications/office/morgen/default.nix
+++ b/pkgs/applications/office/morgen/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "morgen";
-  version = "2.4.3";
+  version = "2.4.4";

  src = fetchurl {
    url = "https://download.todesktop.com/210203cqcj00tw1/morgen-${version}.deb";
-    sha256 = "sha256-IWGeb0+IiFNYJ+jQAzGYfQ5FnrbR6HIpynS9jgd5/mY=";
+    sha256 = "sha256-5/85ro206o3SsvAvcZeDD2Dmo2jU4zXmtI3X4WdQaRI=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@ -69,7 +69,9 @@ let
      { case = range "8.7" "8.10";  out = ocamlPackages_4_09; }
      { case = range "8.5" "8.6";   out = ocamlPackages_4_05; }
    ] ocamlPackages_4_12;
-  ocamlBuildInputs = [ ocamlPackages.ocaml ocamlPackages.findlib ]
+  ocamlNativeBuildInputs = [ ocamlPackages.ocaml ocamlPackages.findlib ]
+    ++ optional (versionAtLeast "8.14") ocamlPackages.dune_2;
+  ocamlBuildInputs = []
    ++ optional (!versionAtLeast "8.10") ocamlPackages.camlp5
    ++ optional (!versionAtLeast "8.13") ocamlPackages.num
    ++ optional (versionAtLeast "8.13") ocamlPackages.zarith;
@ -79,7 +81,7 @@ self = stdenv.mkDerivation {

  passthru = {
    inherit coq-version;
-    inherit ocamlPackages ocamlBuildInputs;
+    inherit ocamlPackages ocamlBuildInputs ocamlNativeBuildInputs;
    # For compatibility
    inherit (ocamlPackages) ocaml camlp5 findlib num ;
    emacsBufferSetup = pkgs: ''
@ -129,6 +131,7 @@ self = stdenv.mkDerivation {
  };

  nativeBuildInputs = [ pkg-config ]
+    ++ ocamlNativeBuildInputs
    ++ optional buildIde copyDesktopItems
    ++ optional (buildIde && versionAtLeast "8.10") wrapGAppsHook
    ++ optional (!versionAtLeast "8.6") gnumake42;
@ -137,7 +140,6 @@ self = stdenv.mkDerivation {
      (if versionAtLeast "8.10"
       then [ ocamlPackages.lablgtk3-sourceview3 glib gnome.adwaita-icon-theme ]
       else [ ocamlPackages.lablgtk ])
-    ++ optional (versionAtLeast "8.14") ocamlPackages.dune_2
  ;

  postPatch = ''
@ -168,7 +170,7 @@ self = stdenv.mkDerivation {

  prefixKey = "-prefix ";

-  buildFlags = [ "revision" "coq" "coqide" ] ++ optional (!versionAtLeast "8.14") "bin/votour";
+  buildFlags = [ "revision" "coq" ] ++ optional buildIde "coqide" ++ optional (!versionAtLeast "8.14") "bin/votour";
  enableParallelBuilding = true;

  createFindlibDestdir = true;
--- a/pkgs/applications/version-management/fossil/default.nix
+++ b/pkgs/applications/version-management/fossil/default.nix
@ -16,11 +16,11 @@

 stdenv.mkDerivation rec {
  pname = "fossil";
-  version = "2.17";
+  version = "2.18";

  src = fetchurl {
    url = "https://www.fossil-scm.org/home/tarball/version-${version}/fossil-${version}.tar.gz";
-    sha256 = "0539rsfvwv49qyrf36z5m0k74kvnn6y5xasm9vvi6lbphx8yxmi1";
+    sha256 = "0iimdzfdl5687xyqxfadbn640x45n3933q1nfx7b32rl4v3vk778";
  };

  nativeBuildInputs = [ installShellFiles tcl tcllib ];
--- a/pkgs/applications/version-management/git-and-tools/ghorg/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/ghorg/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "ghorg";
-  version = "1.5.1";
+  version = "1.7.8";

  src = fetchFromGitHub {
    owner = "gabrie30";
    repo = "ghorg";
-    rev = version;
-    sha256 = "sha256-HkOMG7VG8jyvr1W1T/62murtNYE8wyT/p3lDtuxfm5M=";
+    rev = "v${version}";
+    sha256 = "sha256-NZlPcr13onxgbmKPdv0ODOhYDT5T+OeSvHE8VGOGyo4=";
  };

  doCheck = false;
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,14 +1,14 @@
 {
-  "version": "14.7.3",
-  "repo_hash": "1by4r7an5s5n9jka77mvp9ysc9c5kyvld9fvwr0r5qw2h39akl9g",
+  "version": "14.7.4",
+  "repo_hash": "0z62p2c24h7icdqar2l3nwlq7z4pan6n80ril8j1y6k03z1cs0nq",
  "yarn_hash": "12k2r1y7kw95kfsmy0s8rbsf0vldr8c2liah0rkc7pihr19gq3w7",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v14.7.3-ee",
+  "rev": "v14.7.4-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "14.7.3",
+    "GITALY_SERVER_VERSION": "14.7.4",
    "GITLAB_PAGES_VERSION": "1.51.0",
    "GITLAB_SHELL_VERSION": "13.22.2",
-    "GITLAB_WORKHORSE_VERSION": "14.7.3"
+    "GITLAB_WORKHORSE_VERSION": "14.7.4"
  }
 }
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -25,7 +25,7 @@ let
    gemdir = ./.;
  };

-  version = "14.7.3";
+  version = "14.7.4";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/v${lib.versions.major version}";
 in

@ -37,7 +37,7 @@ buildGoModule {
    owner = "gitlab-org";
    repo = "gitaly";
    rev = "v${version}";
-    sha256 = "sha256-5m+bhHtI1VZr8Di3LNG0Z7yk8oVTv6re7rckFDjaVvk=";
+    sha256 = "sha256-sNSRYqGIi/PzegHYe04WUaLegPEeX79NjuqSVul21Ak=";
  };

  vendorSha256 = "sha256-eapqtSstc7d3R7A/5krKV0uVr9GhGkHHMrmsBOpWAbo=";
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -5,7 +5,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "14.7.3";
+  version = "14.7.4";

  src = fetchFromGitLab {
    owner = data.owner;
--- a/pkgs/applications/version-management/redmine/Gemfile
+++ b/pkgs/applications/version-management/redmine/Gemfile
@ -3,7 +3,7 @@ source 'https://rubygems.org'
 ruby '>= 2.4.0', '< 2.8.0'
 gem 'bundler', '>= 1.12.0'

-gem 'rails', '5.2.6'
+gem 'rails', '5.2.6.2'
 gem 'sprockets', '~> 3.7.2' if RUBY_VERSION < '2.5'
 gem 'globalid', '~> 0.4.2' if Gem.ruby_version < Gem::Version.new('2.6.0')
 gem 'rouge', '~> 3.26.0'
--- a/pkgs/applications/version-management/redmine/Gemfile.lock
+++ b/pkgs/applications/version-management/redmine/Gemfile.lock
@ -1,19 +1,19 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    actioncable (5.2.6)
-      actionpack (= 5.2.6)
+    actioncable (5.2.6.2)
+      actionpack (= 5.2.6.2)
      nio4r (~> 2.0)
      websocket-driver (>= 0.6.1)
-    actionmailer (5.2.6)
-      actionpack (= 5.2.6)
-      actionview (= 5.2.6)
-      activejob (= 5.2.6)
+    actionmailer (5.2.6.2)
+      actionpack (= 5.2.6.2)
+      actionview (= 5.2.6.2)
+      activejob (= 5.2.6.2)
      mail (~> 2.5, >= 2.5.4)
      rails-dom-testing (~> 2.0)
-    actionpack (5.2.6)
-      actionview (= 5.2.6)
-      activesupport (= 5.2.6)
+    actionpack (5.2.6.2)
+      actionview (= 5.2.6.2)
+      activesupport (= 5.2.6.2)
      rack (~> 2.0, >= 2.0.8)
      rack-test (>= 0.6.3)
      rails-dom-testing (~> 2.0)
@ -21,26 +21,26 @@ GEM
    actionpack-xml_parser (2.0.1)
      actionpack (>= 5.0)
      railties (>= 5.0)
-    actionview (5.2.6)
-      activesupport (= 5.2.6)
+    actionview (5.2.6.2)
+      activesupport (= 5.2.6.2)
      builder (~> 3.1)
      erubi (~> 1.4)
      rails-dom-testing (~> 2.0)
      rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activejob (5.2.6)
-      activesupport (= 5.2.6)
+    activejob (5.2.6.2)
+      activesupport (= 5.2.6.2)
      globalid (>= 0.3.6)
-    activemodel (5.2.6)
-      activesupport (= 5.2.6)
-    activerecord (5.2.6)
-      activemodel (= 5.2.6)
-      activesupport (= 5.2.6)
+    activemodel (5.2.6.2)
+      activesupport (= 5.2.6.2)
+    activerecord (5.2.6.2)
+      activemodel (= 5.2.6.2)
+      activesupport (= 5.2.6.2)
      arel (>= 9.0)
-    activestorage (5.2.6)
-      actionpack (= 5.2.6)
-      activerecord (= 5.2.6)
+    activestorage (5.2.6.2)
+      actionpack (= 5.2.6.2)
+      activerecord (= 5.2.6.2)
      marcel (~> 1.0.0)
-    activesupport (5.2.6)
+    activesupport (5.2.6.2)
      concurrent-ruby (~> 1.0, >= 1.0.2)
      i18n (>= 0.7, < 2)
      minitest (~> 5.1)
@ -58,21 +58,21 @@ GEM
      rack-test (>= 0.6.3)
      regexp_parser (~> 1.5)
      xpath (~> 3.2)
-    childprocess (3.0.0)
+    childprocess (4.1.0)
    chunky_png (1.4.0)
    concurrent-ruby (1.1.9)
    crass (1.0.6)
-    css_parser (1.10.0)
+    css_parser (1.11.0)
      addressable
    csv (3.1.9)
    docile (1.4.0)
    erubi (1.10.0)
-    globalid (0.5.2)
+    globalid (1.0.0)
      activesupport (>= 5.0)
    htmlentities (4.3.4)
-    i18n (1.8.10)
+    i18n (1.8.11)
      concurrent-ruby (~> 1.0)
-    loofah (2.12.0)
+    loofah (2.14.0)
      crass (~> 1.0.2)
      nokogiri (>= 1.5.9)
    mail (2.7.1)
@ -82,7 +82,7 @@ GEM
    mini_magick (4.11.0)
    mini_mime (1.0.3)
    mini_portile2 (2.5.3)
-    minitest (5.14.4)
+    minitest (5.15.0)
    mocha (1.13.0)
    mysql2 (0.5.3)
    net-ldap (0.17.0)
@ -91,44 +91,44 @@ GEM
      mini_portile2 (~> 2.5.0)
      racc (~> 1.4)
    parallel (1.21.0)
-    parser (3.0.2.0)
+    parser (3.1.1.0)
      ast (~> 2.4.1)
    pg (1.2.3)
    public_suffix (4.0.6)
-    puma (5.5.2)
+    puma (5.6.2)
      nio4r (~> 2.0)
-    racc (1.5.2)
+    racc (1.6.0)
    rack (2.2.3)
    rack-openid (1.4.2)
      rack (>= 1.1.0)
      ruby-openid (>= 2.1.8)
    rack-test (1.1.0)
      rack (>= 1.0, < 3)
-    rails (5.2.6)
-      actioncable (= 5.2.6)
-      actionmailer (= 5.2.6)
-      actionpack (= 5.2.6)
-      actionview (= 5.2.6)
-      activejob (= 5.2.6)
-      activemodel (= 5.2.6)
-      activerecord (= 5.2.6)
-      activestorage (= 5.2.6)
-      activesupport (= 5.2.6)
+    rails (5.2.6.2)
+      actioncable (= 5.2.6.2)
+      actionmailer (= 5.2.6.2)
+      actionpack (= 5.2.6.2)
+      actionview (= 5.2.6.2)
+      activejob (= 5.2.6.2)
+      activemodel (= 5.2.6.2)
+      activerecord (= 5.2.6.2)
+      activestorage (= 5.2.6.2)
+      activesupport (= 5.2.6.2)
      bundler (>= 1.3.0)
-      railties (= 5.2.6)
+      railties (= 5.2.6.2)
      sprockets-rails (>= 2.0.0)
    rails-dom-testing (2.0.3)
      activesupport (>= 4.2.0)
      nokogiri (>= 1.6)
    rails-html-sanitizer (1.4.2)
      loofah (~> 2.3)
-    railties (5.2.6)
-      actionpack (= 5.2.6)
-      activesupport (= 5.2.6)
+    railties (5.2.6.2)
+      actionpack (= 5.2.6.2)
+      activesupport (= 5.2.6.2)
      method_source
      rake (>= 0.8.7)
      thor (>= 0.19.0, < 2.0)
-    rainbow (3.0.0)
+    rainbow (3.1.1)
    rake (13.0.6)
    rbpdf (1.20.1)
      htmlentities
@ -136,7 +136,7 @@ GEM
    rbpdf-font (1.19.1)
    redcarpet (3.5.1)
    regexp_parser (1.8.2)
-    request_store (1.5.0)
+    request_store (1.5.1)
      rack (>= 1.4)
    rexml (3.2.5)
    roadie (4.0.0)
@ -147,7 +147,7 @@ GEM
      roadie (>= 3.1, < 5.0)
    rotp (6.2.0)
    rouge (3.26.1)
-    rqrcode (2.1.0)
+    rqrcode (2.1.1)
      chunky_png (~> 1.0)
      rqrcode_core (~> 1.0)
    rqrcode_core (1.2.0)
@ -160,8 +160,8 @@ GEM
      rubocop-ast (>= 1.2.0, < 2.0)
      ruby-progressbar (~> 1.7)
      unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.12.0)
-      parser (>= 3.0.1.1)
+    rubocop-ast (1.16.0)
+      parser (>= 3.1.1.0)
    rubocop-performance (1.10.2)
      rubocop (>= 0.90.0, < 2.0)
      rubocop-ast (>= 0.4.0)
@ -172,8 +172,9 @@ GEM
    ruby-openid (2.9.2)
    ruby-progressbar (1.11.0)
    rubyzip (2.3.2)
-    selenium-webdriver (3.142.7)
-      childprocess (>= 0.5, < 4.0)
+    selenium-webdriver (4.1.0)
+      childprocess (>= 0.5, < 5.0)
+      rexml (~> 3.2, >= 3.2.5)
      rubyzip (>= 1.2.2)
    simplecov (0.18.5)
      docile (~> 1.1)
@ -182,25 +183,27 @@ GEM
    sprockets (4.0.2)
      concurrent-ruby (~> 1.0)
      rack (> 1, < 3)
-    sprockets-rails (3.2.2)
-      actionpack (>= 4.0)
-      activesupport (>= 4.0)
+    sprockets-rails (3.4.2)
+      actionpack (>= 5.2)
+      activesupport (>= 5.2)
      sprockets (>= 3.0.0)
-    thor (1.1.0)
+    thor (1.2.1)
    thread_safe (0.3.6)
    tzinfo (1.2.9)
      thread_safe (~> 0.1)
    unicode-display_width (2.1.0)
-    webdrivers (4.6.1)
+    webdrivers (4.7.0)
      nokogiri (~> 1.6)
      rubyzip (>= 1.3.0)
-      selenium-webdriver (>= 3.0, < 4.0)
+      selenium-webdriver (> 3.141, < 5.0)
+    webrick (1.7.0)
    websocket-driver (0.7.5)
      websocket-extensions (>= 0.1.0)
    websocket-extensions (0.1.5)
    xpath (3.2.0)
      nokogiri (~> 1.8)
-    yard (0.9.26)
+    yard (0.9.27)
+      webrick (~> 1.7.0)

 PLATFORMS
  ruby
@ -224,7 +227,7 @@ DEPENDENCIES
  pg (~> 1.2.2)
  puma
  rack-openid
-  rails (= 5.2.6)
+  rails (= 5.2.6.2)
  rails-dom-testing
  rbpdf (~> 1.20.0)
  redcarpet (~> 3.5.1)
--- a/pkgs/applications/version-management/redmine/default.nix
+++ b/pkgs/applications/version-management/redmine/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, bundlerEnv, ruby, makeWrapper }:

 let
-  version = "4.2.3";
+  version = "4.2.4";
  rubyEnv = bundlerEnv {
    name = "redmine-env-${version}";

@ -15,8 +15,10 @@ in
    inherit version;

    src = fetchurl {
-      url = "https://www.redmine.org/releases/${pname}-${version}.tar.gz";
-      sha256 = "033slhr5kmz5b29v7n52336i0r7y4m9si748b22r85s2jpf37xkj";
+      # https://www.redmine.org/news/134
+      # > "These releases are not available yet on the releases page from a technical reason, we are sorry for this and we expected to have them uploaded next week. I'll post here an update after we have them uploaded."
+      url = "https://www.redmine.org/attachments/download/28862/${pname}-${version}.tar.gz";
+      sha256 = "7f50fd4a6cf1c1e48091a87696b813ba264e11f04dec67fb006858a1b49a5c7d";
    };

    nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/version-management/redmine/gemset.nix
+++ b/pkgs/applications/version-management/redmine/gemset.nix
@ -5,10 +5,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1s778lwghaf0zwfvbhzvjq691rl75d85raiqg1c7zly8p9afq8ym";
+      sha256 = "0il9l30jz1gfjccrahfk2gl57b31dqgjlzjc8cfifm76ggywmz67";
      type = "gem";
    };
-    version = "5.2.6";
+    version = "5.2.6.2";
  };
  actionmailer = {
    dependencies = ["actionpack" "actionview" "activejob" "mail" "rails-dom-testing"];
@ -16,10 +16,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0gwvn4lrkhqmxp96npjp4sfaz78h9ab2lrl20sjph7xxakfwknld";
+      sha256 = "1cci24da56d467ldq40n3l176h9qdw691w1b703c251izh6c4n5d";
      type = "gem";
    };
-    version = "5.2.6";
+    version = "5.2.6.2";
  };
  actionpack = {
    dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
@ -27,10 +27,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0b2xl458f2ygnjbvv0hacc8bk9qxbx64m2g7vw6f9y7k8q85930y";
+      sha256 = "1xis55xvs4hja6fnmj4785rzafk553k5f0xb7jprqf38c6dzmiak";
      type = "gem";
    };
-    version = "5.2.6";
+    version = "5.2.6.2";
  };
  actionpack-xml_parser = {
    dependencies = ["actionpack" "railties"];
@ -49,10 +49,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "06f8212kplqhap9jpi49dvqlhwkfxxxm9nh8al6qjvl7mfh9qbzg";
+      sha256 = "00a9g63xwfimnzsrcrnr4vmdwhg7jaic49jas70r695nznwkxr9x";
      type = "gem";
    };
-    version = "5.2.6";
+    version = "5.2.6.2";
  };
  activejob = {
    dependencies = ["activesupport" "globalid"];
@ -60,10 +60,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1cdvxkbzbs4cdh4bgf2cg7i886a20gvr43hg76kx5rzd8xal7xnd";
+      sha256 = "0fm5qxrv8pxhl7m88p17xxpizddasm9kknaldkax8im3b9vrgnr9";
      type = "gem";
    };
-    version = "5.2.6";
+    version = "5.2.6.2";
  };
  activemodel = {
    dependencies = ["activesupport"];
@ -71,10 +71,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1r28kcnzr8dm6idirndd8pvbmg5c678ijxk845g84ykq1l69czs6";
+      sha256 = "0k0xizwbcadmslc8rkg2vnsbrsqivm6yj2yjrzb6rhqwphcr9zjf";
      type = "gem";
    };
-    version = "5.2.6";
+    version = "5.2.6.2";
  };
  activerecord = {
    dependencies = ["activemodel" "activesupport" "arel"];
@ -82,10 +82,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "05qqnichgxml6z3d1dpgjy2fi62dppnqxgg37hr9a35hwhn05fzc";
+      sha256 = "1m00zh62rfn2h15vfn89jg39wxmghc88v2vjb5r4m0c7g24vrb14";
      type = "gem";
    };
-    version = "5.2.6";
+    version = "5.2.6.2";
  };
  activestorage = {
    dependencies = ["actionpack" "activerecord" "marcel"];
@ -93,10 +93,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0wnzac1qs4y339p13xyr03rx4ql3i4ywzfhyzn118d2zz82xnpfl";
+      sha256 = "0h3z331xli0j5didh0g9cv4zrlx32b5csp1566fpy0fr2kgqmpi9";
      type = "gem";
    };
-    version = "5.2.6";
+    version = "5.2.6.2";
  };
  activesupport = {
    dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo"];
@ -104,10 +104,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1vybx4cj42hr6m8cdwbrqq2idh98zms8c11kr399xjczhl9ywjbj";
+      sha256 = "164lmi9w96wdwd00dnly8f9dcak3blv49ymyqz30q2fdjn45c775";
      type = "gem";
    };
-    version = "5.2.6";
+    version = "5.2.6.2";
  };
  addressable = {
    dependencies = ["public_suffix"];
@ -166,10 +166,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1ic028k8xgm2dds9mqnvwwx3ibaz32j8455zxr9f4bcnviyahya5";
+      sha256 = "1lvcp8bsd35g57f7wz4jigcw2sryzzwrpcgjwwf3chmjrjcww5in";
      type = "gem";
    };
-    version = "3.0.0";
+    version = "4.1.0";
  };
  chunky_png = {
    groups = ["default"];
@ -207,10 +207,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1q8gj3wkc2mbzsqw5zcsr3kyzrrb2pda03pi769rjbvqr94g3bm5";
+      sha256 = "1qbdgp36dhcyljhmfxrvbgp1ha9yqxhxgyg3sdm48y9m371jd2an";
      type = "gem";
    };
-    version = "1.10.0";
+    version = "1.11.0";
  };
  csv = {
    groups = ["default"];
@ -248,10 +248,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0k6ww3shk3mv119xvr9m99l6ql0czq91xhd66hm8hqssb18r2lvm";
+      sha256 = "1n5yc058i8xhi1fwcp1w7mfi6xaxfmrifdb4r4hjfff33ldn8lqj";
      type = "gem";
    };
-    version = "0.5.2";
+    version = "1.0.0";
  };
  htmlentities = {
    groups = ["default"];
@ -269,10 +269,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0g2fnag935zn2ggm5cn6k4s4xvv53v2givj1j90szmvavlpya96a";
+      sha256 = "0vdd1kii40qhbr9n8qx71k2gskq6rkl8ygy8hw5hfj8bb5a364xf";
      type = "gem";
    };
-    version = "1.8.10";
+    version = "1.8.11";
  };
  loofah = {
    dependencies = ["crass" "nokogiri"];
@ -280,10 +280,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1nqcya57x2n58y1dify60i0dpla40n4yir928khp4nj5jrn9mgmw";
+      sha256 = "0z8bdcmw66j3dy6ivcc02yq32lx3n9bavx497llln8qy014xjm4w";
      type = "gem";
    };
-    version = "2.12.0";
+    version = "2.14.0";
  };
  mail = {
    dependencies = ["mini_mime"];
@ -351,10 +351,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "19z7wkhg59y8abginfrm2wzplz7py3va8fyngiigngqvsws6cwgl";
+      sha256 = "06xf558gid4w8lwx13jwfdafsch9maz8m0g85wnfymqj63x5nbbd";
      type = "gem";
    };
-    version = "5.14.4";
+    version = "5.15.0";
  };
  mocha = {
    groups = ["test"];
@ -431,10 +431,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "06ma6w87ph8lnc9z4hi40ynmcdnjv0p8x53x0s3fjkz4q2p6sxh5";
+      sha256 = "0zaghgvva2q4jqbachg8jvpwgbg3w1jqr0d00m8rqciqznjgsw3c";
      type = "gem";
    };
-    version = "3.0.2.0";
+    version = "3.1.1.0";
  };
  pg = {
    groups = ["default"];
@ -470,20 +470,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1xblxnrs0c5m326v7kgr32k4m00cl2ipcf5m0qvyisrw62vd5dbn";
+      sha256 = "1np2myaxlk5iab1zarwgmp7zsjvm5j8ssg35ijv8b6dpvc3cjd56";
      type = "gem";
    };
-    version = "5.5.2";
+    version = "5.6.2";
  };
  racc = {
    groups = ["default" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "178k7r0xn689spviqzhvazzvxfq6fyjldxb3ywjbgipbfi4s8j1g";
+      sha256 = "0la56m0z26j3mfn1a9lf2l03qx1xifanndf9p3vx1azf6sqy7v9d";
      type = "gem";
    };
-    version = "1.5.2";
+    version = "1.6.0";
  };
  rack = {
    groups = ["default" "openid" "test"];
@ -523,10 +523,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1p17dmifd0v3knh9wja4z4rv0qaybwansnwxmvx6f3rcgkszkpnc";
+      sha256 = "0fgbld733j2j85pf8kpv1mvp8rmlkqs7ccv77q2mwfm7ri4yisy0";
      type = "gem";
    };
-    version = "5.2.6";
+    version = "5.2.6.2";
  };
  rails-dom-testing = {
    dependencies = ["activesupport" "nokogiri"];
@ -556,20 +556,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0rs97fxv13hgpbmyhk8ag8qzgkh25css0797h90k9w1vg9djl84k";
+      sha256 = "1fgyw80j2mss3hdhzxa1b12c7j17az55znq0d16md69if8dwfmic";
      type = "gem";
    };
-    version = "5.2.6";
+    version = "5.2.6.2";
  };
  rainbow = {
    groups = ["default" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0bb2fpjspydr6x0s8pn1pqkzmxszvkfapv0p4627mywl7ky4zkhk";
+      sha256 = "0smwg4mii0fm38pyb5fddbmrdpifwv22zv3d3px2xx497am93503";
      type = "gem";
    };
-    version = "3.0.0";
+    version = "3.1.1";
  };
  rake = {
    groups = ["default"];
@ -628,10 +628,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0cx74kispmnw3ljwb239j65a2j14n8jlsygy372hrsa8mxc71hxi";
+      sha256 = "13ppgmsbrqah08j06bybd3cddv6dml79yzyjn7r8j1src78h98h7";
      type = "gem";
    };
-    version = "1.5.0";
+    version = "1.5.1";
  };
  rexml = {
    groups = ["default" "test"];
@ -691,10 +691,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0444sgvx3ahvgr3c9swpy32kcdpciwgcqahp3pb4m7d23xp1qjdc";
+      sha256 = "10sq4aknch9rzpy8af77rqxk8rr59d33slg1kwg9h7fw9f1spmjn";
      type = "gem";
    };
-    version = "2.1.0";
+    version = "2.1.1";
  };
  rqrcode_core = {
    groups = ["default"];
@ -723,10 +723,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0x0xfq2mpg194rcanbjrgvjbh94s9kq72jynxx61789s628kxy59";
+      sha256 = "1bd2z82ly7fix8415gvfiwzb6bjialz5rs3sr72kv1lk68rd23wv";
      type = "gem";
    };
-    version = "1.12.0";
+    version = "1.16.0";
  };
  rubocop-performance = {
    dependencies = ["rubocop" "rubocop-ast"];
@ -781,15 +781,15 @@
    version = "2.3.2";
  };
  selenium-webdriver = {
-    dependencies = ["childprocess" "rubyzip"];
+    dependencies = ["childprocess" "rexml" "rubyzip"];
    groups = ["test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0adcvp86dinaqq3nhf8p3m0rl2g6q0a4h52k0i7kdnsg1qz9k86y";
+      sha256 = "17hilxa40cj7q48k6wcx1cbdb1v3q9c4nx89fji7gyqpcfm16vq7";
      type = "gem";
    };
-    version = "3.142.7";
+    version = "4.1.0";
  };
  simplecov = {
    dependencies = ["docile" "simplecov-html"];
@ -829,20 +829,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0mwmz36265646xqfyczgr1mhkm1hfxgxxvgdgr4xfcbf2g72p1k2";
+      sha256 = "1b9i14qb27zs56hlcc2hf139l0ghbqnjpmfi0054dxycaxvk5min";
      type = "gem";
    };
-    version = "3.2.2";
+    version = "3.4.2";
  };
  thor = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "18yhlvmfya23cs3pvhr1qy38y41b6mhr5q9vwv5lrgk16wmf3jna";
+      sha256 = "0inl77jh4ia03jw3iqm5ipr76ghal3hyjrd6r8zqsswwvi9j2xdi";
      type = "gem";
    };
-    version = "1.1.0";
+    version = "1.2.1";
  };
  thread_safe = {
    groups = ["default" "test"];
@ -881,10 +881,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1naymcfmm9pkf0f67xd99d9f6dpv477ggyvc1c04gxifirynfydp";
+      sha256 = "05fdb6z8541p912xanjbl9y15cyj6g44530y0nib6qhv6i90rkzp";
      type = "gem";
    };
-    version = "4.6.1";
+    version = "4.7.0";
+  };
+  webrick = {
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1d4cvgmxhfczxiq5fr534lmizkhigd15bsx5719r5ds7k7ivisc7";
+      type = "gem";
+    };
+    version = "1.7.0";
  };
  websocket-driver = {
    dependencies = ["websocket-extensions"];
@ -919,13 +929,14 @@
    version = "3.2.0";
  };
  yard = {
+    dependencies = ["webrick"];
    groups = ["development"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0qzr5j1a1cafv81ib3i51qyl8jnmwdxlqi3kbiraldzpbjh4ln9h";
+      sha256 = "0d08gkis1imlvppyh8dbslk89hwj5af2fmlzvmwahgx2bm48d9sn";
      type = "gem";
    };
-    version = "0.9.26";
+    version = "0.9.27";
  };
 }
--- a/pkgs/build-support/coq/default.nix
+++ b/pkgs/build-support/coq/default.nix
@ -16,6 +16,7 @@ in
  displayVersion ? {},
  release ? {},
  extraBuildInputs ? [],
+  extraNativeBuildInputs ? [],
  namePrefix ? [ "coq" ],
  enableParallelBuilding ? true,
  extraInstallFlags ? [],
@ -34,7 +35,7 @@ let
  args-to-remove = foldl (flip remove) ([
    "version" "fetcher" "repo" "owner" "domain" "releaseRev"
    "displayVersion" "defaultVersion" "useMelquiondRemake"
-    "release" "extraBuildInputs" "extraPropagatedBuildInputs" "namePrefix"
+    "release" "extraBuildInputs" "extraNativeBuildInputs" "extraPropagatedBuildInputs" "namePrefix"
    "meta" "useDune2ifVersion" "useDune2" "opam-name"
    "extraInstallFlags" "setCOQBIN" "mlPlugin"
    "dropAttrs" "dropDerivationAttrs" "keepAttrs" ] ++ dropAttrs) keepAttrs;
@ -67,9 +68,11 @@ stdenv.mkDerivation (removeAttrs ({

  inherit (fetched) version src;

-  buildInputs = [ coq ]
-    ++ optionals mlPlugin coq.ocamlBuildInputs
+  nativeBuildInputs = [ coq ]
    ++ optionals useDune2 [coq.ocaml coq.ocamlPackages.dune_2]
+    ++ optionals mlPlugin coq.ocamlNativeBuildInputs
+    ++ extraNativeBuildInputs;
+  buildInputs = optionals mlPlugin coq.ocamlBuildInputs
    ++ extraBuildInputs;
  inherit enableParallelBuilding;

--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@ -95,6 +95,9 @@ in
  # Doing the download on a remote machine just duplicates network
  # traffic, so don't do that by default
 , preferLocalBuild ? true
+
+  # Additional packages needed as part of a fetch
+, nativeBuildInputs ? [ ]
 }:

 assert sha512 != "" -> builtins.compareVersions "1.11" builtins.nixVersion <= 0;
@ -128,7 +131,7 @@ stdenvNoCC.mkDerivation {

  builder = ./builder.sh;

-  nativeBuildInputs = [ curl ];
+  nativeBuildInputs = [ curl ] ++ nativeBuildInputs;

  urls = urls_;

--- a/pkgs/build-support/fetchzip/default.nix
+++ b/pkgs/build-support/fetchzip/default.nix
@ -13,6 +13,7 @@
 , urls ? []
 , extraPostFetch ? ""
 , name ? "source"
+, nativeBuildInputs ? [ ]
 , # Allows to set the extension for the intermediate downloaded
  # file. This can be used as a hint for the unpackCmdHooks to select
  # an appropriate unpacking tool.
@ -31,6 +32,8 @@ in {

  downloadToTemp = true;

+  nativeBuildInputs = [ unzip ] ++ nativeBuildInputs;
+
  postFetch =
    ''
      unpackDir="$TMPDIR/unpack"
@ -64,7 +67,4 @@ in {
    + ''
      chmod 755 "$out"
    '';
-} // removeAttrs args [ "stripRoot" "extraPostFetch" "extension" ])).overrideAttrs (x: {
-  # Hackety-hack: we actually need unzip hooks, too
-  nativeBuildInputs = x.nativeBuildInputs ++ [ unzip ];
-})
+} // removeAttrs args [ "stripRoot" "extraPostFetch" "extension" "nativeBuildInputs" ]))
--- a/pkgs/desktops/gnome/core/gnome-tour/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-tour/default.nix
@ -22,11 +22,11 @@

 stdenv.mkDerivation rec {
  pname = "gnome-tour";
-  version = "40.0";
+  version = "40.1";

  src = fetchurl {
    url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-cGMiOGmgdHJ0FL7H23ONhQYhbuhMz8O8p9rFLkmMG/k=";
+    hash = "sha256-rYYS110B7qY8WcmY65KOvm75mEZgYbn8H97IKF02M5g=";
  };

  cargoVendorDir = "vendor";
--- a/pkgs/desktops/gnome/misc/gpaste/default.nix
+++ b/pkgs/desktops/gnome/misc/gpaste/default.nix
@ -17,14 +17,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "3.42.5";
+  version = "3.42.6";
  pname = "gpaste";

  src = fetchFromGitHub {
    owner = "Keruspe";
    repo = "GPaste";
    rev = "v${version}";
-    sha256 = "sha256-BpDA2V40V+VF2CB7ik+edMxrRtYSFnTQ48ec6pt8Jo4=";
+    sha256 = "sha256-dCeNWdHj3bBGJR1VpJtQjSn601Vdl3f9FjHAPB2wuhE=";
  };

  patches = [
--- a/pkgs/development/compilers/purescript/purescript/default.nix
+++ b/pkgs/development/compilers/purescript/purescript/default.nix
@ -18,7 +18,7 @@ let

 in stdenv.mkDerivation rec {
  pname = "purescript";
-  version = "0.14.5";
+  version = "0.14.6";

  # These hashes can be updated automatically by running the ./update.sh script.
  src =
@ -26,12 +26,12 @@ in stdenv.mkDerivation rec {
    then
    fetchurl {
      url = "https://github.com/${pname}/${pname}/releases/download/v${version}/macos.tar.gz";
-      sha256 = "1brvbpzr3cwls809fl0sjrm9cbh8v7maf5d7ic2mha0xapabgfpv";
+      sha256 = "0yfl4galaqzbbkql2vfsg4zrc5cv037286764kv8qibdk2yrhap3";
    }
    else
    fetchurl {
      url = "https://github.com/${pname}/${pname}/releases/download/v${version}/linux64.tar.gz";
-      sha256 = "1mvxvn30iyrq0ck6g08f925gxnnhbfgl29b2gjjsmm3m9mpll7ws";
+      sha256 = "01mf850a9jhqba6a3hsbl9fjxp2khplwnlr15wzp637s5vf7rd79";
    };


--- a/pkgs/development/coq-modules/QuickChick/default.nix
+++ b/pkgs/development/coq-modules/QuickChick/default.nix
@ -34,10 +34,10 @@ mkCoqDerivation {
    "substituteInPlace Makefile --replace quickChickTool.byte quickChickTool.native";

  mlPlugin = true;
+  extraNativeBuildInputs = lib.optional recent coq.ocamlPackages.ocamlbuild;
  extraBuildInputs = lib.optional recent coq.ocamlPackages.num;
  propagatedBuildInputs = [ ssreflect ]
-    ++ lib.optionals recent [ coq-ext-lib simple-io ]
-    ++ lib.optional recent coq.ocamlPackages.ocamlbuild;
+    ++ lib.optionals recent [ coq-ext-lib simple-io ];
  extraInstallFlags = [ "-f Makefile.coq" ];

  enableParallelBuilding = false;
--- a/pkgs/development/coq-modules/addition-chains/default.nix
+++ b/pkgs/development/coq-modules/addition-chains/default.nix
@ -1,4 +1,4 @@
-{ lib, mkCoqDerivation, coq, mathcomp-ssreflect, mathcomp-algebra, paramcoq
+{ lib, mkCoqDerivation, coq, mathcomp-ssreflect, mathcomp-algebra, mathcomp-fingroup, paramcoq
 , version ? null }:
 with lib;

@ -17,7 +17,7 @@ mkCoqDerivation {
    { case = range "8.11" "8.12"; out = "0.4"; }
  ] null;

-  propagatedBuildInputs = [ mathcomp-ssreflect mathcomp-algebra paramcoq ];
+  propagatedBuildInputs = [ mathcomp-ssreflect mathcomp-algebra mathcomp-fingroup paramcoq ];

  useDune2 = true;

--- a/pkgs/development/coq-modules/coq-bits/default.nix
+++ b/pkgs/development/coq-modules/coq-bits/default.nix
@ -22,6 +22,7 @@ with lib; mkCoqDerivation {
    };
  };

+  extraBuildInputs = [ mathcomp.ssreflect mathcomp.fingroup ];
  propagatedBuildInputs = [ mathcomp.algebra ];

  installPhase = ''
--- a/pkgs/development/coq-modules/coq-elpi/default.nix
+++ b/pkgs/development/coq-modules/coq-elpi/default.nix
@ -48,9 +48,8 @@ in mkCoqDerivation {
  release."1.6.0".sha256      = "0kf99i43mlf750fr7fric764mm495a53mg5kahnbp6zcjcxxrm0b";
  releaseRev = v: "v${v}";

-  nativeBuildInputs = [ which ];
+  extraNativeBuildInputs = [ which elpi ];
  mlPlugin = true;
-  extraBuildInputs = [ elpi ];

  meta = {
    description = "Coq plugin embedding ELPI.";
--- a/pkgs/development/coq-modules/coqtail-math/default.nix
+++ b/pkgs/development/coq-modules/coqtail-math/default.nix
@ -10,7 +10,7 @@ mkCoqDerivation {
  release."20201124".rev    = "5c22c3d7dcd8cf4c47cf84a281780f5915488e9e";
  release."20201124".sha256 = "sha256-wd+Lh7dpAD4zfpyKuztDmSFEZo5ZiFrR8ti2jUCVvoQ=";

-  buildInputs = with coq.ocamlPackages; [ ocaml findlib ];
+  extraNativeBuildInputs = with coq.ocamlPackages; [ ocaml findlib ];

  meta = {
    license = licenses.lgpl3Only;
--- a/pkgs/development/coq-modules/coquelicot/default.nix
+++ b/pkgs/development/coq-modules/coquelicot/default.nix
@ -16,7 +16,7 @@ with lib; mkCoqDerivation {
  release."3.0.2".sha256 = "1rqfbbskgz7b1bcpva8wh3v3456sq2364y804f94sc8y5sij23nl";
  releaseRev = v: "coquelicot-${v}";

-  nativeBuildInputs = [ which autoconf ];
+  extraNativeBuildInputs = [ which autoconf ];
  propagatedBuildInputs = [ ssreflect ];
  useMelquiondRemake.logpath = "Coquelicot";

--- a/pkgs/development/coq-modules/dpdgraph/default.nix
+++ b/pkgs/development/coq-modules/dpdgraph/default.nix
@ -39,7 +39,7 @@ mkCoqDerivation {
  release."0.6".sha256   = "0qvar8gfbrcs9fmvkph5asqz4l5fi63caykx3bsn8zf0xllkwv0n";
  releaseRev = v: "v${v}";

-  nativeBuildInputs = [ autoreconfHook ];
+  extraNativeBuildInputs = [ autoreconfHook ];
  mlPlugin = true;
  extraBuildInputs = [ coq.ocamlPackages.ocamlgraph ];

--- a/pkgs/development/coq-modules/fourcolor/default.nix
+++ b/pkgs/development/coq-modules/fourcolor/default.nix
@ -16,7 +16,7 @@ mkCoqDerivation {
    { cases = [ (isLe "8.13") (pred.inter (isGe "1.11.0") (isLt "1.13")) ]; out = "1.2.3"; }
  ] null;

-  propagatedBuildInputs = [ mathcomp.algebra ];
+  propagatedBuildInputs = [ mathcomp.algebra mathcomp.ssreflect mathcomp.fingroup ];

  meta = {
    description = "Formal proof of the Four Color Theorem ";
--- a/pkgs/development/coq-modules/gaia/default.nix
+++ b/pkgs/development/coq-modules/gaia/default.nix
@ -15,7 +15,7 @@ with lib; mkCoqDerivation {
  ] null;

  propagatedBuildInputs =
-    [ mathcomp.ssreflect mathcomp.algebra ];
+    [ mathcomp.ssreflect mathcomp.algebra mathcomp.fingroup ];

  meta = {
    description = "Implementation of books from Bourbaki's Elements of Mathematics in Coq";
--- a/pkgs/development/coq-modules/gappalib/default.nix
+++ b/pkgs/development/coq-modules/gappalib/default.nix
@ -12,7 +12,7 @@ with lib; mkCoqDerivation {
  release."1.4.4".sha256 = "114q2hgw64j6kqa9mg3qcp1nlf0ia46z2xadq81fnkxqm856ml7l";
  releaseRev = v: "gappalib-coq-${v}";

-  nativeBuildInputs = [ which autoconf ];
+  extraNativeBuildInputs = [ which autoconf ];
  mlPlugin = true;
  propagatedBuildInputs = [ flocq ];
  useMelquiondRemake.logpath = "Gappa";
--- a/pkgs/development/coq-modules/graph-theory/default.nix
+++ b/pkgs/development/coq-modules/graph-theory/default.nix
@ -1,4 +1,4 @@
-{ lib, mkCoqDerivation, coq, mathcomp-algebra, mathcomp-finmap
+{ lib, mkCoqDerivation, coq, mathcomp-algebra, mathcomp-finmap, mathcomp-fingroup
 , hierarchy-builder, version ? null }:

 with lib;
@ -15,7 +15,7 @@ mkCoqDerivation {
    { case = range "8.13" "8.14"; out = "0.9"; }
  ] null;

-  propagatedBuildInputs = [ mathcomp-algebra mathcomp-finmap hierarchy-builder ];
+  propagatedBuildInputs = [ mathcomp-algebra mathcomp-finmap mathcomp-fingroup hierarchy-builder ];

  meta = {
    description = "Library of formalized graph theory results in Coq";
--- a/pkgs/development/coq-modules/hierarchy-builder/default.nix
+++ b/pkgs/development/coq-modules/hierarchy-builder/default.nix
@ -17,7 +17,7 @@ with lib; let hb = mkCoqDerivation {
  release."0.10.0".sha256 = "1a3vry9nzavrlrdlq3cys3f8kpq3bz447q8c4c7lh2qal61wb32h";
  releaseRev = v: "v${v}";

-  nativeBuildInputs = [ which ];
+  extraNativeBuildInputs = [ which ];

  propagatedBuildInputs = [ coq-elpi ];

--- a/pkgs/development/coq-modules/interval/default.nix
+++ b/pkgs/development/coq-modules/interval/default.nix
@ -1,4 +1,4 @@
-{ lib, mkCoqDerivation, which, autoconf, coq, coquelicot, flocq, bignums ? null, gnuplot_qt, version ? null }:
+{ lib, mkCoqDerivation, which, autoconf, coq, coquelicot, flocq, mathcomp-ssreflect, mathcomp-fingroup, bignums ? null, gnuplot_qt, version ? null }:

 mkCoqDerivation rec {
  pname = "interval";
@ -20,8 +20,8 @@ mkCoqDerivation rec {
  release."3.3.0".sha256 = "0lz2hgggzn4cvklvm8rpaxvwaryf37i8mzqajqgdxdbd8f12acsz";
  releaseRev = v: "interval-${v}";

-  nativeBuildInputs = [ which autoconf ];
-  propagatedBuildInputs = [ bignums coquelicot flocq ]
+  extraNativeBuildInputs = [ which autoconf ];
+  propagatedBuildInputs = [ bignums coquelicot flocq mathcomp-ssreflect mathcomp-fingroup ]
    ++ lib.optionals (lib.versions.isGe "4.2.0" defaultVersion) [ gnuplot_qt ];
  useMelquiondRemake.logpath = "Interval";
  mlPlugin = true;
--- a/pkgs/development/coq-modules/itauto/default.nix
+++ b/pkgs/development/coq-modules/itauto/default.nix
@ -13,7 +13,7 @@ mkCoqDerivation rec {
  ] null;

  mlPlugin = true;
-  extraBuildInputs = (with coq.ocamlPackages; [ ocamlbuild ]);
+  extraNativeBuildInputs = (with coq.ocamlPackages; [ ocamlbuild ]);
  enableParallelBuilding = false;

  meta = {
--- a/pkgs/development/coq-modules/mathcomp-real-closed/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-real-closed/default.nix
@ -24,7 +24,14 @@ with lib; mkCoqDerivation {
      { cases = [ (isGe "8.7")   "1.7.0"  ]; out = "1.0.1"; }
    ] null;

-  propagatedBuildInputs = [ mathcomp.ssreflect mathcomp.field mathcomp-bigenough ];
+  propagatedBuildInputs = [
+    mathcomp.ssreflect
+    mathcomp.algebra
+    mathcomp.field
+    mathcomp.fingroup
+    mathcomp.solvable
+    mathcomp-bigenough
+  ];

  meta = {
    description = "Mathematical Components Library on real closed fields";
--- a/pkgs/development/coq-modules/mathcomp-word/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-word/default.nix
@ -17,7 +17,7 @@ mkCoqDerivation {
    { cases = [ (range "8.12" "8.14") (isGe "1.12") ]; out = "1.0"; }
  ] null;

-  propagatedBuildInputs = [ mathcomp.algebra ];
+  propagatedBuildInputs = [ mathcomp.algebra mathcomp.ssreflect mathcomp.fingroup ];

  meta = {
    description = "Yet Another Coq Library on Machine Words";
--- a/pkgs/development/coq-modules/mathcomp-zify/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-zify/default.nix
@ -1,4 +1,4 @@
-{ lib, mkCoqDerivation, coq, mathcomp-algebra, version ? null }:
+{ lib, mkCoqDerivation, coq, mathcomp-algebra, mathcomp-ssreflect,  mathcomp-fingroup, version ? null }:

 with lib; mkCoqDerivation rec {
  namePrefix = [ "coq" "mathcomp" ];
@ -15,7 +15,7 @@ with lib; mkCoqDerivation rec {
  release."1.0.0+1.12+8.13".sha256 = "1j533vx6lacr89bj1bf15l1a0s7rvrx4l00wyjv99aczkfbz6h6k";
  release."1.1.0+1.12+8.13".sha256 = "1plf4v6q5j7wvmd5gsqlpiy0vwlw6hy5daq2x42gqny23w9mi2pr";

-  propagatedBuildInputs = [ mathcomp-algebra ];
+  propagatedBuildInputs = [ mathcomp-algebra mathcomp-ssreflect mathcomp-fingroup ];

  meta = {
    description = "Micromega tactics for Mathematical Components";
--- a/pkgs/development/coq-modules/mathcomp/default.nix
+++ b/pkgs/development/coq-modules/mathcomp/default.nix
@ -59,10 +59,9 @@ let
      derivation = mkCoqDerivation ({
        inherit version pname defaultVersion release releaseRev repo owner;

-        nativeBuildInputs = optionals withDoc [ graphviz lua ];
        mlPlugin = versions.isLe "8.6" coq.coq-version;
-        extraBuildInputs = [ ncurses which ];
-        propagatedBuildInputs = mathcomp-deps;
+        extraNativeBuildInputs = [ which ] ++ optionals withDoc [ graphviz lua ];
+        extraBuildInputs = [ ncurses ] ++ mathcomp-deps;

        buildFlags = optional withDoc "doc";

--- a/pkgs/development/coq-modules/multinomials/default.nix
+++ b/pkgs/development/coq-modules/multinomials/default.nix
@ -38,7 +38,7 @@ with lib; mkCoqDerivation {
  '';

  propagatedBuildInputs =
-    [ mathcomp.ssreflect mathcomp.algebra mathcomp-finmap mathcomp-bigenough ];
+    [ mathcomp.ssreflect mathcomp.algebra mathcomp-finmap mathcomp.fingroup mathcomp-bigenough ];

  meta = {
    description = "A Coq/SSReflect Library for Monoidal Rings and Multinomials";
--- a/pkgs/development/coq-modules/odd-order/default.nix
+++ b/pkgs/development/coq-modules/odd-order/default.nix
@ -16,7 +16,15 @@ mkCoqDerivation {
    { case = (range "1.10.0" "1.12.0"); out = "1.12.0"; }
  ] null;

-  propagatedBuildInputs = [ mathcomp.character ];
+  propagatedBuildInputs = [
+    mathcomp.character
+    mathcomp.ssreflect
+    mathcomp.fingroup
+    mathcomp.algebra
+    mathcomp.solvable
+    mathcomp.field
+    mathcomp.all
+  ];

  meta = {
    description = "Formal proof of the Odd Order Theorem";
--- a/pkgs/development/coq-modules/semantics/default.nix
+++ b/pkgs/development/coq-modules/semantics/default.nix
@ -24,7 +24,8 @@ mkCoqDerivation rec {
  ] null;

  mlPlugin = true;
-  extraBuildInputs = (with coq.ocamlPackages; [ num ocamlbuild ]);
+  extraNativeBuildInputs = (with coq.ocamlPackages; [ ocamlbuild ]);
+  extraBuildInputs = (with coq.ocamlPackages; [ num ]);

  postPatch = ''
    for p in Make Makefile.coq.local
--- a/pkgs/development/coq-modules/simple-io/default.nix
+++ b/pkgs/development/coq-modules/simple-io/default.nix
@ -7,7 +7,7 @@ with lib; mkCoqDerivation {
  inherit version;
  defaultVersion = if versions.range "8.7" "8.13" coq.coq-version then "1.3.0" else null;
  release."1.3.0".sha256 = "1yp7ca36jyl9kz35ghxig45x6cd0bny2bpmy058359p94wc617ax";
-  extraBuildInputs = (with coq.ocamlPackages; [ ocaml ocamlbuild ]);
+  extraNativeBuildInputs = (with coq.ocamlPackages; [ ocaml ocamlbuild ]);
  propagatedBuildInputs = [ coq-ext-lib ];

  doCheck = true;
--- a/pkgs/development/libraries/flite/default.nix
+++ b/pkgs/development/libraries/flite/default.nix
@ -27,7 +27,9 @@ stdenv.mkDerivation rec {
    "--enable-shared"
  ] ++ lib.optionals stdenv.isLinux [ "--with-audio=alsa" ];

-  enableParallelBuilding = true;
+  # main/Makefile creates and removes 'flite_voice_list.c' from multiple targets:
+  # make[1]: *** No rule to make target 'flite_voice_list.c', needed by 'all'.  Stop
+  enableParallelBuilding = false;

  meta = with lib; {
    description = "A small, fast run-time speech synthesis engine";
--- a/pkgs/development/libraries/gegl/default.nix
+++ b/pkgs/development/libraries/gegl/default.nix
@ -36,14 +36,14 @@

 stdenv.mkDerivation rec {
  pname = "gegl";
-  version = "0.4.34";
+  version = "0.4.36";

  outputs = [ "out" "dev" "devdoc" ];
  outputBin = "dev";

  src = fetchurl {
    url = "https://download.gimp.org/pub/gegl/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-72PwvKW0McYRmt3YNMp/u1B8kAxIYcV7Nme29Mz8qqo=";
+    sha256 = "sha256-b9WKDNzHcCJYra7/tXOjiSKK6PDv9HV479ojCbYbLKY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/intel-media-sdk/default.nix
+++ b/pkgs/development/libraries/intel-media-sdk/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "intel-media-sdk";
-  version = "22.1.0";
+  version = "22.2.0";

  src = fetchFromGitHub {
    owner = "Intel-Media-SDK";
    repo = "MediaSDK";
    rev = "intel-mediasdk-${version}";
-    sha256 = "sha256-iISG947MUWVVAxykFwB5UK5Z4uQnEWJ6AFr/ZlHx4Nw=";
+    sha256 = "sha256-Hcm48KTuBQbnVHd/T5XqQKbVS/XgJ4TYNbSCc8O53XQ=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/development/libraries/live555/default.nix
+++ b/pkgs/development/libraries/live555/default.nix
@ -10,7 +10,7 @@

 stdenv.mkDerivation rec {
  pname = "live555";
-  version = "2022.01.21";
+  version = "2022.02.07";

  src = fetchurl {
    urls = [
@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
      "https://download.videolan.org/contrib/live555/live.${version}.tar.gz"
      "mirror://sourceforge/slackbuildsdirectlinks/live.${version}.tar.gz"
    ];
-    sha256 = "sha256-diV5wULbOrqMRDCyI9NjVaR6JUbYl9KWHUlvA/jjqQ4=";
+    sha256 = "sha256-bwwfinHOtQa8v5abArSww2l7ThXa623LqYcsh0XOksY=";
  };

  nativeBuildInputs = lib.optional stdenv.isDarwin darwin.cctools;
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@ -252,12 +252,14 @@ self = stdenv.mkDerivation {
    inherit (libglvnd) driverLink;
    inherit llvmPackages;

-    tests.devDoesNotDependOnLLVM = stdenv.mkDerivation {
-      name = "mesa-dev-does-not-depend-on-llvm";
-      buildCommand = ''
-        echo ${self.dev} >>$out
-      '';
-      disallowedRequisites = [ llvmPackages.llvm self.drivers ];
+    tests = lib.optionalAttrs stdenv.isLinux {
+      devDoesNotDependOnLLVM = stdenv.mkDerivation {
+        name = "mesa-dev-does-not-depend-on-llvm";
+        buildCommand = ''
+          echo ${self.dev} >>$out
+        '';
+        disallowedRequisites = [ llvmPackages.llvm self.drivers ];
+      };
    };
  };

--- a/pkgs/development/libraries/physics/hepmc3/default.nix
+++ b/pkgs/development/libraries/physics/hepmc3/default.nix
@ -9,11 +9,11 @@ in

 stdenv.mkDerivation rec {
  pname = "hepmc3";
-  version = "3.2.4";
+  version = "3.2.5";

  src = fetchurl {
    url = "http://hepmc.web.cern.ch/hepmc/releases/HepMC3-${version}.tar.gz";
-    sha256 = "sha256-4Ij8z9GmwvjhCJ9FcQG+4eXHqXd+nVHGQZyKKIpJ4bs=";
+    sha256 = "sha256-zQ91yA91VJxZzCqCns52Acd96Xyypat1eQysjh1YUDI=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/rubberband/default.nix
+++ b/pkgs/development/libraries/rubberband/default.nix
@ -12,6 +12,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ libsamplerate libsndfile fftw vamp-plugin-sdk ladspaH ];
+  makeFlags = [ "AR:=$(AR)" ];

  meta = with lib; {
    description = "High quality software library for audio time-stretching and pitch-shifting";
--- a/pkgs/development/libraries/science/math/or-tools/default.nix
+++ b/pkgs/development/libraries/science/math/or-tools/default.nix
@ -77,7 +77,8 @@ stdenv.mkDerivation rec {
    (cd temp_python/ortools; PYTHONPATH="$python/${python.sitePackages}:$PYTHONPATH" python setup.py install '--prefix=$python')
  '';

-  enableParallelBuilding = true;
+  # protobuf generation is not thread safe
+  enableParallelBuilding = false;

  nativeBuildInputs = [
    cmake
--- a/pkgs/development/libraries/wolfssl/default.nix
+++ b/pkgs/development/libraries/wolfssl/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "wolfssl";
-  version = "5.1.1";
+  version = "5.2.0";

  src = fetchFromGitHub {
    owner = "wolfSSL";
    repo = "wolfssl";
    rev = "v${version}-stable";
-    sha256 = "sha256-/noS5cn8lllWoGyZ9QyjRmdiR6LXzfT4lYGEt+0+Bdw=";
+    sha256 = "1xdhbhn31q7waw7w158hz9n0vj76zlfn5njq7hncf73ks38drj6k";
  };

  postPatch = ''
--- a/pkgs/development/ocaml-modules/pycaml/default.nix
+++ b/pkgs/development/ocaml-modules/pycaml/default.nix
@ -1,47 +0,0 @@
-{ lib, stdenv, fetchurl, ocaml, findlib, ncurses, python2, ocaml_make }:
-
-# This is the original pycaml version with patches from debian.
-
-stdenv.mkDerivation rec {
-  pname = "pycaml";
-  version = "0.82-14";
-
-  srcs = [
-    (fetchurl {
-      url = "mirror://debian/pool/main/p/pycaml/pycaml_${lib.versions.majorMinor version}.orig.tar.gz";
-      sha256 = "d57be559c8d586c575717d47817986bbdbcebe2ffd16ad6b291525c62868babe";
-    })
-
-    (fetchurl {
-      url = "mirror://debian/pool/main/p/pycaml/pycaml_${version}.debian.tar.gz";
-      sha256 = "a763088ec1fa76c769bf586ed6692e7ac035b0a2bfd48a90a8e7a9539ec0c2f1";
-    })
-  ];
-
-  postPatch = ''
-    rm -f Makefile* configure*
-    cp ../debian/META ../debian/Makefile .
-    sed -i "Makefile" -e's|/usr/share/ocamlmakefile/OCamlMakefile|${ocaml_make}/include/OCamlMakefile|g'
-  '';
-
-  sourceRoot = "pycaml";
-  patches = [ "../debian/patches/*.patch" ];
-
-  buildInputs = [ ncurses ocaml findlib python2 ocaml_make ];
-  createFindlibDestdir = true;
-
-  # the Makefile is not shipped with an install target, hence we do it ourselves.
-  installPhase = ''
-    ocamlfind install pycaml \
-     dllpycaml_stubs.so libpycaml_stubs.a pycaml.a pycaml.cma \
-     pycaml.cmi pycaml.cmo pycaml.cmx pycaml.cmxa \
-     META
-  '';
-
-  meta = {
-    homepage = "https://github.com/chemoelectric/pycaml";
-    description = "Bindings for python and ocaml";
-    license = "LGPL";
-    platforms = ocaml.meta.platforms or [ ];
-  };
-}
--- a/pkgs/development/python-modules/cupy/default.nix
+++ b/pkgs/development/python-modules/cupy/default.nix
@ -7,12 +7,12 @@

 buildPythonPackage rec {
  pname = "cupy";
-  version = "10.1.0";
+  version = "10.2.0";
  disabled = !isPy3k;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "ad28e7311b2023391f2278b7649828decdd9d9599848e18845eb4ab1b2d01936";
+    sha256 = "sha256-5ovvA76QGOsOnVztMfDgLerks5nJrKR08rLc+ArmWA8=";
  };

  preConfigure = ''
--- a/pkgs/development/python-modules/geojson-client/default.nix
+++ b/pkgs/development/python-modules/geojson-client/default.nix
@ -6,17 +6,21 @@
 , pytz
 , requests
 , pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "geojson-client";
-  version = "0.6";
+  version = "0.7";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "exxamalte";
    repo = "python-geojson-client";
    rev = "v${version}";
-    sha256 = "sha256-8eSLimCgFRn3cHTz5TE9fAUAbwFO72b23C0lg6fVOLQ=";
+    sha256 = "sha256-7EhdIfVM6d5fp6k+RdX6z33O5sZGeF/ThNkSXL8EjE8=";
  };

  propagatedBuildInputs = [
@ -26,9 +30,13 @@ buildPythonPackage rec {
    requests
  ];

-  checkInputs = [ pytestCheckHook ];
+  checkInputs = [
+    pytestCheckHook
+  ];

-  pythonImportsCheck = [ "geojson_client" ];
+  pythonImportsCheck = [
+    "geojson_client"
+  ];

  meta = with lib; {
    description = "Python module for convenient access to GeoJSON feeds";
--- a/pkgs/development/python-modules/google-cloud-bigtable/default.nix
+++ b/pkgs/development/python-modules/google-cloud-bigtable/default.nix
@ -8,15 +8,19 @@
 , mock
 , proto-plus
 , pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "google-cloud-bigtable";
-  version = "2.5.1";
+  version = "2.5.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-zqyLJX3ufjIpdiS7Qw85R6K/2p2m1KbYtmH2DH/r0nE=";
+    hash = "sha256-2ot8e34FbJ51dByIp+3Tq0OggpKbjqZAjwNxUZtnf0I=";
  };

  propagatedBuildInputs = [
@ -51,6 +55,6 @@ buildPythonPackage rec {
    description = "Google Cloud Bigtable API client library";
    homepage = "https://github.com/googleapis/python-bigtable";
    license = licenses.asl20;
-    maintainers = [ maintainers.costrouc ];
+    maintainers = with maintainers; [ costrouc ];
  };
 }
--- a/pkgs/development/python-modules/google-cloud-org-policy/default.nix
+++ b/pkgs/development/python-modules/google-cloud-org-policy/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "google-cloud-org-policy";
-  version = "1.2.1";
+  version = "1.3.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "cdb2d6878c426ed34af8950b052845a76b0f5fab3f96a2ec5dc80be994ca5cf8";
+    sha256 = "sha256-IbQP2/XMdwzmY3UgINiUvdd1Y1ABJkhh7x7x3kiR4Is=";
  };

  propagatedBuildInputs = [ google-api-core proto-plus ];
--- a/pkgs/development/python-modules/google-cloud-translate/default.nix
+++ b/pkgs/development/python-modules/google-cloud-translate/default.nix
@ -9,15 +9,19 @@
 , mock
 , proto-plus
 , pytest-asyncio
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "google-cloud-translate";
-  version = "3.6.1";
+  version = "3.7.0";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "38772cc60ef4315d25a7dbeef5ddab9e75674722cb4500bc69b295e5d0af6a97";
+    hash = "sha256-dJ+i8D2p5yz3jh1BwedE4/EZfsH2B3AHokuyedWK6Jc=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/jax/default.nix
+++ b/pkgs/development/python-modules/jax/default.nix
@ -1,8 +1,10 @@
 { lib
 , absl-py
+, blas
 , buildPythonPackage
 , fetchFromGitHub
 , jaxlib
+, lapack
 , numpy
 , opt-einsum
 , pytestCheckHook
@ -12,6 +14,9 @@
 , typing-extensions
 }:

+let
+  usingMKL = blas.implementation == "mkl" || lapack.implementation == "mkl";
+in
 buildPythonPackage rec {
  pname = "jax";
  version = "0.3.1";
@ -59,6 +64,9 @@ buildPythonPackage rec {
    "tests/"
  ];

+  # See https://github.com/google/jax/issues/9705.
+  disabledTests = lib.optionals usingMKL [ "test_custom_root_with_aux" ];
+
  pythonImportsCheck = [
    "jax"
  ];
--- a/pkgs/development/python-modules/meshtastic/default.nix
+++ b/pkgs/development/python-modules/meshtastic/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "meshtastic";
-  version = "1.2.85";
+  version = "1.2.87";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -27,7 +27,7 @@ buildPythonPackage rec {
    owner = "meshtastic";
    repo = "Meshtastic-python";
    rev = version;
-    sha256 = "sha256-DFRnyWBQ3/g5NwZH5hoVYJfj3gN/UP57JvNSnNaqws4=";
+    sha256 = "sha256-W56nTTbRcSRkT15xn24ywkIVNHRUavV5Z8EST3BFkjk=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/mlflow/default.nix
+++ b/pkgs/development/python-modules/mlflow/default.nix
@ -6,6 +6,7 @@
 , six
 , flask
 , numpy
+, scipy
 , pandas
 , python-dateutil
 , protobuf
@ -26,12 +27,12 @@

 buildPythonPackage rec {
  pname = "mlflow";
-  version = "1.22.0";
+  version = "1.23.1";
  disabled = isPy27;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "f680390715e436ae38cf7056ec91030fc9eb67cc631226f28ff9504fbe395add";
+    sha256 = "03rfyhli7vbb1pz0zw75mdwj9pz3awxi3dadxn5glpwn953w6r5y";
  };

  # run into https://stackoverflow.com/questions/51203641/attributeerror-module-alembic-context-has-no-attribute-config
@ -46,6 +47,7 @@ buildPythonPackage rec {
    six
    flask
    numpy
+    scipy
    pandas
    python-dateutil
    protobuf
@ -64,14 +66,7 @@ buildPythonPackage rec {
    importlib-metadata
  ];

-  patches = [
-    # Relex alembic version, https://github.com/mlflow/mlflow/pull/5245
-    (fetchpatch {
-      name = "relax-alembic-version.patch";
-      url = "https://github.com/mlflow/mlflow/commit/945eb4b67f315c0b2c4018b1df006fde910f115f.patch";
-      sha256 = "sha256-jETVEPzlNe0PvFZVOi1SwgJELfx/KCeq6REL3vl+YT0=";
-    })
-  ];
+  pythonImportsCheck = [ "mlflow" ];

  meta = with lib; {
    homepage = "https://github.com/mlflow/mlflow";
--- a/pkgs/development/python-modules/pglast/default.nix
+++ b/pkgs/development/python-modules/pglast/default.nix
@ -8,11 +8,11 @@

 buildPythonPackage rec {
  pname = "pglast";
-  version = "3.8";
+  version = "3.9";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "31ad29b6a27048b1a26c072992fc5213d2eaf366854679e6c97111e300e0ef01";
+    sha256 = "sha256-fwXOfQW+ybhROdgayOAsgaFjf8HHh5jr5xczkBnA40w=";
  };

  disabled = !isPy3k;
--- a/pkgs/development/python-modules/qiskit-finance/default.nix
+++ b/pkgs/development/python-modules/qiskit-finance/default.nix
@ -22,7 +22,7 @@

 buildPythonPackage rec {
  pname = "qiskit-finance";
-  version = "0.3.0";
+  version = "0.3.1";

  disabled = pythonOlder "3.6";

@ -30,7 +30,7 @@ buildPythonPackage rec {
    owner = "qiskit";
    repo = pname;
    rev = version;
-    sha256 = "1wpx519apnpp25yiq20warg4q8yv09x8fk0m8b9kyp199x86iffp";
+    sha256 = "sha256-wnto3IqrJFAqIv6QAXe3BB9fvXQXe2fw/iUZe3+198M=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/zcs/default.nix
+++ b/pkgs/development/python-modules/zcs/default.nix
@ -15,6 +15,10 @@ buildPythonPackage rec {
    sha256 = "sha256-ZoQgAaJy3kKHLljyKA0Oo/D1kefE8X9FlsGDSNt1nPw=";
  };

+  patches = [
+    ./fix-test-yaml.patch
+  ];
+
  propagatedBuildInputs = [ yacs ];

  pythonImportsCheck = [ "zcs" ];
--- a/pkgs/development/python-modules/zcs/fix-test-yaml.patch
+++ b/pkgs/development/python-modules/zcs/fix-test-yaml.patch
@ -0,0 +1,13 @@
+diff --git a/test/test_zcs.py b/test/test_zcs.py
+index e4981d3..893999f 100644
+--- a/test/test_zcs.py
+++ b/test/test_zcs.py
+@@ -65,7 +65,7 @@ class TestCfgNode(unittest.TestCase):
+         cfg = self.cfg.clone()
+         yamlp = pathjoin(tmpboxx(), "test.yaml")
+         cfg.dump(yamlp)
+-        cfg_dict = yaml.load(open(yamlp))
+        cfg_dict = yaml.load(open(yamlp), yaml.Loader)
+         cfgd = CfgNode(cfg_dict)
+         self.assertTrue(str(cfg.dump()) == str(cfgd.dump()))
+ 
--- a/pkgs/development/python-modules/zict/default.nix
+++ b/pkgs/development/python-modules/zict/default.nix
@ -3,11 +3,11 @@

 buildPythonPackage rec {
  pname = "zict";
-  version = "2.0.0";
+  version = "2.1.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "8e2969797627c8a663575c2fc6fcb53a05e37cdb83ee65f341fc6e0c3d0ced16";
+    sha256 = "sha256-FbLMFflaR2++BiP9j3ceHncTEL96AflUEqC2BbbkdRA=";
  };

  disabled = pythonOlder "3.6";
--- a/pkgs/development/python2-modules/gtkme/default.nix
+++ b/pkgs/development/python2-modules/gtkme/default.nix
@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pkg-config
+, gobject-introspection
+, pygobject3
+, gtk3
+, glib
+}:
+
+buildPythonPackage rec {
+  pname = "gtkme";
+  version = "1.5.3";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-NIUgnbfcHjbPfsH3CF2Bywo8owrdsi1wqDoMxOa+2U4=";
+  };
+
+  nativeBuildInputs = [ pkg-config gobject-introspection gtk3 ];
+  buildInputs = [ pygobject3 glib ];
+  propagatedBuildInputs = [ gtk3 ];
+
+  pythonImportsCheck = [
+    "gtkme"
+  ];
+
+  meta = with lib; {
+    description = "Manages an Application with Gtk windows, forms, lists and other complex items easily";
+    homepage = "https://gitlab.com/doctormo/gtkme";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [
+      revol-xut
+    ];
+  };
+}
--- a/pkgs/development/tools/amazon-qldb-shell/default.nix
+++ b/pkgs/development/tools/amazon-qldb-shell/default.nix
@ -9,7 +9,7 @@

 let
  pname = "amazon-qldb-shell";
-  version = "2.0.0";
+  version = "2.0.1";
  package = rustPlatform.buildRustPackage {
    inherit pname version;

@ -17,13 +17,13 @@ let
      owner = "awslabs";
      repo = pname;
      rev = "v${version}";
-      sha256 = "sha256-Pnm1HxEjjNKpS3tTymtOXxUF7EEnWM+7WBsqeaG8seA=";
+      sha256 = "sha256-aXScqJ1LijMSAy9YkS5QyXtTqxd19lLt3BbyVXlbw8o=";
    };

    nativeBuildInputs = [ clang cmake ];
    buildInputs = [ llvmPackages.libclang ];

-    cargoSha256 = "sha256-EUqGSKcGnhrdLn8ystaLkkR31RjEvjW6vRzKPMK77e8=";
+    cargoSha256 = "sha256-y3dNEa2U9mwsENPda44zweszlk4UJXGtfeH+er8mi0U=";

    LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";

@ -34,6 +34,7 @@ let
      homepage = "https://github.com/awslabs/amazon-qldb-shell";
      license = licenses.asl20;
      maintainers = [ maintainers.terlar ];
+      mainProgram = "qldb";
    };
  };
 in
--- a/pkgs/development/tools/analysis/actionlint/default.nix
+++ b/pkgs/development/tools/analysis/actionlint/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "actionlint";
-  version = "1.6.8";
+  version = "1.6.9";

  subPackages = [ "cmd/actionlint" ];

@ -10,7 +10,7 @@ buildGoModule rec {
    owner = "rhysd";
    repo = "actionlint";
    rev = "v${version}";
-    sha256 = "sha256-wjLY40bxpoMk6YIG/4KbjxSWUDVNn3cX5OcsgfEPjzk=";
+    sha256 = "sha256-UDa/qFtRTED6d+lPbjNknX9qFZ3QZ9jiD0ByvLsGARk=";
  };

  vendorSha256 = "sha256-0tytdTZxnWYl8AxaquF0ArY3dy51j8H2kzw69qcSHzk=";
--- a/Show More
+++ b/Show More