Merge master into haskell-updates

lib/modules.nix

@@ -138,7 +138,7 @@ rec {
             # support for that, in turn it's lazy in its values. This means e.g.
             # a `_module.args.pkgs = import (fetchTarball { ... }) {}` won't
             # start a download when `pkgs` wasn't evaluated.
-            type = types.lazyAttrsOf types.unspecified;
+            type = types.lazyAttrsOf types.raw;
             internal = true;
             description = "Arguments passed to each module.";
           };

lib/tests/modules.sh

@@ -293,6 +293,12 @@ checkConfigOutput "{ }" config.submodule.a ./emptyValues.nix
 checkConfigError 'The option .int.a. is used but not defined' config.int.a ./emptyValues.nix
 checkConfigError 'The option .nonEmptyList.a. is used but not defined' config.nonEmptyList.a ./emptyValues.nix
 
+## types.raw
+checkConfigOutput "{ foo = <CODE>; }" config.unprocessedNesting ./raw.nix
+checkConfigOutput "10" config.processedToplevel ./raw.nix
+checkConfigError "The option .multiple. is defined multiple times" config.multiple ./raw.nix
+checkConfigOutput "bar" config.priorities ./raw.nix
+
 cat <<EOF
 ====== module tests ======
 $pass Pass

lib/tests/modules/raw.nix

@@ -0,0 +1,30 @@
+{ lib, ... }: {
+
+  options = {
+    processedToplevel = lib.mkOption {
+      type = lib.types.raw;
+    };
+    unprocessedNesting = lib.mkOption {
+      type = lib.types.raw;
+    };
+    multiple = lib.mkOption {
+      type = lib.types.raw;
+    };
+    priorities = lib.mkOption {
+      type = lib.types.raw;
+    };
+  };
+
+  config = {
+    processedToplevel = lib.mkIf true 10;
+    unprocessedNesting.foo = throw "foo";
+    multiple = lib.mkMerge [
+      "foo"
+      "foo"
+    ];
+    priorities = lib.mkMerge [
+      "foo"
+      (lib.mkForce "bar")
+    ];
+  };
+}

lib/types.nix

@@ -162,6 +162,13 @@ rec {
   # nixos/doc/manual/development/option-types.xml!
   types = rec {
 
+    raw = mkOptionType rec {
+      name = "raw";
+      description = "raw value";
+      check = value: true;
+      merge = mergeOneOption;
+    };
+
     anything = mkOptionType {
       name = "anything";
       description = "anything";

maintainers/maintainer-list.nix

@@ -6524,7 +6524,7 @@
     githubId = 18447310;
   };
   kloenk = {
-    email = "me@kloenk.de";
+    email = "me@kloenk.dev";
     matrix = "@kloenk:petabyte.dev";
     name = "Finn Behrens";
     github = "kloenk";
@@ -9253,6 +9253,12 @@
     githubId = 15930073;
     name = "Moritz Scheuren";
   };
+  ozkutuk = {
+    email = "ozkutuk@protonmail.com";
+    github = "ozkutuk";
+    githubId = 5948762;
+    name = "Berk Özkütük";
+  };
   pablovsky = {
     email = "dealberapablo07@gmail.com";
     github = "pablo1107";
@@ -11547,6 +11553,12 @@
     githubId = 1699155;
     name = "Steve Elliott";
   };
+  stehessel = {
+      email = "stephan@stehessel.de";
+      github = "stehessel";
+      githubId = 55607356;
+      name = "Stephan Heßelmann";
+  };
   stelcodes = {
     email = "stel@stel.codes";
     github = "stelcodes";

maintainers/scripts/remove-old-aliases.py

@@ -0,0 +1,202 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i python3 -p "python3.withPackages(ps: with ps; [ ])" nix
+"""
+A program to remove old aliases or convert old aliases to throws
+Example usage:
+./maintainers/scripts/remove-old-aliases.py --year 2018 --file ./pkgs/top-level/aliases.nix
+
+Check this file with mypy after every change!
+$ mypy --strict maintainers/scripts/remove-old-aliases.py
+"""
+import argparse
+import shutil
+import subprocess
+from datetime import date as datetimedate
+from datetime import datetime
+from pathlib import Path
+
+
+def process_args() -> argparse.Namespace:
+    """process args"""
+    arg_parser = argparse.ArgumentParser()
+    arg_parser.add_argument(
+        "--year", required=True, type=int, help="operate on aliases older than $year"
+    )
+    arg_parser.add_argument(
+        "--month",
+        type=int,
+        default=1,
+        help="operate on aliases older than $year-$month",
+    )
+    arg_parser.add_argument("--file", required=True, type=Path, help="alias file")
+    arg_parser.add_argument(
+        "--dry-run", action="store_true", help="don't modify files, only print results"
+    )
+    return arg_parser.parse_args()
+
+
+def get_date_lists(
+    txt: list[str], cutoffdate: datetimedate
+) -> tuple[list[str], list[str], list[str]]:
+    """get a list of lines in which the date is older than $cutoffdate"""
+    date_older_list: list[str] = []
+    date_older_throw_list: list[str] = []
+    date_sep_line_list: list[str] = []
+
+    for lineno, line in enumerate(txt, start=1):
+        line = line.rstrip()
+        my_date = None
+        for string in line.split():
+            string = string.strip(":")
+            try:
+                # strip ':' incase there is a string like 2019-11-01:
+                my_date = datetime.strptime(string, "%Y-%m-%d").date()
+            except ValueError:
+                try:
+                    my_date = datetime.strptime(string, "%Y-%m").date()
+                except ValueError:
+                    continue
+
+        if my_date is None or my_date > cutoffdate:
+            continue
+
+        if "=" not in line:
+            date_sep_line_list.append(f"{lineno} {line}")
+        # 'if' lines could be complicated
+        elif "if " in line and "if =" not in line:
+            print(f"RESOLVE MANUALLY {line}")
+        elif "throw" in line:
+            date_older_throw_list.append(line)
+        else:
+            date_older_list.append(line)
+
+    return (
+        date_older_list,
+        date_sep_line_list,
+        date_older_throw_list,
+    )
+
+
+def convert_to_throw(date_older_list: list[str]) -> list[tuple[str, str]]:
+    """convert a list of lines to throws"""
+    converted_list = []
+    for line in date_older_list.copy():
+        indent: str = " " * (len(line) - len(line.lstrip()))
+        before_equal = ""
+        after_equal = ""
+        try:
+            before_equal, after_equal = (x.strip() for x in line.split("=", maxsplit=2))
+        except ValueError as err:
+            print(err, line, "\n")
+            date_older_list.remove(line)
+            continue
+
+        alias = before_equal.strip()
+        after_equal_list = [x.strip(";:") for x in after_equal.split()]
+
+        converted = (
+            f"{indent}{alias} = throw \"'{alias}' has been renamed to/replaced by"
+            f" '{after_equal_list.pop(0)}'\";"
+            f' # Converted to throw {datetime.today().strftime("%Y-%m-%d")}'
+        )
+        converted_list.append((line, converted))
+
+    return converted_list
+
+
+def generate_text_to_write(
+    txt: list[str],
+    date_older_list: list[str],
+    converted_to_throw: list[tuple[str, str]],
+    date_older_throw_list: list[str],
+) -> list[str]:
+    """generate a list of text to be written to the aliasfile"""
+    text_to_write: list[str] = []
+    for line in txt:
+        text_to_append: str = ""
+        if converted_to_throw:
+            for tupl in converted_to_throw:
+                if line == tupl[0]:
+                    text_to_append = f"{tupl[1]}\n"
+        if line not in date_older_list and line not in date_older_throw_list:
+            text_to_append = f"{line}\n"
+        if text_to_append:
+            text_to_write.append(text_to_append)
+
+    return text_to_write
+
+
+def write_file(
+    aliasfile: Path,
+    text_to_write: list[str],
+) -> None:
+    """write file"""
+    temp_aliasfile = Path(f"{aliasfile}.raliases")
+    with open(temp_aliasfile, "w", encoding="utf-8") as far:
+        for line in text_to_write:
+            far.write(line)
+    print("\nChecking the syntax of the new aliasfile")
+    try:
+        subprocess.run(
+            ["nix-instantiate", "--eval", temp_aliasfile],
+            check=True,
+            stdout=subprocess.DEVNULL,
+        )
+    except subprocess.CalledProcessError:
+        print(
+            "\nSyntax check failed,",
+            "there may have been a line which only has\n"
+            'aliasname = "reason why";\n'
+            "when it should have been\n"
+            'aliasname = throw "reason why";',
+        )
+        temp_aliasfile.unlink()
+        return
+    shutil.move(f"{aliasfile}.raliases", aliasfile)
+    print(f"{aliasfile} modified! please verify with 'git diff'.")
+
+
+def main() -> None:
+    """main"""
+    args = process_args()
+
+    aliasfile = Path(args.file).absolute()
+    cutoffdate = (datetime.strptime(f"{args.year}-{args.month}-01", "%Y-%m-%d")).date()
+
+    txt: list[str] = (aliasfile.read_text(encoding="utf-8")).splitlines()
+
+    date_older_list: list[str] = []
+    date_sep_line_list: list[str] = []
+    date_older_throw_list: list[str] = []
+
+    date_older_list, date_sep_line_list, date_older_throw_list = get_date_lists(
+        txt, cutoffdate
+    )
+
+    converted_to_throw: list[tuple[str, str]] = []
+    converted_to_throw = convert_to_throw(date_older_list)
+
+    if date_older_list:
+        print(" Will be converted to throws. ".center(100, "-"))
+        for l_n in date_older_list:
+            print(l_n)
+
+    if date_older_throw_list:
+        print(" Will be removed. ".center(100, "-"))
+        for l_n in date_older_throw_list:
+            print(l_n)
+
+    if date_sep_line_list:
+        print(" On separate line, resolve manually. ".center(100, "-"))
+        for l_n in date_sep_line_list:
+            print(l_n)
+
+    if not args.dry_run:
+        text_to_write = generate_text_to_write(
+            txt, date_older_list, converted_to_throw, date_older_throw_list
+        )
+        write_file(aliasfile, text_to_write)
+
+
+if __name__ == "__main__":
+    main()

maintainers/scripts/update.nix

@@ -147,7 +147,7 @@ let
 
     to run update script for specific package, or
 
-        % nix-shell maintainers/scripts/update.nix --arg predicate '(path: pkg: builtins.isList pkg.updateScript && builtins.length pkg.updateScript >= 1 && (let script = builtins.head pkg.updateScript; in builtins.isAttrs script && script.name == "gnome-update-script"))'
+        % nix-shell maintainers/scripts/update.nix --arg predicate '(path: pkg: pkg.updateScript.name or null == "gnome-update-script")'
 
     to run update script for all packages matching given predicate, or
 

maintainers/scripts/update.py

@@ -88,6 +88,10 @@ async def commit_changes(name: str, merge_lock: asyncio.Lock, worktree: str, bra
         async with merge_lock:
             await check_subprocess('git', 'add', *change['files'], cwd=worktree)
             commit_message = '{attrPath}: {oldVersion} → {newVersion}'.format(**change)
+            if 'commitMessage' in change:
+                commit_message = change['commitMessage']
+            elif 'commitBody' in change:
+                commit_message = commit_message + '\n\n' + change['commitBody']
             await check_subprocess('git', 'commit', '--quiet', '-m', commit_message, cwd=worktree)
             await check_subprocess('git', 'cherry-pick', branch)
 

nixos/doc/manual/development/option-types.section.md

@@ -63,6 +63,17 @@ merging is handled.
     ```
     :::
 
+`types.raw`
+
+:   A type which doesn't do any checking, merging or nested evaluation. It
+    accepts a single arbitrary value that is not recursed into, making it
+    useful for values coming from outside the module system, such as package
+    sets or arbitrary data. Options of this type are still evaluated according
+    to priorities and conditionals, so `mkForce`, `mkIf` and co. still work on
+    the option value itself, but not for any value nested within it. This type
+    should only be used when checking, merging and nested evaluation are not
+    desirable.
+
 `types.attrs`
 
 :   A free-form attribute set.

nixos/doc/manual/from_md/development/option-types.section.xml

@@ -92,6 +92,25 @@
 </programlisting>
         </listitem>
       </varlistentry>
+      <varlistentry>
+        <term>
+          <literal>types.raw</literal>
+        </term>
+        <listitem>
+          <para>
+            A type which doesn’t do any checking, merging or nested
+            evaluation. It accepts a single arbitrary value that is not
+            recursed into, making it useful for values coming from
+            outside the module system, such as package sets or arbitrary
+            data. Options of this type are still evaluated according to
+            priorities and conditionals, so <literal>mkForce</literal>,
+            <literal>mkIf</literal> and co. still work on the option
+            value itself, but not for any value nested within it. This
+            type should only be used when checking, merging and nested
+            evaluation are not desirable.
+          </para>
+        </listitem>
+      </varlistentry>
       <varlistentry>
         <term>
           <literal>types.attrs</literal>

nixos/doc/manual/from_md/release-notes/rl-2111.section.xml

@@ -1429,6 +1429,17 @@ Superuser created successfully.
           knob.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>/usr</literal> will always be included in the initial
+          ramdisk. See the
+          <literal>fileSystems.&lt;name&gt;.neededForBoot</literal>
+          option. If any files exist under <literal>/usr</literal>
+          (which is not typical for NixOS), they will be included in the
+          initial ramdisk, increasing its size to a possibly problematic
+          extent.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
   <section xml:id="sec-release-21.11-notable-changes">

nixos/doc/manual/from_md/release-notes/rl-2205.section.xml

@@ -932,6 +932,14 @@
           renamed to <literal>linux-firmware</literal>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          It is now possible to specify wordlists to include as handy to
+          access environment variables using the
+          <literal>config.environment.wordlist</literal> configuration
+          options.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The <literal>services.mbpfan</literal> module was converted to
@@ -970,6 +978,13 @@
           Plugins are automatically repackaged using autoPatchelf.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <literal>services.logrotate.enable</literal> now defaults to
+          true if any rotate path has been defined, and some paths have
+          been added by default.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The <literal>zrepl</literal> package has been updated from

nixos/doc/manual/release-notes/rl-2111.section.md

@@ -419,6 +419,9 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The Linux kernel for security reasons now restricts access to BPF syscalls via `BPF_UNPRIV_DEFAULT_OFF=y`. Unprivileged access can be reenabled via the `kernel.unprivileged_bpf_disabled` sysctl knob.
 
+- `/usr` will always be included in the initial ramdisk. See the `fileSystems.<name>.neededForBoot` option.
+  If any files exist under `/usr` (which is not typical for NixOS), they will be included in the initial ramdisk, increasing its size to a possibly problematic extent.
+
 ## Other Notable Changes {#sec-release-21.11-notable-changes}
 
 

nixos/doc/manual/release-notes/rl-2205.section.md

@@ -311,6 +311,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - The `firmwareLinuxNonfree` package has been renamed to `linux-firmware`.
 
+- It is now possible to specify wordlists to include as handy to access environment variables using the `config.environment.wordlist` configuration options.
+
 - The `services.mbpfan` module was converted to a [RFC 0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration.
 
 - The default value for `programs.spacefm.settings.graphical_su` got unset. It previously pointed to `gksu` which has been removed.
@@ -323,6 +325,9 @@ In addition to numerous new and upgraded packages, this release has the followin
 - `services.mattermost.plugins` has been added to allow the declarative installation of Mattermost plugins.
   Plugins are automatically repackaged using autoPatchelf.
 
+- `services.logrotate.enable` now defaults to true if any rotate path has
+  been defined, and some paths have been added by default.
+
 - The `zrepl` package has been updated from 0.4.0 to 0.5:
 
   - The RPC protocol version was bumped; all zrepl daemons in a setup must be updated and restarted before replication can resume.

nixos/modules/misc/ids.nix

@@ -82,7 +82,7 @@ in
       git = 41;
       #fourstore = 42; # dropped in 20.03
       #fourstorehttp = 43; # dropped in 20.03
-      virtuoso = 44;
+      #virtuoso = 44;  dropped module
       #rtkit = 45; # dynamically allocated 2021-09-03
       dovecot2 = 46;
       dovenull2 = 47;

nixos/modules/misc/wordlist.nix

@@ -0,0 +1,59 @@
+{ config, lib, pkgs, ... }:
+with lib;
+let
+  concatAndSort = name: files: pkgs.runCommand name {} ''
+    awk 1 ${lib.escapeShellArgs files} | sed '{ /^\s*$/d; s/^\s\+//; s/\s\+$// }' | sort | uniq > $out
+  '';
+in
+{
+  options = {
+    environment.wordlist = {
+      enable = mkEnableOption "environment variables for lists of words";
+
+      lists = mkOption {
+        type = types.attrsOf (types.nonEmptyListOf types.path);
+
+        default = {
+          WORDLIST = [ "${pkgs.scowl}/share/dict/words.txt" ];
+        };
+
+        defaultText = literalExpression ''
+          {
+            WORDLIST = [ "''${pkgs.scowl}/share/dict/words.txt" ];
+          }
+        '';
+
+        description = ''
+          A set with the key names being the environment variable you'd like to
+          set and the values being a list of paths to text documents containing
+          lists of words. The various files will be merged, sorted, duplicates
+          removed, and extraneous spacing removed.
+
+          If you have a handful of words that you want to add to an already
+          existing wordlist, you may find `builtins.toFile` useful for this
+          task.
+        '';
+
+        example = literalExpression ''
+          {
+            WORDLIST = [ "''${pkgs.scowl}/share/dict/words.txt" ];
+            AUGMENTED_WORDLIST = [
+              "''${pkgs.scowl}/share/dict/words.txt"
+              "''${pkgs.scowl}/share/dict/words.variants.txt"
+              (builtins.toFile "extra-words" '''
+                desynchonization
+                oobleck''')
+            ];
+          }
+        '';
+      };
+    };
+  };
+
+  config = mkIf config.environment.wordlist.enable {
+    environment.variables =
+      lib.mapAttrs
+        (name: value: "${concatAndSort "wordlist-${name}" value}")
+        config.environment.wordlist.lists;
+  };
+}

nixos/modules/module-list.nix

@@ -115,6 +115,7 @@
   ./misc/nixpkgs.nix
   ./misc/passthru.nix
   ./misc/version.nix
+  ./misc/wordlist.nix
   ./misc/nixops-autoluks.nix
   ./programs/adb.nix
   ./programs/appgate-sdp.nix
@@ -349,7 +350,6 @@
   ./services/databases/redis.nix
   ./services/databases/riak.nix
   ./services/databases/victoriametrics.nix
-  ./services/databases/virtuoso.nix
   ./services/desktops/accountsservice.nix
   ./services/desktops/bamf.nix
   ./services/desktops/blueman.nix

nixos/modules/rename.nix

@@ -87,10 +87,9 @@ with lib;
     (mkRemovedOptionModule [ "services" "racoon" ] ''
       The racoon module has been removed, because the software project was abandoned upstream.
     '')
-
     (mkRemovedOptionModule [ "services" "shellinabox" ] "The corresponding package was removed from nixpkgs.")
-
     (mkRemovedOptionModule [ "services" "gogoclient" ] "The corresponding package was removed from nixpkgs.")
+    (mkRemovedOptionModule [ "services" "virtuoso" ] "The corresponding package was removed from nixpkgs.")
 
     # Do NOT add any option renames here, see top of the file
   ];

nixos/modules/services/databases/virtuoso.nix

@@ -1,99 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.virtuoso;
-  virtuosoUser = "virtuoso";
-  stateDir = "/var/lib/virtuoso";
-in
-with lib;
-{
-
-  ###### interface
-
-  options = {
-
-    services.virtuoso = {
-
-      enable = mkEnableOption "Virtuoso Opensource database server";
-
-      config = mkOption {
-        type = types.lines;
-        default = "";
-        description = "Extra options to put into Virtuoso configuration file.";
-      };
-
-      parameters = mkOption {
-        type = types.lines;
-        default = "";
-        description = "Extra options to put into [Parameters] section of Virtuoso configuration file.";
-      };
-
-      listenAddress = mkOption {
-        type = types.str;
-        default = "1111";
-        example = "myserver:1323";
-        description = "ip:port or port to listen on.";
-      };
-
-      httpListenAddress = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = "myserver:8080";
-        description = "ip:port or port for Virtuoso HTTP server to listen on.";
-      };
-
-      dirsAllowed = mkOption {
-        type = types.nullOr types.str; # XXX Maybe use a list in the future?
-        default = null;
-        example = "/www, /home/";
-        description = "A list of directories Virtuoso is allowed to access";
-      };
-    };
-
-  };
-
-
-  ###### implementation
-
-  config = mkIf cfg.enable {
-
-    users.users.${virtuosoUser} =
-      { uid = config.ids.uids.virtuoso;
-        description = "virtuoso user";
-        home = stateDir;
-      };
-
-    systemd.services.virtuoso = {
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-
-      preStart = ''
-        mkdir -p ${stateDir}
-        chown ${virtuosoUser} ${stateDir}
-      '';
-
-      script = ''
-        cd ${stateDir}
-        ${pkgs.virtuoso}/bin/virtuoso-t +foreground +configfile ${pkgs.writeText "virtuoso.ini" cfg.config}
-      '';
-    };
-
-    services.virtuoso.config = ''
-      [Database]
-      DatabaseFile=${stateDir}/x-virtuoso.db
-      TransactionFile=${stateDir}/x-virtuoso.trx
-      ErrorLogFile=${stateDir}/x-virtuoso.log
-      xa_persistent_file=${stateDir}/x-virtuoso.pxa
-
-      [Parameters]
-      ServerPort=${cfg.listenAddress}
-      RunAs=${virtuosoUser}
-      ${optionalString (cfg.dirsAllowed != null) "DirsAllowed=${cfg.dirsAllowed}"}
-      ${cfg.parameters}
-
-      [HTTPServer]
-      ${optionalString (cfg.httpListenAddress != null) "ServerPort=${cfg.httpListenAddress}"}
-    '';
-
-  };
-
-}

nixos/modules/services/logging/logrotate.nix

@@ -4,7 +4,6 @@ with lib;
 
 let
   cfg = config.services.logrotate;
-  inherit (config.users) groups;
 
   pathOpts = { name, ... }:  {
     options = {
@@ -85,10 +84,6 @@ let
     };
 
     config.name = name;
-    config.extraConfig = ''
-      missingok
-      notifempty
-    '';
   };
 
   mkConf = pathOpts: ''
@@ -102,7 +97,11 @@ let
   '';
 
   paths = sortProperties (attrValues (filterAttrs (_: pathOpts: pathOpts.enable) cfg.paths));
-  configFile = pkgs.writeText "logrotate.conf" (concatStringsSep "\n" ((map mkConf paths) ++ [ cfg.extraConfig ]));
+  configFile = pkgs.writeText "logrotate.conf" (
+    concatStringsSep "\n" (
+      [ "missingok" "notifempty" cfg.extraConfig ] ++ (map mkConf paths)
+    )
+  );
 
 in
 {
@@ -112,7 +111,10 @@ in
 
   options = {
     services.logrotate = {
-      enable = mkEnableOption "the logrotate systemd service";
+      enable = mkEnableOption "the logrotate systemd service" // {
+        default = foldr (n: a: a || n.enable) false (attrValues cfg.paths);
+        defaultText = literalExpression "cfg.paths != {}";
+      };
 
       paths = mkOption {
         type = with types; attrsOf (submodule pathOpts);
@@ -163,25 +165,6 @@ in
       }
     ) cfg.paths;
 
-    services.logrotate = {
-      paths = {
-        "/var/log/btmp" = {
-          frequency = mkDefault "monthly";
-          keep = mkDefault 1;
-          extraConfig = ''
-            create 0660 root ${groups.utmp.name}
-          '';
-        };
-        "/var/log/wtmp" = {
-          frequency = mkDefault "monthly";
-          keep = mkDefault 1;
-          extraConfig = ''
-            create 0664 root ${groups.utmp.name}
-          '';
-        };
-      };
-    };
-
     systemd.services.logrotate = {
       description = "Logrotate Service";
       wantedBy = [ "multi-user.target" ];

nixos/modules/services/misc/plex.nix

@@ -55,6 +55,19 @@ in
           symlinks in Plex's plugin directory will be cleared and this module
           will symlink all of the paths specified here to that directory.
         '';
+        example = literalExpression ''
+          [
+            (builtins.path {
+              name = "Audnexus.bundle";
+              path = pkgs.fetchFromGitHub {
+                owner = "djdembeck";
+                repo = "Audnexus.bundle";
+                rev = "v0.2.8";
+                sha256 = "sha256-IWOSz3vYL7zhdHan468xNc6C/eQ2C2BukQlaJNLXh7E=";
+              };
+            })
+          ]
+        '';
       };
 
       extraScanners = mkOption {

nixos/modules/services/security/vaultwarden/default.nix

@@ -151,7 +151,7 @@ in {
     };
 
     systemd.services.backup-vaultwarden = mkIf (cfg.backupDir != null) {
-      aliases = [ "backup-bitwarden_rs" ];
+      aliases = [ "backup-bitwarden_rs.service" ];
       description = "Backup vaultwarden";
       environment = {
         DATA_FOLDER = "/var/lib/bitwarden_rs";
@@ -169,7 +169,7 @@ in {
     };
 
     systemd.timers.backup-vaultwarden = mkIf (cfg.backupDir != null) {
-      aliases = [ "backup-bitwarden_rs" ];
+      aliases = [ "backup-bitwarden_rs.service" ];
       description = "Backup vaultwarden on time";
       timerConfig = {
         OnCalendar = mkDefault "23:00";

nixos/modules/services/web-servers/nginx/default.nix

@@ -988,5 +988,17 @@ in
       nginx.gid = config.ids.gids.nginx;
     };
 
+    services.logrotate.paths.nginx = mapAttrs (_: mkDefault) {
+      path = "/var/log/nginx/*.log";
+      frequency = "weekly";
+      keep = 26;
+      extraConfig = ''
+        compress
+        delaycompress
+        postrotate
+          [ ! -f /var/run/nginx/nginx.pid ] || kill -USR1 `cat /var/run/nginx/nginx.pid`
+        endscript
+      '';
+    };
   };
 }

nixos/modules/system/boot/systemd.nix

@@ -1217,6 +1217,23 @@ in
     boot.kernel.sysctl."kernel.pid_max" = mkIf pkgs.stdenv.is64bit (lib.mkDefault 4194304);
 
     boot.kernelParams = optional (!cfg.enableUnifiedCgroupHierarchy) "systemd.unified_cgroup_hierarchy=0";
+
+    services.logrotate.paths = {
+      "/var/log/btmp" = mapAttrs (_: mkDefault) {
+        frequency = "monthly";
+        keep = 1;
+        extraConfig = ''
+          create 0660 root ${config.users.groups.utmp.name}
+        '';
+      };
+      "/var/log/wtmp" = mapAttrs (_: mkDefault) {
+        frequency = "monthly";
+        keep = 1;
+        extraConfig = ''
+          create 0664 root ${config.users.groups.utmp.name}
+        '';
+      };
+    };
   };
 
   # FIXME: Remove these eventually.

nixos/tests/all-tests.nix

@@ -270,6 +270,7 @@ in
   litestream = handleTest ./litestream.nix {};
   locate = handleTest ./locate.nix {};
   login = handleTest ./login.nix {};
+  logrotate = handleTest ./logrotate.nix {};
   loki = handleTest ./loki.nix {};
   lxd = handleTest ./lxd.nix {};
   lxd-image = handleTest ./lxd-image.nix {};
@@ -347,6 +348,7 @@ in
   nginx = handleTest ./nginx.nix {};
   nginx-auth = handleTest ./nginx-auth.nix {};
   nginx-etag = handleTest ./nginx-etag.nix {};
+  nginx-modsecurity = handleTest ./nginx-modsecurity.nix {};
   nginx-pubhtml = handleTest ./nginx-pubhtml.nix {};
   nginx-sandbox = handleTestOn ["x86_64-linux"] ./nginx-sandbox.nix {};
   nginx-sso = handleTest ./nginx-sso.nix {};

nixos/tests/logrotate.nix

@@ -0,0 +1,35 @@
+# Test logrotate service works and is enabled by default
+
+import ./make-test-python.nix ({ pkgs, ...} : rec {
+  name = "logrotate";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ martinetd ];
+  };
+
+  # default machine
+  machine = { ... }: {
+  };
+
+  testScript =
+    ''
+      with subtest("whether logrotate works"):
+          machine.succeed(
+              # we must rotate once first to create logrotate stamp
+              "systemctl start --wait logrotate.service",
+
+              # wtmp is present in default config.
+              "rm -f /var/log/wtmp*",
+              "echo test > /var/log/wtmp",
+
+              # move into the future and rotate
+              "date -s 'now + 1 month + 1 day'",
+              # systemd will run logrotate from logrotate.timer automatically
+              # on date change, but if we want to wait for it to terminate
+              # it's easier to run again...
+              "systemctl start --wait logrotate.service",
+
+              # check rotate worked
+              "[ -e /var/log/wtmp.1 ]",
+          )
+    '';
+})

nixos/tests/nginx-modsecurity.nix

@@ -0,0 +1,39 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "nginx-modsecurity";
+
+  machine = { config, lib, pkgs, ... }: {
+    services.nginx = {
+      enable = true;
+      additionalModules = [ pkgs.nginxModules.modsecurity-nginx ];
+      virtualHosts.localhost =
+        let modsecurity_conf = pkgs.writeText "modsecurity.conf" ''
+          SecRuleEngine On
+          SecDefaultAction "phase:1,log,auditlog,deny,status:403"
+          SecDefaultAction "phase:2,log,auditlog,deny,status:403"
+          SecRule REQUEST_METHOD   "HEAD"        "id:100, phase:1, block"
+          SecRule REQUEST_FILENAME "secret.html" "id:101, phase:2, block"
+        '';
+        testroot = pkgs.runCommand "testroot" {} ''
+          mkdir -p $out
+          echo "<html><body>Hello World!</body></html>" > $out/index.html
+          echo "s3cret" > $out/secret.html
+        '';
+      in {
+        root = testroot;
+        extraConfig = ''
+          modsecurity on;
+          modsecurity_rules_file ${modsecurity_conf};
+        '';
+      };
+    };
+  };
+  testScript = ''
+    machine.wait_for_unit("nginx")
+
+    response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1/")
+    assert "Hello World!" in response
+
+    machine.fail("curl -fvvv -X HEAD -s http://127.0.0.1/")
+    machine.fail("curl -fvvv -s http://127.0.0.1/secret.html")
+  '';
+})

pkgs/applications/audio/geonkick/default.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "geonkick";
-  version = "2.8.1";
+  version = "2.9.0";
 
   src = fetchFromGitLab {
     owner = "iurie-sw";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-wSlZ9pVVqlrPSz20pRdcRLq6pTcibxD7326l9WY7ZDY=";
+    sha256 = "sha256-/BDK1PyRw4xOt+rzC9yX29aRQb1aDnDBIenSz+859OY=";
   };
 
   nativeBuildInputs = [ cmake pkg-config ];

pkgs/applications/audio/new-session-manager/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "new-session-manager";
-  version = "1.5.1";
+  version = "1.5.3";
 
   src = fetchFromGitHub {
     owner = "linuxaudio";
     repo = "new-session-manager";
     rev = "v${version}";
-    sha256 = "sha256-hcw+Fn5s1S786eqmR95RmkFcIaRzWaH38YE9DXVQJU0=";
+    sha256 = "sha256-dQE7kUoxqDtTrk5euHqpMVeApxniecWZWOARcCl573o=";
   };
 
   nativeBuildInputs = [ meson pkg-config ninja ];
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   hardeningDisable = [ "format" ];
 
   meta = with lib; {
-    homepage = "https://linuxaudio.github.io/new-session-manager/";
+    homepage = "https://new-session-manager.jackaudio.org/";
     description = "A session manager designed for audio applications.";
     maintainers = [ maintainers._6AA4FD ];
     license = licenses.gpl3Plus;

pkgs/applications/audio/praat/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "praat";
-  version = "6.2.04";
+  version = "6.2.07";
 
   src = fetchFromGitHub {
     owner = "praat";
     repo = "praat";
     rev = "v${version}";
-    sha256 = "sha256-xzEgj4pjW+y46CXtVq4myHKX6DImCibsUz8m0G6F+YQ=";
+    sha256 = "sha256-MM8uC1+d1P7aZI460fCcHWtE7+xfJV1ZFj2cdp/b1rY=";
   };
 
   configurePhase = ''

pkgs/applications/audio/r128gain/default.nix

@@ -1,8 +1,7 @@
 { lib
 , fetchFromGitHub
-, genericUpdater
+, gitUpdater
 , substituteAll
-, common-updater-scripts
 , ffmpeg
 , python3Packages
 , sox
@@ -33,12 +32,7 @@ python3Packages.buildPythonApplication rec {
   # sandbox to be disabled.
   doCheck = false;
 
-  passthru = {
+  passthru.updateScript = gitUpdater { inherit pname version; };
-    updateScript = genericUpdater {
-      inherit pname version;
-      versionLister = "${common-updater-scripts}/bin/list-git-tags ${src.meta.homepage}";
-    };
-  };
 
   meta = with lib; {
     description = "Fast audio loudness scanner & tagger (ReplayGain v2 / R128)";

pkgs/applications/blockchains/erigon.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "erigon";
-  version = "2022.01.02";
+  version = "2022.02.02";
 
   src = fetchFromGitHub {
     owner = "ledgerwatch";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-PzLFwpLKPMV9J2+hqwFppdrFvGxyWpSzYDiQTWZXKco=";
+    sha256 = "sha256-hFoIPlmNzG2oQON86OUY9Y8oRbqexPVo4e7+pTbh1Kk=";
   };
 
-  vendorSha256 = "sha256-YslMHpc3ApPiZOhNZrKoLaQcUWZwj7WLxmzYFyThnRo=";
+  vendorSha256 = "sha256-vXIuXT7BIs7xjGq1DBk0/dGQ0ccxfrFGLn6E03MUvY4=";
   proxyVendor = true;
 
   # Build errors in mdbx when format hardening is enabled:

pkgs/applications/blockchains/lightwalletd/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "lightwalletd";
-  version = "0.4.8";
+  version = "0.4.9";
 
   src = fetchFromGitHub {
     owner = "zcash";
     repo  = "lightwalletd";
     rev = "v${version}";
-    sha256 = "sha256-3cjXQXJqdmAMc+APybAKbpBhTy8Pk/QyBygSa8pGGAs=";
+    sha256 = "sha256-IksA06V+mP7ZAXXFYLKLacxrDXeMXHAk5w4t7pmobq4=";
   };
 
   vendorSha256 = null;

pkgs/applications/blockchains/nbxplorer/util/update-common.sh

@@ -26,7 +26,7 @@ getRepo() {
 }
 
 getLatestVersionTag() {
-  "$nixpkgs"/pkgs/common-updater/scripts/list-git-tags https://github.com/$(getRepo) 2>/dev/null \
+  "$nixpkgs"/pkgs/common-updater/scripts/list-git-tags --url=https://github.com/$(getRepo) 2>/dev/null \
     | sort -V | tail -1 | sed 's|^v||'
 }
 

pkgs/applications/misc/dbeaver/default.nix

@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dbeaver";
-  version = "21.3.4"; # When updating also update fetchedMavenDeps.sha256
+  version = "21.3.5"; # When updating also update fetchedMavenDeps.sha256
 
   src = fetchFromGitHub {
     owner = "dbeaver";
     repo = "dbeaver";
     rev = version;
-    sha256 = "sha256-n8QaOYFLQYxJcq/+7bBIKuYtqeIJIwa8b1pniH+FMXk=";
+    sha256 = "sha256-xJYC+p8HeY4XOzArZMKRvOafW82npMMfwlqlxsH6Ycg=";
   };
 
   fetchedMavenDeps = stdenv.mkDerivation {
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     dontFixup = true;
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
-    outputHash = "sha256-fJs/XM8PZqm/CrhShtcy4R/4s8dCc1WdXIvYSCYZ4dw=";
+    outputHash = "sha256-WAB15d4UvUOkBXT7K/hvAZWOE3V1Lpl/tr+AFNBM4FI=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/fnott/default.nix

@@ -19,14 +19,14 @@
 
 stdenv.mkDerivation rec {
   pname = "fnott";
-  version = "1.2.0";
+  version = "1.2.1";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "dnkl";
     repo = "fnott";
     rev = version;
-    sha256 = "1qmxzpv2xy79aznzzr9fay61mzf1pdzv85ah3w3q2kl2i7pskfxb";
+    sha256 = "sha256-Ni1LwsBkh+XekHEAPxoAkE3tjgUByvpLUGpx7WC54Jw=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/markets/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "markets";
-  version = "0.5.3";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "bitstower";
     repo = "markets";
     rev = version;
-    sha256 = "0sfdmz7cp8i2bymippp8jyxsidxjn69v9cqm40q77j81kfm84bfv";
+    sha256 = "sha256-/g/r/1i69PmPND40zIID3Nun0I4ZFT1EFoNf1qprBjI=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/mdzk/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdzk";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "mdzk-rs";
     repo = "mdzk";
     rev = version;
-    sha256 = "sha256-UiJ28VI4qXo04WojNaExTVQ3aTIXCQrdMbNM0DDy8A4=";
+    sha256 = "sha256-V//tVcIzhCh03VjwMC+R2ynaOFm+dp6qxa0oqBfvGUs=";
   };
 
-  cargoSha256 = "sha256-CiA8Z1+S6+Lwms70IiRvIN83gValHuy6kHOukR2O7/Q=";
+  cargoSha256 = "sha256-2lPckUhnyfHaVWXzZXKliolDZiPtNl9UBZIKs6tUaNQ=";
 
   buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 

pkgs/applications/misc/qMasterPassword/default.nix

@@ -1,14 +1,14 @@
 { lib, stdenv, mkDerivation, fetchFromGitHub, qtbase, qmake, qttools, libX11, libXtst, openssl, libscrypt }:
 
 mkDerivation rec {
-  pname = "qMasterPassword-unstable";
+  pname = "qMasterPassword";
-  version = "2022-01-28";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "bkueng";
-    repo = "qMasterPassword";
+    repo = pname;
-    rev = "7ade33952531731c266c2597f4212c93aca68c59";
+    rev = "v${version}";
-    sha256 = "sha256-MdV6AkRh072++sKoeuwvhgqLEfUkTF34xt6OH9n59Q0=";
+    sha256 = "sha256-eUJD9FoGaDzADKm3wZHs5Bhdt7RoM1WTTVNP6xUV7gs=";
   };
 
   buildInputs = [ qtbase libX11 libXtst openssl libscrypt ];

pkgs/applications/networking/browsers/chromium/common.nix

@@ -220,7 +220,7 @@ let
       # Link to our own Node.js and Java (required during the build):
       mkdir -p third_party/node/linux/node-linux-x64/bin
       ln -s "${pkgsBuildHost.nodejs}/bin/node" third_party/node/linux/node-linux-x64/bin/node
-      ln -s "${pkgsBuildHost.jre8}/bin/java" third_party/jdk/current/bin/
+      ln -s "${pkgsBuildHost.jre8_headless}/bin/java" third_party/jdk/current/bin/
 
       # Allow building against system libraries in official builds
       sed -i 's/OFFICIAL_BUILD/GOOGLE_CHROME_BUILD/' tools/generate_shim_headers/generate_shim_headers.py

pkgs/applications/networking/browsers/opera/default.nix

@@ -50,11 +50,11 @@ let
 in stdenv.mkDerivation rec {
 
   pname = "opera";
-  version = "82.0.4227.43";
+  version = "83.0.4254.54";
 
   src = fetchurl {
     url = "${mirror}/${version}/linux/${pname}-stable_${version}_amd64.deb";
-    sha256 = "sha256-DFhf62dqk7qA2k+JgVqGLxF30UPwQwhXD105Qua25X0=";
+    sha256 = "sha256-kv90FmenGpAbNyw/puwEbR/vVNHV2d5UdX3amMTcI7k=";
   };
 
   unpackCmd = "${dpkg}/bin/dpkg-deb -x $curSrc .";

pkgs/applications/networking/cluster/fluxcd/default.nix

@@ -1,9 +1,9 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles }:
 
 let
-  version = "0.27.0";
+  version = "0.27.2";
-  sha256 = "12d5azl30071s31dqbvbi1c5a5746cb9y45g889hgcyl50yzm2dx";
+  sha256 = "0rdsc9i8mjiwyb6l9sbhxirl4i3b50m6505wwvhxz4y5arzdi1k6";
-  manifestsSha256 = "0mhx9xgir9ych9p0j5yc4swf371njfbwyk3cqa1nmipgpxbfczc6";
+  manifestsSha256 = "0h966xqjkvrblxd62iph9vwr2h7w1ig943hi5vg0swy4674v3ybf";
 
   manifests = fetchzip {
     url =
@@ -23,7 +23,7 @@ in buildGoModule rec {
     inherit sha256;
   };
 
-  vendorSha256 = "sha256-iyyGLHtJVXc7rdu2VkuGo+Y1tTS0krW7F/lD5TmjTQs=";
+  vendorSha256 = "sha256-xkhbGID+oI7+kLml8CveEet7gtPSty8LGv1gkqpqg6w=";
 
   postUnpack = ''
     cp -r ${manifests} source/cmd/flux/manifests

pkgs/applications/networking/cluster/fn-cli/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "fn";
-  version = "0.6.13";
+  version = "0.6.14";
 
   src = fetchFromGitHub {
     owner = "fnproject";
     repo = "cli";
     rev = version;
-    sha256 = "sha256-zynhDxhZEpLmO8Z8shU8DnJUJ+K0wmf8fkRjMMV35uE=";
+    sha256 = "sha256-4gHwf8zOkCKbOPU4Zq1u4h5vn0r1Vi/B++ERxvr/iuk=";
   };
 
   vendorSha256 = null;

pkgs/applications/networking/cluster/glooctl/default.nix

@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.10.8";
+  version = "1.10.10";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    sha256 = "sha256-D6UWwR+cs/pGLBOIky34g253xMxWygczbmjtg8ixNoQ=";
+    hash = "sha256-Be0ejIQ3euKXX6wc1abXz8BphhrDnBMP0GzmnrF7C/4=";
   };
 
   subPackages = [ "projects/gloo/cli/cmd" ];
-  vendorSha256 = "sha256-6hmGtTNuuR4V0uMGEsOy6Iz/hhL8p1cn/4rEx4Uleug=";
+  vendorSha256 = "1s3s4n2wgi4azwkmg9zw2a3gz378nb1i41p3s8aixfbf6fsqc6ga";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/networking/cluster/odo/default.nix

@@ -0,0 +1,38 @@
+{ lib, buildGoModule, fetchFromGitHub, testVersion, odo }:
+
+buildGoModule rec {
+  pname = "odo";
+  version = "2.5.0";
+
+  src = fetchFromGitHub {
+    owner = "redhat-developer";
+    repo = "odo";
+    rev = "v${version}";
+    sha256 = "KYJkCoF80UPsebWwxpc5gIfmT3Aj4OU8r6dDkaWXqbY=";
+  };
+
+  vendorSha256 = null;
+
+  buildPhase = ''
+    make bin
+  '';
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -a odo $out/bin
+  '';
+
+  passthru.tests.version = testVersion {
+    package = odo;
+    command = "odo version";
+    version = "v${version}";
+  };
+
+  meta = with lib; {
+    description = "Developer-focused CLI for OpenShift and Kubernetes";
+    license = licenses.asl20;
+    homepage = "odo.dev";
+    maintainers = with maintainers; [ stehessel ];
+    platforms = platforms.unix;
+  };
+}

pkgs/applications/networking/cluster/werf/default.nix

@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "werf";
-  version = "1.2.69";
+  version = "1.2.70";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     rev = "v${version}";
-    sha256 = "sha256-rmDP8qPOPhUrygt5gAF2MOVNCHqh+1Gc50mnVFXpev4=";
+    sha256 = "sha256-Qla1pTqzBUgazzCo4A51YtoEj2UoVBgs4p/GrTfxQFM=";
   };
   vendorSha256 = "sha256-PNg4QEi9+LvYWWhj2B6OrP+SBanuINlSGZYCMNjOQv0=";
   proxyVendor = true;

pkgs/applications/networking/instant-messengers/fluffychat/default.nix

@@ -2,13 +2,15 @@
 , fetchFromGitLab
 , flutter
 , olm
+, imagemagick
+, makeDesktopItem
 }:
 
 flutter.mkFlutterApp rec {
   pname = "fluffychat";
   version = "1.2.0";
 
-  vendorHash = "sha256-Qg0IlajbIl8e3BkKgn4O+mbZGvhfqr7XwllBLJQAA/I=";
+  vendorHash = "sha256-j5opwEFifa+DMG7Uziv4SWEPVokD6OSq8mSIr0AdDL0=";
 
   src = fetchFromGitLab {
     owner = "famedly";
@@ -17,10 +19,58 @@ flutter.mkFlutterApp rec {
     hash = "sha256-PJH3jMQc6u9R6Snn+9rNN8t+8kt6l3Xt7zKPbpqj13E=";
   };
 
+  desktopItem = makeDesktopItem {
+    name = "Fluffychat";
+    exec = "@out@/bin/fluffychat";
+    icon = "fluffychat";
+    desktopName = "Fluffychat";
+    genericName = "Chat with your friends (matrix client)";
+    categories = "Chat;Network;InstantMessaging;";
+  };
+
   buildInputs = [
     olm
   ];
 
+  nativeBuildInputs = [
+    imagemagick
+  ];
+
+  flutterExtraFetchCommands = ''
+    M=$(echo $TMP/.pub-cache/hosted/pub.dartlang.org/matrix-*)
+    sed -i $M/scripts/prepare.sh \
+      -e "s|/usr/lib/x86_64-linux-gnu/libolm.so.3|/bin/sh|g"  \
+      -e "s|if which flutter >/dev/null; then|exit; if which flutter >/dev/null; then|g"
+
+    pushd $M
+    bash scripts/prepare.sh
+    popd
+  '';
+
+  # replace olm dummy path
+  postConfigure = ''
+    M=$(echo $TMP/.pub-cache/hosted/pub.dartlang.org/matrix-*)
+    ln -sf ${olm}/lib/libolm.so.3 $M/ffi/olm/libolm.so
+  '';
+
+  postInstall = ''
+    FAV=$out/app/data/flutter_assets/assets/favicon.png
+    ICO=$out/share/icons
+
+    install -D $FAV $ICO/fluffychat.png
+    mkdir $out/share/applications
+    cp $desktopItem/share/applications/*.desktop $out/share/applications
+
+    for s in 24 32 42 64 128 256 512; do
+      D=$ICO/hicolor/''${s}x''${s}/apps
+      mkdir -p $D
+      convert $FAV -resize ''${s}x''${s} $D/fluffychat.png
+    done
+
+    substituteInPlace $out/share/applications/*.desktop \
+      --subst-var out
+  '';
+
   meta = with lib; {
     description = "Chat with your friends (matrix client)";
     homepage = "https://fluffychat.im/";

pkgs/applications/networking/instant-messengers/schildichat/schildichat-desktop.nix

@@ -122,7 +122,7 @@ stdenv.mkDerivation rec {
     description = "Matrix client / Element Desktop fork";
     homepage = "https://schildi.chat/";
     changelog = "https://github.com/SchildiChat/schildichat-desktop/releases";
-    maintainers = lib.teams.matrix.members;
+    maintainers = lib.teams.matrix.members ++ [ lib.maintainers.kloenk ];
     license = lib.licenses.asl20;
     platforms = lib.platforms.all;
   };

pkgs/applications/networking/instant-messengers/schildichat/schildichat-web.nix

@@ -79,7 +79,7 @@ in stdenv.mkDerivation rec {
     description = "Matrix client / Element Web fork";
     homepage = "https://schildi.chat/";
     changelog = "https://github.com/SchildiChat/schildichat-desktop/releases";
-    maintainers = lib.teams.matrix.members;
+    maintainers = lib.teams.matrix.members ++ [ lib.maintainers.kloenk ];
     license = lib.licenses.asl20;
     platforms = lib.platforms.all;
   };

pkgs/applications/networking/n8n/node-packages.nix

@@ -472,31 +472,31 @@ let
         sha512 = "YATxVxgRqNH6nHEIsvg6k2Boc1JHI9ZbH5iWFFv/MTkchz3b1ieGDa5T0a9RznNdI0KhVbdbWSN+KWWrQZRxTw==";
       };
     };
-    "@types/node-12.20.45" = {
+    "@types/node-12.20.46" = {
       name = "_at_types_slash_node";
       packageName = "@types/node";
-      version = "12.20.45";
+      version = "12.20.46";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/node/-/node-12.20.45.tgz";
+        url = "https://registry.npmjs.org/@types/node/-/node-12.20.46.tgz";
-        sha512 = "1Jg2Qv5tuxBqgQV04+wO5u+wmSHbHgpORCJdeCLM+E+YdPElpdHhgywU+M1V1InL8rfOtpqtOjswk+uXTKwx7w==";
+        sha512 = "cPjLXj8d6anFPzFvOPxS3fvly3Shm5nTfl6g8X5smexixbuGUf7hfr21J5tX9JW+UPStp/5P5R8qrKL5IyVJ+A==";
       };
     };
-    "@types/node-17.0.17" = {
+    "@types/node-17.0.18" = {
       name = "_at_types_slash_node";
       packageName = "@types/node";
-      version = "17.0.17";
+      version = "17.0.18";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/node/-/node-17.0.17.tgz";
+        url = "https://registry.npmjs.org/@types/node/-/node-17.0.18.tgz";
-        sha512 = "e8PUNQy1HgJGV3iU/Bp2+D/DXh3PYeyli8LgIwsQcs1Ar1LoaWHSIT6Rw+H2rNJmiq6SNWiDytfx8+gYj7wDHw==";
+        sha512 = "eKj4f/BsN/qcculZiRSujogjvp5O/k4lOW5m35NopjZM/QwLOR075a8pJW5hD+Rtdm2DaCVPENS6KtSQnUD6BA==";
       };
     };
-    "@types/node-fetch-2.5.12" = {
+    "@types/node-fetch-2.6.1" = {
       name = "_at_types_slash_node-fetch";
       packageName = "@types/node-fetch";
-      version = "2.5.12";
+      version = "2.6.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/@types/node-fetch/-/node-fetch-2.5.12.tgz";
+        url = "https://registry.npmjs.org/@types/node-fetch/-/node-fetch-2.6.1.tgz";
-        sha512 = "MKgC4dlq4kKNa/mYrwpKfzQMB5X3ee5U6fSprkKpToBqBmX4nFZL9cW5jl6sWn+xpRJ7ypWh2yyqqr8UUCstSw==";
+        sha512 = "oMqjURCaxoSIsHSr1E47QHzbmzNR5rK8McHuNb11BOM9cHcIK3Avy0s/b2JlXHoQGTYS3NsvWzV1M0iK7l0wbA==";
       };
     };
     "@types/promise-ftp-1.3.4" = {
@@ -976,13 +976,13 @@ let
         sha512 = "uUbetCWczQHbsKyX1C99XpQHBM8SWfovvaZhPIj23/1uV7SQf0WeRZbiLpw0JZm+LHTChfNgrLfDJOVoU2kU+A==";
       };
     };
-    "aws-sdk-2.1073.0" = {
+    "aws-sdk-2.1077.0" = {
       name = "aws-sdk";
       packageName = "aws-sdk";
-      version = "2.1073.0";
+      version = "2.1077.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1073.0.tgz";
+        url = "https://registry.npmjs.org/aws-sdk/-/aws-sdk-2.1077.0.tgz";
-        sha512 = "TtyHDL4ZEs8Zh/DqWY/hv745DTWrIwOyBAvfjBJ45RE9h0TjpWqCIowEtb6gRPAKyPPyfGH4s+rEYu07vNK1Hg==";
+        sha512 = "orJvJROs8hJaQRfHsX7Zl5PxEgrD/uTXyqXz9Yu9Io5VVxzvnOty9oHmvEMSlgTIf1qd01gnev/vpvP1HgzKtw==";
       };
     };
     "aws-sign2-0.7.0" = {
@@ -1174,13 +1174,13 @@ let
         sha512 = "c98Bf3tPniI+scsdk237ku1Dc3ujXQTSgyiPUDEOe7tRkhrqridvh8klBv0HCEso1OLOYcHuCv/cS6DNxKH+ZA==";
       };
     };
-    "body-parser-1.19.1" = {
+    "body-parser-1.19.2" = {
       name = "body-parser";
       packageName = "body-parser";
-      version = "1.19.1";
+      version = "1.19.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/body-parser/-/body-parser-1.19.1.tgz";
+        url = "https://registry.npmjs.org/body-parser/-/body-parser-1.19.2.tgz";
-        sha512 = "8ljfQi5eBk8EJfECMrgqNGWPEY5jWP+1IzkzkGdFFEwFQZZyaZ21UqdaHktgiMlH0xLHqIFtE/u2OYE5dOtViA==";
+        sha512 = "SAAwOxgoCKMGs9uUAUFHygfLAyaniaoun6I8mFY9pRAJL9+Kec34aU+oIjDhTycub1jozEfEwx1W1IuOYxVSFw==";
       };
     };
     "body-parser-xml-2.0.3" = {
@@ -1318,13 +1318,13 @@ let
         sha1 = "d32815404d689699f85a4ea4fa8755dd13a96048";
       };
     };
-    "bytes-3.1.1" = {
+    "bytes-3.1.2" = {
       name = "bytes";
       packageName = "bytes";
-      version = "3.1.1";
+      version = "3.1.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/bytes/-/bytes-3.1.1.tgz";
+        url = "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz";
-        sha512 = "dWe4nWO/ruEOY7HkUJ5gFt1DCFV9zPRoJr8pV0/ASQermOZjtq8jMjOprC0Kd10GLN+l7xaUPvxzJFWtxGu8Fg==";
+        sha512 = "/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==";
       };
     };
     "call-bind-1.0.2" = {
@@ -1777,13 +1777,13 @@ let
         sha512 = "Mn4AJiYkR3TAZH1Xm/RU7gFS/0kM5TBSAQDry8y40Aez0ASY+3boUhv+3QE5XbOXiXM2JjdhkKve3IsBvWCibQ==";
       };
     };
-    "cookie-0.4.1" = {
+    "cookie-0.4.2" = {
       name = "cookie";
       packageName = "cookie";
-      version = "0.4.1";
+      version = "0.4.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/cookie/-/cookie-0.4.1.tgz";
+        url = "https://registry.npmjs.org/cookie/-/cookie-0.4.2.tgz";
-        sha512 = "ZwrFkGJxUR3EIoXtO+yVE69Eb7KlixbaeAWfBQB9vVsNn/o+Yw69gBWSSDK825hQNdN+wF8zELf3dFNl/kxkUA==";
+        sha512 = "aSWTXFzaKWkvHO1Ny/s+ePFpvKsPnjc551iI41v3ny/ow6tBG5Vd+FuqGNhh1LxOmVzOlGUriIlOaokOvhaStA==";
       };
     };
     "cookie-signature-1.0.6" = {
@@ -1795,13 +1795,13 @@ let
         sha1 = "e303a882b342cc3ee8ca513a79999734dab3ae2c";
       };
     };
-    "core-js-3.21.0" = {
+    "core-js-3.21.1" = {
       name = "core-js";
       packageName = "core-js";
-      version = "3.21.0";
+      version = "3.21.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/core-js/-/core-js-3.21.0.tgz";
+        url = "https://registry.npmjs.org/core-js/-/core-js-3.21.1.tgz";
-        sha512 = "YUdI3fFu4TF/2WykQ2xzSiTQdldLB4KVuL9WeAy5XONZYt5Cun/fpQvctoKbCgvPhmzADeesTk/j2Rdx77AcKQ==";
+        sha512 = "FRq5b/VMrWlrmCzwRrpDYNxyHP9BcAZC+xHJaqTgIE5091ZV1NTmyh0sGOg5XqpnHvR0svdy0sv1gWA1zmhxig==";
       };
     };
     "core-util-is-1.0.2" = {
@@ -2434,13 +2434,13 @@ let
         sha1 = "97e801aa052df02454de46b02bf621642cdc8502";
       };
     };
-    "express-4.17.2" = {
+    "express-4.17.3" = {
       name = "express";
       packageName = "express";
-      version = "4.17.2";
+      version = "4.17.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/express/-/express-4.17.2.tgz";
+        url = "https://registry.npmjs.org/express/-/express-4.17.3.tgz";
-        sha512 = "oxlxJxcQlYwqPWKVJJtvQiwHgosH/LrLSPA+H4UxpyvSS6jC5aH+5MoHFM+KABgTOt0APue4w66Ha8jCUo9QGg==";
+        sha512 = "yuSQpz5I+Ch7gFrPCk4/c+dIBKlQUxtgwqzph132bsT6qhuzss6I8cLJQz7B3rFblzd6wtcI0ZbGltH/C4LjUg==";
       };
     };
     "extend-3.0.2" = {
@@ -2587,13 +2587,13 @@ let
         sha512 = "GRnmB5gPyJpAhTQdSZTSp9uaPSvl09KoYcMQtsB9rQoOmzs9dH6ffeccH+Z+cv6P68Hu5bC6JjRh4Ah/mHSNRw==";
       };
     };
-    "follow-redirects-1.14.8" = {
+    "follow-redirects-1.14.9" = {
       name = "follow-redirects";
       packageName = "follow-redirects";
-      version = "1.14.8";
+      version = "1.14.9";
       src = fetchurl {
-        url = "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.14.8.tgz";
+        url = "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.14.9.tgz";
-        sha512 = "1x0S9UVJHsQprFcEC/qnNzBLcIxsjAV905f/UkQxbclCsoTWlacCNOpQa/anodLl2uaEKFhfWOvM2Qg77+15zA==";
+        sha512 = "MQDfihBQYMcyy5dhRDJUHcw7lb2Pv/TuE6xP1vyraLukNDHKbDxDNaOE3NbCAdKQApno+GPRyo1YAp89yCjK4w==";
       };
     };
     "for-each-0.3.3" = {
@@ -3595,13 +3595,13 @@ let
         sha1 = "bb935d48582cba168c06834957a54a3e07124f11";
       };
     };
-    "isbot-3.4.2" = {
+    "isbot-3.4.3" = {
       name = "isbot";
       packageName = "isbot";
-      version = "3.4.2";
+      version = "3.4.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/isbot/-/isbot-3.4.2.tgz";
+        url = "https://registry.npmjs.org/isbot/-/isbot-3.4.3.tgz";
-        sha512 = "b59O14840ltLAGq8z+M8VhL+1CdrjbZYQIhQBPacutjl27Ypa2/UksJ1DRzWOz19F5H/2d2pstbdAp7+b0ph+A==";
+        sha512 = "5hAgiY9ysMIJcVQlGHcXptwgZr1yYbIGNBE36a3sPo7cLZ9eLTLx0qOssekFKaTHiXTwd/ZZMTuOS7w4faOmpw==";
       };
     };
     "isexe-2.0.0" = {
@@ -4288,13 +4288,13 @@ let
         sha512 = "UtJcAD4yEaGtjPezWuO9wC4nwUnVH/8/Im3yEHQP4b67cXlD/Qr9hdITCU1xDbSEXg2XKNaP8jsReV7vQd00/A==";
       };
     };
-    "minimatch-3.1.1" = {
+    "minimatch-3.1.2" = {
       name = "minimatch";
       packageName = "minimatch";
-      version = "3.1.1";
+      version = "3.1.2";
       src = fetchurl {
-        url = "https://registry.npmjs.org/minimatch/-/minimatch-3.1.1.tgz";
+        url = "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz";
-        sha512 = "reLxBcKUPNBnc/sVtAbxgRVFSegoGeLaSjmphNhcwcolhYLRgtJscn5mRl6YRZNQv40Y7P6JM2YhSIsbL9OB5A==";
+        sha512 = "J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==";
       };
     };
     "minimist-1.2.5" = {
@@ -4477,13 +4477,13 @@ let
         sha512 = "z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==";
       };
     };
-    "n8n-core-0.104.0" = {
+    "n8n-core-0.105.0" = {
       name = "n8n-core";
       packageName = "n8n-core";
-      version = "0.104.0";
+      version = "0.105.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-core/-/n8n-core-0.104.0.tgz";
+        url = "https://registry.npmjs.org/n8n-core/-/n8n-core-0.105.0.tgz";
-        sha512 = "rh8ooCF0zeVjic6JWByuCzcltpeV/OJjUmLcChXU3S6peggCvazvxlU6GOF/+YT69CeQdHwhTmOXSEevu0uzVQ==";
+        sha512 = "rYAtchFf7V94M9UP1ZCu9ie9O6OWncNconuzO9I1D/QLjBNVGzu0+SsG8be5bGTrAWO0WiNYdj84qMqqJS4NWg==";
       };
     };
     "n8n-design-system-0.11.0" = {
@@ -4495,31 +4495,31 @@ let
         sha512 = "KL64XTr9sqqiBEEV7on2cdLooleHPyXClFL+THUy2oXDbGqdlyCGykukU7S4aX+nSjrJEQEDMaMcbw3NCHrumg==";
       };
     };
-    "n8n-editor-ui-0.130.0" = {
+    "n8n-editor-ui-0.131.0" = {
       name = "n8n-editor-ui";
       packageName = "n8n-editor-ui";
-      version = "0.130.0";
+      version = "0.131.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-editor-ui/-/n8n-editor-ui-0.130.0.tgz";
+        url = "https://registry.npmjs.org/n8n-editor-ui/-/n8n-editor-ui-0.131.0.tgz";
-        sha512 = "UNvZ3CTcqmxJs1JuhLPSMo18nlakzFYAyJ8UKwCvAOGVfGltHweVeaKHnAEs0legDAkdJ3yEtaebTrQjF+dCoA==";
+        sha512 = "Sexo31sn8PdiNjDckNfDCXBs9MBR/hF5NzuFtUCUNaXPR6Z5gql6EhPT+fJfG9Wdsj09L3vV+j3gTAbXqRgPIw==";
       };
     };
-    "n8n-nodes-base-0.161.0" = {
+    "n8n-nodes-base-0.162.0" = {
       name = "n8n-nodes-base";
       packageName = "n8n-nodes-base";
-      version = "0.161.0";
+      version = "0.162.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-nodes-base/-/n8n-nodes-base-0.161.0.tgz";
+        url = "https://registry.npmjs.org/n8n-nodes-base/-/n8n-nodes-base-0.162.0.tgz";
-        sha512 = "WRTzmzDO3dKZF6WRzQ/d6w2TaYLoPUb+X1kjDWaxF5omwz6UFc63dVtJ+irhyQR8wRj3/ytdrS3xEMDxZ9vXlg==";
+        sha512 = "bi7vs//5OHrW6RowouusBwUzKutFKnysLWdDrlxlCENGtRDtI+7ELrLMWnKs6PYTRWz0OSBHpEMN64MDEIoEZg==";
       };
     };
-    "n8n-workflow-0.86.0" = {
+    "n8n-workflow-0.87.0" = {
       name = "n8n-workflow";
       packageName = "n8n-workflow";
-      version = "0.86.0";
+      version = "0.87.0";
       src = fetchurl {
-        url = "https://registry.npmjs.org/n8n-workflow/-/n8n-workflow-0.86.0.tgz";
+        url = "https://registry.npmjs.org/n8n-workflow/-/n8n-workflow-0.87.0.tgz";
-        sha512 = "+Kdo5RMEsh7QJ8AkWNTSpyxYRtjpxPmPfifVAFg4HVguW7g5e7f74xlmqD2xnxQybC9B3f6jxvx6WMKbNcT/+A==";
+        sha512 = "ei5fvQK4jM3NotOA36d267o243m2MdlSPlG6cIutqx4lgUd1oXX7mYyCJzF3/kNcWbiI8QjdhUoURgdCOEzn8g==";
       };
     };
     "named-placeholders-1.1.2" = {
@@ -4540,13 +4540,13 @@ let
         sha512 = "wynEP02LmIbLpcYw8uBKpcfF6dmg2vcpKqxeH5UcoKEYdExslsdUA4ugFauuaeYdTB76ez6gJW8XAZ6CgkXYxA==";
       };
     };
-    "nanoid-3.2.0" = {
+    "nanoid-3.3.1" = {
       name = "nanoid";
       packageName = "nanoid";
-      version = "3.2.0";
+      version = "3.3.1";
       src = fetchurl {
-        url = "https://registry.npmjs.org/nanoid/-/nanoid-3.2.0.tgz";
+        url = "https://registry.npmjs.org/nanoid/-/nanoid-3.3.1.tgz";
-        sha512 = "fmsZYa9lpn69Ad5eDn7FMcnnSR+8R34W9qJEijxYhTbfOWzr22n1QxCMzXLK+ODyW2973V3Fux959iQoUxzUIA==";
+        sha512 = "n6Vs/3KGyxPQd6uO0eH4Bv0ojGSUvuLlIHtC3Y0kEO23YRge8H9x1GCzLn28YX0H66pMkxuaeESFq4tKISKwdw==";
       };
     };
     "native-duplexpair-1.0.0" = {
@@ -5566,13 +5566,13 @@ let
         sha512 = "qxXIEh4pCGfHICj1mAJQ2/2XVZkjCDTcEgfoSQxc/fYivUZxTkk7L3bDBJSoNrEzXI17oUO5Dp07ktqE5KzczA==";
       };
     };
-    "qs-6.9.6" = {
+    "qs-6.9.7" = {
       name = "qs";
       packageName = "qs";
-      version = "6.9.6";
+      version = "6.9.7";
       src = fetchurl {
-        url = "https://registry.npmjs.org/qs/-/qs-6.9.6.tgz";
+        url = "https://registry.npmjs.org/qs/-/qs-6.9.7.tgz";
-        sha512 = "TIRk4aqYLNoJUbd+g2lEdz5kLWIuTMRagAXxl78Q0RiVjAOugHmeKNGdd3cwo/ktpf9aL9epCfFqWDEKysUlLQ==";
+        sha512 = "IhMFgUmuNpyRfxA90umL7ByLlgRXu6tIfKPpF5TmcfRLlLCckfP/g3IQmju6jjpu+Hh8rA+2p6A27ZSPOOHdKw==";
       };
     };
     "querystring-0.2.0" = {
@@ -5656,13 +5656,13 @@ let
         sha512 = "Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==";
       };
     };
-    "raw-body-2.4.2" = {
+    "raw-body-2.4.3" = {
       name = "raw-body";
       packageName = "raw-body";
-      version = "2.4.2";
+      version = "2.4.3";
       src = fetchurl {
-        url = "https://registry.npmjs.org/raw-body/-/raw-body-2.4.2.tgz";
+        url = "https://registry.npmjs.org/raw-body/-/raw-body-2.4.3.tgz";
-        sha512 = "RPMAFUJP19WIet/99ngh6Iv8fzAbqum4Li7AD6DtGaW2RpMB/11xDoalPiJMTbu6I3hkbMVkATvZrqb9EEqeeQ==";
+        sha512 = "UlTNLIcu0uzb4D2f4WltY6cVjLi+/jEN4lgEUj3E04tpMDpUlkBo/eSn6zou9hum2VMNpCCUone0O0WeJim07g==";
       };
     };
     "rc-1.2.8" = {
@@ -6259,13 +6259,13 @@ let
         sha512 = "LAOh4z89bGQvl9pFfNF8V146i7o7/CqFPbqzYgP+yYzDIDeS9HaNFtXABamRW+AQzEVODcvE79ljJ+8a9YSdMg==";
       };
     };
-    "snowflake-sdk-1.6.6" = {
+    "snowflake-sdk-1.6.7" = {
       name = "snowflake-sdk";
       packageName = "snowflake-sdk";
-      version = "1.6.6";
+      version = "1.6.7";
       src = fetchurl {
-        url = "https://registry.npmjs.org/snowflake-sdk/-/snowflake-sdk-1.6.6.tgz";
+        url = "https://registry.npmjs.org/snowflake-sdk/-/snowflake-sdk-1.6.7.tgz";
-        sha512 = "b8mbYI6TFGe8H0m0eviNd4FC/3jsw02OHNt21k9sLWkBp4re2VUhaJf7555ln7thMSnMcbkdAB8zQBZcbqdoPg==";
+        sha512 = "pisHqO5ALTggbNhE7LGEG5bnD6NKebcqyirOl4IsoKsD7g6d+vC3gHgRR/cm8kAH1GhLHY/WwhDq2fr7lundpA==";
       };
     };
     "source-map-0.6.1" = {
@@ -7015,13 +7015,13 @@ let
         sha1 = "021e4d9c7705f21bbf37d03ceb58767402774c64";
       };
     };
-    "url-parse-1.5.6" = {
+    "url-parse-1.5.9" = {
       name = "url-parse";
       packageName = "url-parse";
-      version = "1.5.6";
+      version = "1.5.9";
       src = fetchurl {
-        url = "https://registry.npmjs.org/url-parse/-/url-parse-1.5.6.tgz";
+        url = "https://registry.npmjs.org/url-parse/-/url-parse-1.5.9.tgz";
-        sha512 = "xj3QdUJ1DttD1LeSfvJlU1eiF1RvBSBfUu8GplFGdUzSO28y5yUtEl7wb//PI4Af6qh0o/K8545vUmucRrfWsw==";
+        sha512 = "HpOvhKBvre8wYez+QhHcYiVvVmeF6DVnuSOOPhe3cTum3BnqHhvKaZm8FU5yTiOu/Jut2ZpB2rA/SbBA1JIGlQ==";
       };
     };
     "utf7-1.0.2" = {
@@ -7141,13 +7141,13 @@ let
         sha1 = "3a105ca17053af55d6e270c1f8288682e18da400";
       };
     };
-    "vm2-3.9.7" = {
+    "vm2-3.9.8" = {
       name = "vm2";
       packageName = "vm2";
-      version = "3.9.7";
+      version = "3.9.8";
       src = fetchurl {
-        url = "https://registry.npmjs.org/vm2/-/vm2-3.9.7.tgz";
+        url = "https://registry.npmjs.org/vm2/-/vm2-3.9.8.tgz";
-        sha512 = "g/GZ7V0Mlmch3eDVOATvAXr1GsJNg6kQ5PjvYy3HbJMCRn5slNbo/u73Uy7r5yUej1cRa3ZjtoVwcWSQuQ/fow==";
+        sha512 = "/1PYg/BwdKzMPo8maOZ0heT7DLI0DAFTm7YQaz/Lim9oIaFZsJs3EdtalvXuBfZwczNwsYhju75NW4d6E+4q+w==";
       };
     };
     "vue-fragment-1.5.2" = {
@@ -7462,10 +7462,10 @@ in
   n8n = nodeEnv.buildNodePackage {
     name = "n8n";
     packageName = "n8n";
-    version = "0.163.1";
+    version = "0.164.1";
     src = fetchurl {
-      url = "https://registry.npmjs.org/n8n/-/n8n-0.163.1.tgz";
+      url = "https://registry.npmjs.org/n8n/-/n8n-0.164.1.tgz";
-      sha512 = "lhup+qIy3cG0oWvBuOWi57Tn3F2k5NBD00KJ3ilKgnk4VsY+LmAca2xvyZNKvlRPa9i++3ukG6XioPTDuXylgw==";
+      sha512 = "8eUhHHikLspebbc1AjatdSQeaQAVgeYMIMFZmiUPMUw8FVtQ67otse6t/RvBE2RXTzxKer54Nr8eA+cF5dHi8g==";
     };
     dependencies = [
       (sources."@azure/abort-controller-1.0.5" // {
@@ -7577,8 +7577,8 @@ in
       sources."@types/lodash-4.14.178"
       sources."@types/lossless-json-1.0.1"
       sources."@types/mime-1.3.2"
-      sources."@types/node-17.0.17"
+      sources."@types/node-17.0.18"
-      (sources."@types/node-fetch-2.5.12" // {
+      (sources."@types/node-fetch-2.6.1" // {
         dependencies = [
           sources."form-data-3.0.1"
         ];
@@ -7646,7 +7646,7 @@ in
         ];
       })
       sources."avsc-5.7.3"
-      (sources."aws-sdk-2.1073.0" // {
+      (sources."aws-sdk-2.1077.0" // {
         dependencies = [
           sources."buffer-4.9.2"
           sources."events-1.1.1"
@@ -7700,7 +7700,7 @@ in
       })
       sources."bluebird-3.7.2"
       sources."bn.js-4.12.0"
-      (sources."body-parser-1.19.1" // {
+      (sources."body-parser-1.19.2" // {
         dependencies = [
           sources."debug-2.6.9"
           sources."ms-2.0.0"
@@ -7719,7 +7719,7 @@ in
       sources."buffer-writer-2.0.0"
       sources."bull-3.29.3"
       sources."byte-length-1.0.2"
-      sources."bytes-3.1.1"
+      sources."bytes-3.1.2"
       sources."call-bind-1.0.2"
       sources."callback-stream-1.1.0"
       sources."callsites-3.1.0"
@@ -7817,9 +7817,9 @@ in
       sources."content-disposition-0.5.4"
       sources."content-type-1.0.4"
       sources."convict-6.2.1"
-      sources."cookie-0.4.1"
+      sources."cookie-0.4.2"
       sources."cookie-signature-1.0.6"
-      sources."core-js-3.21.0"
+      sources."core-js-3.21.1"
       sources."core-util-is-1.0.2"
       (sources."crc-32-1.2.1" // {
         dependencies = [
@@ -7902,7 +7902,7 @@ in
       sources."eventsource-1.1.0"
       sources."exit-on-epipe-1.0.1"
       sources."expand-tilde-2.0.2"
-      (sources."express-4.17.2" // {
+      (sources."express-4.17.3" // {
         dependencies = [
           sources."debug-2.6.9"
           sources."ms-2.0.0"
@@ -7933,7 +7933,7 @@ in
       })
       sources."flatted-3.2.5"
       sources."fn.name-1.1.0"
-      sources."follow-redirects-1.14.8"
+      sources."follow-redirects-1.14.9"
       sources."for-each-0.3.3"
       sources."forever-agent-0.6.1"
       sources."form-data-4.0.0"
@@ -8059,7 +8059,7 @@ in
       sources."is-windows-1.0.2"
       sources."is-wsl-2.2.0"
       sources."isarray-0.0.1"
-      sources."isbot-3.4.2"
+      sources."isbot-3.4.3"
       sources."isexe-2.0.0"
       sources."iso-639-1-2.1.13"
       sources."isstream-0.1.2"
@@ -8162,7 +8162,7 @@ in
       sources."mime-types-2.1.34"
       sources."mimic-fn-2.1.0"
       sources."minimalistic-assert-1.0.1"
-      sources."minimatch-3.1.1"
+      sources."minimatch-3.1.2"
       sources."minimist-1.2.5"
       (sources."minipass-2.9.0" // {
         dependencies = [
@@ -8205,19 +8205,19 @@ in
         ];
       })
       sources."mz-2.7.0"
-      (sources."n8n-core-0.104.0" // {
+      (sources."n8n-core-0.105.0" // {
         dependencies = [
           sources."qs-6.10.3"
         ];
       })
       sources."n8n-design-system-0.11.0"
-      sources."n8n-editor-ui-0.130.0"
+      sources."n8n-editor-ui-0.131.0"
-      (sources."n8n-nodes-base-0.161.0" // {
+      (sources."n8n-nodes-base-0.162.0" // {
         dependencies = [
           sources."iconv-lite-0.6.3"
         ];
       })
-      sources."n8n-workflow-0.86.0"
+      sources."n8n-workflow-0.87.0"
       (sources."named-placeholders-1.1.2" // {
         dependencies = [
           sources."lru-cache-4.1.5"
@@ -8225,7 +8225,7 @@ in
         ];
       })
       sources."nanoclone-0.2.1"
-      sources."nanoid-3.2.0"
+      sources."nanoid-3.3.1"
       sources."native-duplexpair-1.0.0"
       (sources."nearley-2.20.1" // {
         dependencies = [
@@ -8393,7 +8393,7 @@ in
       })
       sources."punycode-2.1.1"
       sources."python-struct-1.1.3"
-      sources."qs-6.9.6"
+      sources."qs-6.9.7"
       sources."querystring-0.2.0"
       sources."querystringify-2.2.0"
       sources."queue-microtask-1.2.3"
@@ -8403,7 +8403,7 @@ in
       sources."random-bytes-1.0.0"
       sources."randombytes-2.1.0"
       sources."range-parser-1.2.1"
-      sources."raw-body-2.4.2"
+      sources."raw-body-2.4.3"
       sources."rc-1.2.8"
       sources."readable-stream-1.1.14"
       sources."readable-web-to-node-stream-2.0.0"
@@ -8494,7 +8494,7 @@ in
           sources."tslib-2.3.1"
         ];
       })
-      (sources."snowflake-sdk-1.6.6" // {
+      (sources."snowflake-sdk-1.6.7" // {
         dependencies = [
           sources."agent-base-4.3.0"
           sources."debug-3.2.7"
@@ -8545,7 +8545,7 @@ in
       sources."tdigest-0.1.1"
       (sources."tedious-6.7.1" // {
         dependencies = [
-          sources."@types/node-12.20.45"
+          sources."@types/node-12.20.46"
           sources."bl-3.0.1"
           sources."depd-2.0.0"
           sources."iconv-lite-0.5.2"
@@ -8627,7 +8627,7 @@ in
           sources."punycode-1.3.2"
         ];
       })
-      sources."url-parse-1.5.6"
+      sources."url-parse-1.5.9"
       (sources."utf7-1.0.2" // {
         dependencies = [
           sources."semver-5.3.0"
@@ -8643,7 +8643,7 @@ in
       sources."validator-13.7.0"
       sources."vary-1.1.2"
       sources."verror-1.10.0"
-      sources."vm2-3.9.7"
+      sources."vm2-3.9.8"
       sources."vue-fragment-1.5.2"
       sources."vue-i18n-8.27.0"
       sources."webidl-conversions-3.0.1"

pkgs/applications/networking/shellhub-agent/default.nix

@@ -1,8 +1,7 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
-, genericUpdater
+, gitUpdater
-, common-updater-scripts
 , makeWrapper
 , openssh
 }:
@@ -25,9 +24,8 @@ buildGoModule rec {
   ldflags = [ "-s" "-w" "-X main.AgentVersion=v${version}" ];
 
   passthru = {
-    updateScript = genericUpdater {
+    updateScript = gitUpdater {
       inherit pname version;
-      versionLister = "${common-updater-scripts}/bin/list-git-tags ${src.meta.homepage}";
       rev-prefix = "v";
       ignoredVersions = ".(rc|beta).*";
     };

pkgs/applications/networking/testssl/default.nix

@@ -3,13 +3,13 @@
 
 stdenv.mkDerivation rec {
   pname = "testssl.sh";
-  version = "3.0.6";
+  version = "3.0.7";
 
   src = fetchFromGitHub {
     owner = "drwetter";
     repo = pname;
     rev = "v${version}";
-    sha256 = "016qpsb4dv9qb3ab3hmvk4vzf4ipr3xgmzv2cx46pxxsj0gnigd8";
+    sha256 = "sha256-SZfGiKSbLq81YdDMgG0C6LC/nE5NApqeWK/PqDzQNBU=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/office/appflowy/default.nix

@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation rec {
   pname = "appflowy";
-  version = "0.0.2";
+  version = "0.0.3";
 
   src = fetchzip {
     url = "https://github.com/AppFlowy-IO/appflowy/releases/download/${version}/AppFlowy-linux-x86.tar.gz";
-    sha256 = "1fvv4mlgf0vqcq5zh0zl2xr44saz0sm47r8whcywwrmcm0l66iv6";
+    sha256 = "sha256-m9vfgytSKnWLf6hwKjIGcU/7OCmIBiF4hJ/yIRBdSpQ=";
   };
 
   nativeBuildInputs = [

pkgs/applications/office/portfolio/default.nix

@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "PortfolioPerformance";
-  version = "0.56.2";
+  version = "0.56.5";
 
   src = fetchurl {
     url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "sha256-4iMLn0KTrH7MOlNduSl7BMOZKPakHhhQdR3NQXV2ZZU=";
+    sha256 = "sha256-g/MjOrivqbZ93iSs5mLQT36gn72KCJEOgEssBZER+TA=";
   };
 
   nativeBuildInputs = [

pkgs/applications/science/logic/workcraft/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "workcraft";
-  version = "3.3.5";
+  version = "3.3.6";
 
   src = fetchurl {
     url = "https://github.com/workcraft/workcraft/releases/download/v${version}/workcraft-v${version}-linux.tar.gz";
-    sha256 = "sha256-KErKYK3mmjp5uNdGQnjzUUIEwXT5fqbAPUunH72Mtig=";
+    sha256 = "sha256-5J4HOTz92ALUcZZr15jJ6vplc3KDwbFCXqjEhlOV4kE=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/science/math/gurobi/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gurobi";
-  version = "9.1.2";
+  version = "9.5.0";
 
   src = fetchurl {
     url = "https://packages.gurobi.com/${lib.versions.majorMinor version}/gurobi${version}_linux64.tar.gz";
-    sha256 = "7f60bd675f79476bb2b32cd632aa1d470f8246f2b033b7652d8de86f6e7e429b";
+    sha256 = "sha256-u1QuWl0WhfbjZOrwXqbFVySF/8N6IkUWnPPLQCiLwp4=";
   };
 
   sourceRoot = "gurobi${builtins.replaceStrings ["."] [""] version}/linux64";

pkgs/applications/science/math/qalculate-gtk/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qalculate-gtk";
-  version = "3.22.0";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "qalculate";
     repo = "qalculate-gtk";
     rev = "v${version}";
-    sha256 = "sha256-BarbO25c103YImOOnjVgwgqpa3mUVvndgJeUHRf2I60=";
+    sha256 = "sha256-l9lR5MVHWiRz5RG/I/nXRY4GQSSaXXP7PlRNoAu9+yo=";
   };
 
   hardeningDisable = [ "format" ];

pkgs/applications/science/molecular-dynamics/gromacs/default.nix

@@ -19,11 +19,11 @@ let
 
 in stdenv.mkDerivation rec {
   pname = "gromacs";
-  version = "2021.5";
+  version = "2022";
 
   src = fetchurl {
     url = "ftp://ftp.gromacs.org/pub/gromacs/gromacs-${version}.tar.gz";
-    sha256 = "1dh9l2gcv61h1r6qsg8vr3k1xp8jgd27czzg24kzf4k823k3z9pb";
+    sha256 = "0s1bv8nvmdpiyk2yhcmzq8q936hm5jgnqb393101drh2dih0vmps";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/version-management/git-review/default.nix

@@ -4,8 +4,7 @@
 , pbr
 , requests
 , setuptools
-, genericUpdater
+, gitUpdater
-, common-updater-scripts
 }:
 
 buildPythonApplication rec {
@@ -42,10 +41,7 @@ buildPythonApplication rec {
 
   pythonImportsCheck = [ "git_review" ];
 
-  passthru.updateScript = genericUpdater {
+  passthru.updateScript = gitUpdater { inherit pname version; };
-    inherit pname version;
-    versionLister = "${common-updater-scripts}/bin/list-git-tags ${src.meta.homepage}";
-  };
 
   meta = with lib; {
     description = "Tool to submit code to Gerrit";

pkgs/applications/version-management/gitlab/data.json

@@ -1,14 +1,14 @@
 {
-  "version": "14.7.2",
+  "version": "14.7.3",
-  "repo_hash": "1jnwbcsswvy6jjrc2jclrxyyxi54caf8w51sgyiqaik5s3p4wgnx",
+  "repo_hash": "1by4r7an5s5n9jka77mvp9ysc9c5kyvld9fvwr0r5qw2h39akl9g",
   "yarn_hash": "12k2r1y7kw95kfsmy0s8rbsf0vldr8c2liah0rkc7pihr19gq3w7",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v14.7.2-ee",
+  "rev": "v14.7.3-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "14.7.2",
+    "GITALY_SERVER_VERSION": "14.7.3",
     "GITLAB_PAGES_VERSION": "1.51.0",
     "GITLAB_SHELL_VERSION": "13.22.2",
-    "GITLAB_WORKHORSE_VERSION": "14.7.2"
+    "GITLAB_WORKHORSE_VERSION": "14.7.3"
   }
 }

pkgs/applications/version-management/gitlab/gitaly/default.nix

@@ -25,7 +25,7 @@ let
     gemdir = ./.;
   };
 
-  version = "14.7.2";
+  version = "14.7.3";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/v${lib.versions.major version}";
 in
 
@@ -37,7 +37,7 @@ buildGoModule {
     owner = "gitlab-org";
     repo = "gitaly";
     rev = "v${version}";
-    sha256 = "sha256-gtQmRryTYwT2e4lamWYJ7Ri7dEGI7vg/Ir1gnuGmHQg=";
+    sha256 = "sha256-5m+bhHtI1VZr8Di3LNG0Z7yk8oVTv6re7rckFDjaVvk=";
   };
 
   vendorSha256 = "sha256-eapqtSstc7d3R7A/5krKV0uVr9GhGkHHMrmsBOpWAbo=";

pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix

@@ -5,7 +5,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "14.7.2";
+  version = "14.7.3";
 
   src = fetchFromGitLab {
     owner = data.owner;

pkgs/applications/version-management/got/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "got";
-  version = "0.66";
+  version = "0.67";
 
   src = fetchurl {
     url =
       "https://gameoftrees.org/releases/portable/got-portable-${version}.tar.gz";
-    sha256 = "13xrwndj80jix210fxkadivxyd1f5qavdrhxyl32n68xyv5xmkgg";
+    sha256 = "sha256-37Ncljw2tibVRrynDlbxk7d5IS+5QypNFvKIkZ5JvME=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/applications/video/epgstation/update.nix

@@ -13,7 +13,7 @@ let
     inherit pname version;
     attrPath = lib.toLower pname;
     rev-prefix = "v";
-    versionLister = "${common-updater-scripts}/bin/list-git-tags ${homepage}";
+    versionLister = "${common-updater-scripts}/bin/list-git-tags --url=${homepage}";
   };
   updateScript = builtins.elemAt updater 0;
   updateArgs = map (lib.escapeShellArg) (builtins.tail updater);

pkgs/applications/video/mirakurun/update.nix

@@ -17,7 +17,7 @@ let
 
     # exclude prerelease versions
     versionLister = writers.writeBash "list-mirakurun-versions" ''
-      ${common-updater-scripts}/bin/list-git-tags ${homepage} \
+      ${common-updater-scripts}/bin/list-git-tags --url=${homepage} \
         | grep '^[0-9]\+\.[0-9]\+\.[0-9]\+$'
     '';
   };

pkgs/applications/video/shotcut/default.nix

@@ -17,8 +17,7 @@
 , qtgraphicaleffects
 , qmake
 , qttools
-, genericUpdater
+, gitUpdater
-, common-updater-scripts
 }:
 
 assert lib.versionAtLeast mlt.version "6.24.0";
@@ -76,9 +75,8 @@ mkDerivation rec {
     cp -r src/qml $out/share/shotcut/
   '';
 
-  passthru.updateScript = genericUpdater {
+  passthru.updateScript = gitUpdater {
     inherit pname version;
-    versionLister = "${common-updater-scripts}/bin/list-git-tags ${src.meta.homepage}";
     rev-prefix = "v";
   };
 

pkgs/applications/window-managers/i3/balance-workspace.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "i3-balance-workspace";
-  version = "1.8.5";
+  version = "1.8.6";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "7b5d72b756f79878a058484825bb343b100433e00a01f80c9c6d1ccc9f4af57a";
+    sha256 = "sha256-zJdn/Q6r60FQgfehtQfeDkmN0Rz3ZaqgNhiWvjyQFy0=";
   };
 
   propagatedBuildInputs = [ i3ipc ];

pkgs/build-support/flutter/default.nix

@@ -63,6 +63,9 @@ let
       nukeReferences
     ];
 
+    # avoid pub phase
+    dontBuild = true;
+
     installPhase = ''
       . ${../fetchgit/deterministic-git}
 
@@ -76,6 +79,7 @@ let
       flutter config --enable-linux-desktop
       flutter packages get
       flutter build linux || true # so it downloads tools
+      ${lib.optionalString (args ? flutterExtraFetchCommands) args.flutterExtraFetchCommands}
 
       RES="$TMP"
 
@@ -127,6 +131,7 @@ let
     '';
 
     GIT_SSL_CAINFO = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+    SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 
     impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
       "GIT_PROXY_COMMAND" "NIX_GIT_SSL_CAINFO" "SOCKS_SERVER"
@@ -207,6 +212,7 @@ let
 
     # ensure we're using a lockfile for the right package version
     if [ -e pubspec.lock ]; then
+      # FIXME: currently this is broken. in theory this should not break, but flutter has it's own way of doing things.
       # diff -u pubspec.lock $depsFolder/pubspec.lock
       true
     else
@@ -248,9 +254,10 @@ let
     mkdir -p $out/bin
     mv $built $out/app
 
-    for f in $built/data/flutter_assets/assets/*.desktop; do
+    for f in $(find $out/app -iname "*.desktop" -type f); do
       install -D $f $out/share/applications/$(basename $f)
     done
+
     for f in $(find $out/app -maxdepth 1 -type f); do
       ln -s $f $out/bin/$(basename $f)
     done

pkgs/common-updater/generic-updater.nix

@@ -55,7 +55,7 @@ let
       return 1
     }
 
-    tags=$($version_lister $pname ${fileForGitCommands}) || exit 1
+    tags=$($version_lister --pname=${pname} --file="${fileForGitCommands}") || exit 1
 
     # print available tags
     for tag in $tags; do

pkgs/common-updater/git-updater.nix

@@ -0,0 +1,17 @@
+{ genericUpdater
+, common-updater-scripts
+}:
+
+{ pname
+, version
+, attrPath ? pname
+, ignoredVersions ? ""
+, rev-prefix ? ""
+, odd-unstable ? false
+, patchlevel-unstable ? false
+}:
+
+genericUpdater {
+  inherit pname version attrPath ignoredVersions rev-prefix odd-unstable patchlevel-unstable;
+  versionLister = "${common-updater-scripts}/bin/list-git-tags";
+}

pkgs/common-updater/http-two-levels-updater.nix

@@ -0,0 +1,19 @@
+{ lib
+, genericUpdater
+, common-updater-scripts
+}:
+
+{ pname
+, version
+, attrPath ? pname
+, ignoredVersions ? ""
+, rev-prefix ? ""
+, odd-unstable ? false
+, patchlevel-unstable ? false
+, url ? null
+}:
+
+genericUpdater {
+  inherit pname version attrPath ignoredVersions rev-prefix odd-unstable patchlevel-unstable;
+  versionLister = "${common-updater-scripts}/bin/list-archive-two-levels-versions ${lib.optionalString (url != null) "--url=${url}"}";
+}

pkgs/common-updater/scripts/list-archive-two-level-versions

@@ -1,35 +0,0 @@
-#!/usr/bin/env bash
-
-# lists all available versions listed for a package in a site (http)
-
-scriptName=list-archive-two-level-versions # do not use the .wrapped name
-
-usage() {
-    echo "Usage: $scriptName <archive url> [<package name> [<debug file path>]]"
-}
-
-archive="$1"  # archive url
-pname="$2"  # package name
-file="$3"  # file for writing debugging information
-
-if [ -z "$archive" ]; then
-    echo "$scriptName: Missing archive url"
-    usage
-    exit 1
-fi
-
-# print a debugging message
-if [ -n "$file" ]; then
-    echo "# Listing versions for $pname at $archive" >> $file
-fi
-
-# list all major-minor versions from archive
-tags1=$(curl -sS "$archive/")
-tags1=$(echo "$tags1" | sed -rne 's,^<a href="([0-9]+\.[0-9]+)/">.*,\1,p')
-
-# print available versions
-for tag in $tags1; do
-    tags2=$(curl -sS "$archive/$tag/")
-    tags2=$(echo "$tags2" | sed -rne "s,^<a href=\"$pname-([0-9.]+)\\.[^0-9].*\">.*,\\1,p")
-    echo "$tags2"
-done

pkgs/common-updater/scripts/list-archive-two-levels-versions

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+
+# lists all available versions listed for a package in a site (http)
+
+archive=""  # archive url
+pname=""  # package name
+file=""  # file for writing debugging information
+
+while (( $# > 0 )); do
+    flag="$1"
+    shift 1
+    case "$flag" in
+        --url=*)
+            archive="${flag#*=}"
+            ;;
+        --pname=*)
+            pname="${flag#*=}"
+            ;;
+        --file=*)
+            file="${flag#*=}"
+            ;;
+        *)
+            echo "$0: unknown option ‘${flag}’"
+            exit 1
+            ;;
+    esac
+done
+
+# by default set url to the base dir of the first url in src.urls
+if [[ -z "$archive" ]]; then
+    archive="$(nix-instantiate $systemArg --eval -E \
+                   "with import ./. {}; dirOf (dirOf (lib.head $UPDATE_NIX_ATTR_PATH.src.urls))" \
+            | tr -d '"')"
+fi
+
+if [[ -z "$pname" ]]; then
+    pname="$UPDATE_NIX_ATTR_PATH"
+fi
+
+# print a debugging message
+if [[ -n "$file" ]]; then
+    echo "# Listing versions for '$pname' at $archive" >> $file
+fi
+
+# list all major-minor versions from archive
+tags1=$(curl -sS "$archive/")
+tags1=$(echo "$tags1" | sed -rne 's,^<a href="([0-9]+\.[0-9]+)/">.*,\1,p')
+
+# print available versions
+for tag in $tags1; do
+    tags2=$(curl -sS "$archive/$tag/")
+    tags2=$(echo "$tags2" | sed -rne "s,^<a href=\"$pname-([0-9.]+)\\.[^0-9].*\">.*,\\1,p")
+    echo "$tags2"
+done

pkgs/common-updater/scripts/list-git-tags

@@ -2,29 +2,50 @@
 
 # lists all available tags from a git repository
 
-scriptName=list-git-tags # do not use the .wrapped name
+echo "# pname=$UPDATE_NIX_ATTR_PATH" > /tmp/test.txt
 
-usage() {
+url="" # git repository url
-    echo "Usage: $scriptName <repository url> [<package name> [<debug file path>]]"
+pname="" # package name
-}
+file="" # file for writing debugging information
 
-repo="$1" # git repository url
+while (( $# > 0 )); do
-pname="$2" # package name
+    flag="$1"
-file="$3" # file for writing debugging information
+    shift 1
+    case "$flag" in
+        --url=*)
+            url="${flag#*=}"
+            ;;
+        --pname=*)
+            pname="${flag#*=}"
+            ;;
+        --file=*)
+            file="${flag#*=}"
+            ;;
+        *)
+            echo "$0: unknown option ‘${flag}’"
+            exit 1
+            ;;
+    esac
+done
 
-if [ -z "$repo" ]; then
+# By default we set url to src.url or src.meta.homepage
-    echo "$scriptName: Missing git repository url"
+if [[ -z "$url" ]]; then
-    usage
+    url="$(nix-instantiate $systemArg --eval -E \
-    exit 1
+               "with import ./. {}; $UPDATE_NIX_ATTR_PATH.src.url or $UPDATE_NIX_ATTR_PATH.src.meta.homepage" \
+        | tr -d '"')"
+fi
+
+if [[ -z "$pname" ]]; then
+    pname="$UPDATE_NIX_ATTR_PATH"
 fi
 
 # print a debugging message
-if [ -n "$file" ]; then
+if [[ -n "$file" ]]; then
-    echo "# Listing tags for $pname at $repo" >> $file
+    echo "# Listing tags for '$pname' at $url" >> $file
 fi
 
 # list all tags from the remote repository
-tags=$(git ls-remote --tags --refs "$repo")
+tags=$(git ls-remote --tags --refs "$url")
 
 # keep only the version part of the tag
 tags=$(echo "$tags" | cut --delimiter=/ --field=3)

pkgs/data/fonts/iosevka/update-default.sh

@@ -8,7 +8,7 @@ repo=https://github.com/be5invis/Iosevka
 
 # Discover the latest version.
 current_version=$(nix-instantiate "$nixpkgs" --eval --strict -A iosevka.version | tr -d '"')
-new_version=$(list-git-tags "$repo" | sort --reverse --version-sort | awk 'match($0, /^v([0-9.]+)$/, m) { print m[1]; exit; }')
+new_version=$(list-git-tags --url="$repo" | sort --reverse --version-sort | awk 'match($0, /^v([0-9.]+)$/, m) { print m[1]; exit; }')
 if [[ "$new_version" == "$current_version" ]]; then
     echo "iosevka: no update found"
     exit

pkgs/data/fonts/parastoo-fonts/default.nix

@@ -2,7 +2,7 @@
 
 let
   pname = "parastoo-fonts";
-  version = "1.0.0-alpha5";
+  version = "2.0.1";
 in fetchFromGitHub {
   name = "${pname}-${version}";
 
@@ -14,7 +14,7 @@ in fetchFromGitHub {
     tar xf $downloadedFile --strip=1
     find . -name '*.ttf' -exec install -m444 -Dt $out/share/fonts/parastoo-fonts {} \;
   '';
-  sha256 = "10jbii6rskcy4akjl5yfcqv4mfwk3nqnx36l6sbxks43va9l04f4";
+  sha256 = "sha256-4smobLS43DB7ISmbWDWX0IrtaeiyXpi1QpAiL8NyXoQ=";
 
   meta = with lib; {
     homepage = "https://github.com/rastikerdar/parastoo-font";

pkgs/data/misc/osinfo-db/default.nix

@@ -1,15 +1,25 @@
-{ lib, stdenv, fetchurl, osinfo-db-tools, gettext, libxml2 }:
+{ lib
+, stdenv
+, fetchurl
+, osinfo-db-tools
+, gettext
+, libxml2
+}:
 
 stdenv.mkDerivation rec {
   pname = "osinfo-db";
-  version = "20211216";
+  version = "20220214";
 
   src = fetchurl {
     url = "https://releases.pagure.org/libosinfo/${pname}-${version}.tar.xz";
-    sha256 = "sha256-CeznsOUhMw4x0SpZFx408JcYGny7zW+M1J+SiSO7EII=";
+    sha256 = "sha256-E+bJAOuCAPFmD4oe13Xs7NWgH9skv7bu4c5l3XvP06k=";
   };
 
-  nativeBuildInputs = [ osinfo-db-tools gettext libxml2 ];
+  nativeBuildInputs = [
+    osinfo-db-tools
+    gettext
+    libxml2
+  ];
 
   installPhase = ''
     osinfo-db-import --dir "$out/share/osinfo" "${src}"
@@ -18,6 +28,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Osinfo database of information about operating systems for virtualization provisioning tools";
     homepage = "https://gitlab.com/libosinfo/osinfo-db/";
+    changelog = "https://gitlab.com/libosinfo/osinfo-db/-/commits/v${version}";
     license = licenses.gpl2Plus;
     platforms = platforms.linux;
     maintainers = [ maintainers.bjornfor ];

pkgs/data/themes/marwaita/default.nix

@@ -5,6 +5,7 @@
 , gtk-engine-murrine
 , gtk_engines
 , librsvg
+, gitUpdater
 }:
 
 stdenv.mkDerivation rec {
@@ -37,6 +38,8 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  passthru.updateScript = gitUpdater {inherit pname version; };
+
   meta = with lib; {
     description = "GTK theme supporting Budgie, Pantheon, Mate, Xfce4 and GNOME desktops";
     homepage = "https://www.pling.com/p/1239855/";

pkgs/desktops/cinnamon/xreader/default.nix

@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xreader";
-  version = "3.2.2";
+  version = "3.3.0";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    sha256 = "sha256-rAPc4RF2uXp1hI8/8PXDYy3DnL5vNR8rF/EEixO0FXI=";
+    sha256 = "sha256-wBrP5SHGPvH/Gz9QY253zQuf8WSjV19oNB5aIqXGLZ8=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/gnome/update.nix

@@ -1,26 +1,42 @@
-{ stdenv, pkgs, lib, writeScript, python3, common-updater-scripts }:
+{ stdenv, bash, pkgs, lib, writeScript, python3, common-updater-scripts }:
 { packageName, attrPath ? packageName, versionPolicy ? "tagged", freeze ? false }:
 
 let
   python = python3.withPackages (p: [ p.requests p.libversion ]);
-  upperBoundFlag =
+  package = lib.attrByPath (lib.splitString "." attrPath) (throw "Cannot find attribute ‘${attrPath}’.") pkgs;
+  packageVersion = lib.getVersion package;
+  upperBound =
     let
-      package = lib.attrByPath (lib.splitString "." attrPath) (throw "Cannot find attribute ‘${attrPath}’.") pkgs;
-      packageVersion = lib.getVersion package;
       versionComponents = lib.versions.splitVersion packageVersion;
       minorVersion = lib.versions.minor packageVersion;
       minorAvailable = builtins.length versionComponents > 1 && builtins.match "[0-9]+" minorVersion != null;
       nextMinor = builtins.fromJSON minorVersion + 1;
       upperBound = "${lib.versions.major packageVersion}.${builtins.toString nextMinor}";
-    in lib.optionalString (freeze && minorAvailable) ''--upper-bound="${upperBound}"'';
+    in lib.optionals (freeze && minorAvailable) [ upperBound ];
   updateScript = writeScript "gnome-update-script" ''
-    #!${stdenv.shell}
+    #!${bash}/bin/bash
     set -o errexit
-    package_name="$1"
+    attr_path="$1"
-    attr_path="$2"
+    package_name="$2"
-    version_policy="$3"
+    package_version="$3"
+    version_policy="$4"
+
+    flvFlags=("$package_name" "$version_policy" "''${GNOME_UPDATE_STABILITY:-stable}")
+
+    if (( $# >= 5 )); then
+      upper_bound="$5"
+      flvFlags+=("--upper-bound=$upper_bound")
+    fi
+
     PATH=${lib.makeBinPath [ common-updater-scripts python ]}
-    latest_tag=$(python "${./find-latest-version.py}" "$package_name" "$version_policy" "stable" ${upperBoundFlag})
+    latest_tag=$(python "${./find-latest-version.py}" "''${flvFlags[@]}")
     update-source-version "$attr_path" "$latest_tag"
+    echo '[ { "commitBody": "https://gitlab.gnome.org/GNOME/'$package_name'/-/compare/'$package_version'...'$latest_tag'" } ]'
   '';
-in [ updateScript packageName attrPath versionPolicy ]
+in {
+  name = "gnome-update-script";
+  command = [ updateScript attrPath packageName packageVersion versionPolicy ] ++ upperBound;
+  supportedFeatures = [
+    "commit"
+  ];
+}

pkgs/desktops/lxqt/default.nix

@@ -4,10 +4,9 @@ let
 
     # Update script tailored to LXQt packages from git repository
     lxqtUpdateScript = { pname, version, src }:
-      pkgs.genericUpdater {
+      pkgs.gitUpdater {
         inherit pname version;
         attrPath = "lxqt.${pname}";
-        versionLister = "${pkgs.common-updater-scripts}/bin/list-git-tags ${src.meta.homepage}";
       };
 
     # For compiling information, see:

pkgs/desktops/mate/default.nix

@@ -7,10 +7,9 @@ let
 
     # Update script tailored to mate packages from git repository
     mateUpdateScript = { pname, version, odd-unstable ? true, url ? "https://pub.mate-desktop.org/releases" }:
-      pkgs.genericUpdater {
+      pkgs.httpTwoLevelsUpdater {
-        inherit pname version odd-unstable;
+        inherit pname version odd-unstable url;
         attrPath = "mate.${pname}";
-        versionLister = "${pkgs.common-updater-scripts}/bin/list-archive-two-level-versions ${url}";
       };
 
     atril = callPackage ./atril { };

pkgs/desktops/mate/mate-tweak/default.nix

@@ -9,8 +9,7 @@
 , gobject-introspection
 , wrapGAppsHook
 , glib
-, genericUpdater
+, gitUpdater
-, common-updater-scripts
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -74,10 +73,9 @@ python3Packages.buildPythonApplication rec {
     done
   '';
 
-  passthru.updateScript = genericUpdater {
+  passthru.updateScript = gitUpdater {
     inherit pname version;
     attrPath = "mate.${pname}";
-    versionLister = "${common-updater-scripts}/bin/list-git-tags ${src.meta.homepage}";
   };
 
   meta = with lib; {

pkgs/desktops/plasma-5/3rdparty/kwin/scripts/krohnkite.nix

@@ -3,13 +3,13 @@
 
 mkDerivation rec {
   pname = "krohnkite";
-  version = "0.7";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "esjeon";
     repo = "krohnkite";
     rev = "v${version}";
-    sha256 = "0j3rm1w6d545qlmx02xs72b5zsigm48hp7lp7yh30z3cjqm00aap";
+    hash = "sha256-HZCD5884pHuHey+d+HRx/F/Sp1b6ZUy7MdqqZ08H0lU=";
   };
 
   buildInputs = [

pkgs/desktops/xfce/applications/orage/default.nix

@@ -38,10 +38,9 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  passthru.updateScript = xfce.updateScript {
+  passthru.updateScript = xfce.archiveUpdater {
+    category = "apps";
     inherit pname version;
-    attrPath = "xfce.${pname}";
-    versionLister = xfce.archiveLister "apps" pname;
   };
 
   meta = with lib; {

pkgs/desktops/xfce/art/xfce4-icon-theme/default.nix

@@ -28,11 +28,7 @@ stdenv.mkDerivation rec {
 
   dontDropIconThemeCache = true;
 
-  passthru.updateScript = xfce.updateScript {
+  passthru.updateScript = xfce.archiveUpdater { inherit category pname version; };
-    inherit pname version;
-    attrPath = "xfce.${pname}";
-    versionLister = xfce.archiveLister category pname;
-  };
 
   meta = with lib; {
     homepage = "https://www.xfce.org/";

pkgs/desktops/xfce/art/xfwm4-themes/default.nix

@@ -13,11 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-MhTV8A6XA7XoyefDKH1gbe3scoXOtNXbMy6TraZv1XU=";
   };
 
-  passthru.updateScript = xfce.updateScript {
+  passthru.updateScript = xfce.archiveUpdater { inherit category pname version; };
-    inherit pname version;
-    attrPath = "xfce.${pname}";
-    versionLister = xfce.archiveLister category pname;
-  };
 
   meta = with lib; {
     homepage = "https://www.xfce.org/";

pkgs/desktops/xfce/default.nix

@@ -3,13 +3,14 @@
 lib.makeScope pkgs.newScope (self: with self; {
   #### NixOS support
 
-  updateScript = pkgs.genericUpdater;
+  genericUpdater = pkgs.genericUpdater;
 
-  gitLister = url:
+  archiveUpdater = { category, pname, version }:
-    "${pkgs.common-updater-scripts}/bin/list-git-tags ${url}";
+    pkgs.httpTwoLevelsUpdater {
-
+      inherit pname version;
-  archiveLister = category: name:
+      attrPath = "xfce.${pname}";
-    "${pkgs.common-updater-scripts}/bin/list-archive-two-level-versions https://archive.xfce.org/src/${category}/${name}";
+      url = "https://archive.xfce.org/src/${category}/${pname}";
+    };
 
   mkXfceDerivation = callPackage ./mkXfceDerivation.nix { };
 

pkgs/desktops/xfce/mkXfceDerivation.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitLab, pkg-config, xfce4-dev-tools, hicolor-icon-theme, xfce, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitLab, pkg-config, xfce4-dev-tools, hicolor-icon-theme, xfce, wrapGAppsHook, gitUpdater }:
 
 { category
 , pname
@@ -41,9 +41,8 @@ let
 
     pos = builtins.unsafeGetAttrPos "pname" args;
 
-    passthru.updateScript = xfce.updateScript {
+    passthru.updateScript = gitUpdater {
       inherit pname version attrPath rev-prefix odd-unstable patchlevel-unstable;
-      versionLister = xfce.gitLister src.meta.homepage;
     };
 
     meta = with lib; {

pkgs/desktops/xfce/panel-plugins/xfce4-cpugraph-plugin/default.nix

@@ -45,11 +45,7 @@ in stdenv.mkDerivation rec {
     hicolor-icon-theme
   ];
 
-  passthru.updateScript = xfce.updateScript {
+  passthru.updateScript = xfce.archiveUpdater { inherit category pname version; };
-    inherit pname version;
-    attrPath = "xfce.${pname}";
-    versionLister = xfce.archiveLister category pname;
-  };
 
   meta = with lib; {
     homepage = "https://docs.xfce.org/panel-plugins/xfce4-cpugraph-plugin";

pkgs/desktops/xfce/panel-plugins/xfce4-embed-plugin/default.nix

@@ -33,11 +33,7 @@ in stdenv.mkDerivation rec {
     gtk2
   ];
 
-  passthru.updateScript = xfce.updateScript {
+  passthru.updateScript = xfce.archiveUpdater { inherit category pname version; };
-    inherit pname version;
-    attrPath = "xfce.${pname}";
-    versionLister = xfce.archiveLister category pname;
-  };
 
   meta = with lib;{
     homepage = "https://docs.xfce.org/panel-plugins/xfce4-embed-plugin";

pkgs/desktops/xfce/panel-plugins/xfce4-eyes-plugin/default.nix

@@ -35,11 +35,7 @@ in stdenv.mkDerivation rec {
     gtk3
   ];
 
-  passthru.updateScript = xfce.updateScript {
+  passthru.updateScript = xfce.archiveUpdater { inherit category pname version; };
-    inherit pname version;
-    attrPath = "xfce.${pname}";
-    versionLister = xfce.archiveLister category pname;
-  };
 
   meta = with lib; {
     homepage = "https://docs.xfce.org/panel-plugins/xfce4-eyes-plugin";

pkgs/desktops/xfce/panel-plugins/xfce4-fsguard-plugin/default.nix

@@ -35,11 +35,7 @@ in stdenv.mkDerivation rec {
     gtk3
   ];
 
-  passthru.updateScript = xfce.updateScript {
+  passthru.updateScript = xfce.archiveUpdater { inherit category pname version; };
-    inherit pname version;
-    attrPath = "xfce.${pname}";
-    versionLister = xfce.archiveLister category pname;
-  };
 
   meta = with lib; {
     homepage = "https://docs.xfce.org/panel-plugins/xfce4-fsguard-plugin";

pkgs/desktops/xfce/panel-plugins/xfce4-genmon-plugin/default.nix

@@ -33,11 +33,7 @@ in stdenv.mkDerivation rec {
     gtk3
   ];
 
-  passthru.updateScript = xfce.updateScript {
+  passthru.updateScript = xfce.archiveUpdater { inherit category pname version; };
-    inherit pname version;
-    attrPath = "xfce.${pname}";
-    versionLister = xfce.archiveLister category pname;
-  };
 
   meta = with lib; {
     homepage = "https://docs.xfce.org/panel-plugins/xfce4-genmon-plugin";

pkgs/desktops/xfce/panel-plugins/xfce4-mailwatch-plugin/default.nix

@@ -27,11 +27,7 @@ stdenv.mkDerivation rec {
     libgcrypt
   ];
 
-  passthru.updateScript = xfce.updateScript {
+  passthru.updateScript = xfce.archiveUpdater { inherit category pname version; };
-    inherit pname version;
-    attrPath = "xfce.${pname}";
-    versionLister = xfce.archiveLister category pname;
-  };
 
   meta = with lib; {
     homepage = "https://docs.xfce.org/panel-plugins/xfce4-mailwatch-plugin";

pkgs/desktops/xfce/panel-plugins/xfce4-mpc-plugin/default.nix

@@ -27,11 +27,7 @@ stdenv.mkDerivation rec {
     exo
   ];
 
-  passthru.updateScript = xfce.updateScript {
+  passthru.updateScript = xfce.archiveUpdater { inherit category pname version; };
-    inherit pname version;
-    attrPath = "xfce.${pname}";
-    versionLister = xfce.archiveLister category pname;
-  };
 
   meta = with lib; {
     homepage = "https://docs.xfce.org/panel-plugins/xfce4-mpc-plugin";

pkgs/desktops/xfce/panel-plugins/xfce4-namebar-plugin/default.nix

@@ -1,5 +1,7 @@
 { lib, stdenv, pkg-config, fetchFromGitHub, python3, vala
-, gtk3, libwnck, libxfce4util, xfce4-panel, wafHook, xfce }:
+, gtk3, libwnck, libxfce4util, xfce4-panel, wafHook, xfce
+, gitUpdater
+}:
 
 stdenv.mkDerivation rec {
   pname = "xfce4-namebar-plugin";
@@ -20,10 +22,9 @@ stdenv.mkDerivation rec {
     substituteInPlace src/preferences.vala --replace 'var dir_strings = Environment.get_system_data_dirs()' "string[] dir_strings = { \"$out/share\" }"
   '';
 
-  passthru.updateScript = xfce.updateScript {
+  passthru.updateScript = gitUpdater {
     inherit pname version;
     attrPath = "xfce.${pname}";
-    versionLister = xfce.gitLister src.meta.homepage;
     rev-prefix = "v";
   };
 

pkgs/desktops/xfce/panel-plugins/xfce4-notes-plugin/default.nix

@@ -31,11 +31,7 @@ in stdenv.mkDerivation rec {
     xfconf
   ];
 
-  passthru.updateScript = xfce.updateScript {
+  passthru.updateScript = xfce.archiveUpdater { inherit category pname version; };
-    inherit pname version;
-    attrPath = "xfce.${pname}";
-    versionLister = xfce.archiveLister category pname;
-  };
 
   meta = with lib; {
     homepage = "https://docs.xfce.org/panel-plugins/xfce4-notes-plugin";

pkgs/desktops/xfce/panel-plugins/xfce4-sensors-plugin/default.nix

@@ -38,11 +38,7 @@ stdenv.mkDerivation rec {
     "--with-pathnetcat=${netcat-gnu}/bin/netcat"
   ];
 
-  passthru.updateScript = xfce.updateScript {
+  passthru.updateScript = xfce.archiveUpdater { inherit category pname version; };
-    inherit pname version;
-    attrPath = "xfce.${pname}";
-    versionLister = xfce.archiveLister category pname;
-  };
 
   meta = with lib; {
     homepage = "https://docs.xfce.org/panel-plugins/xfce4-sensors-plugin";