Merge branch 'master' into staging-next-2022-04-23

2022-04-30 23:02:28 +02:00 · 2022-04-30 23:02:28 +02:00 · c480cc2895
commit c480cc2895
parent 6431e183cd 16cdb34f95
314 changed files with 71444 additions and 1717 deletions
--- a/.github/workflows/update-terraform-providers.yml
+++ b/.github/workflows/update-terraform-providers.yml
@ -25,7 +25,7 @@ jobs:
          git commit -m "${{ steps.setup.outputs.title }}" providers.json
          popd
      - name: create PR
-        uses: peter-evans/create-pull-request@v3
+        uses: peter-evans/create-pull-request@v4
        with:
          body: |
            Automatic update by [update-terraform-providers](https://github.com/NixOS/nixpkgs/blob/master/.github/workflows/update-terraform-providers.yml) action.
--- a/lib/modules.nix
+++ b/lib/modules.nix
@ -160,7 +160,10 @@ rec {
            type = types.lazyAttrsOf types.raw;
            # Only render documentation once at the root of the option tree,
            # not for all individual submodules.
-            internal = prefix != [];
+            # Allow merging option decls to make this internal regardless.
+            ${if prefix == []
+              then null  # unset => visible
+              else "internal"} = true;
            # TODO: Change the type of this option to a submodule with a
            # freeformType, so that individual arguments can be documented
            # separately
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -525,6 +525,12 @@
    githubId = 38869148;
    name = "Alex Eyre";
  };
+  algram = {
+    email = "aliasgram@gmail.com";
+    github = "Algram";
+    githubId = 5053729;
+    name = "Alias Gram";
+  };
  alibabzo = {
    email = "alistair.bill@gmail.com";
    github = "alibabzo";
@ -2061,6 +2067,12 @@
    githubId = 8228888;
    name = "Charlie Hanley";
  };
+  charlesbaynham = {
+    email = "charlesbaynham@gmail.com";
+    github = "charlesbaynham";
+    githubId = 4397637;
+    name = "Charles Baynham";
+  };
  CharlesHD = {
    email = "charleshdespointes@gmail.com";
    github = "CharlesHD";
@ -4093,11 +4105,18 @@
    matrix = "@felschr:matrix.org";
    github = "felschr";
    githubId = 3314323;
-    name = "Felix Tenley";
-    keys = [{
-      longkeyid = "ed25519/0x910ACB9F6BD26F58";
-      fingerprint = "6AB3 7A28 5420 9A41 82D9  0068 910A CB9F 6BD2 6F58";
-    }];
+    name = "Felix Schröter";
+    keys = [
+      {
+        # historical
+        longkeyid = "ed25519/0x910ACB9F6BD26F58";
+        fingerprint = "6AB3 7A28 5420 9A41 82D9  0068 910A CB9F 6BD2 6F58";
+      }
+      {
+        longkeyid = "ed25519/0x671E39E6744C807D";
+        fingerprint = "7E08 6842 0934 AA1D 6821  1F2A 671E 39E6 744C 807D";
+      }
+    ];
  };
  ffinkdevs = {
    email = "fink@h0st.space";
@ -12018,6 +12037,12 @@
    githubId = 1694705;
    name = "Sam Stites";
  };
+  strager = {
+    email = "strager.nds@gmail.com";
+    github = "strager";
+    githubId = 48666;
+    name = "Matthew \"strager\" Glazar";
+  };
  stumoss = {
    email = "samoss@gmail.com";
    github = "stumoss";
@ -12762,6 +12787,13 @@
    githubId = 90456;
    name = "Rebecca (Bex) Kelly";
  };
+  tpw_rules = {
+    name = "Thomas Watson";
+    email = "twatson52@icloud.com";
+    matrix = "@tpw_rules:matrix.org";
+    github = "tpwrules";
+    githubId = 208010;
+  };
  travisbhartwell = {
    email = "nafai@travishartwell.net";
    github = "travisbhartwell";
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -1292,7 +1292,7 @@ Existing 3rd party modules that provided similar functionality, like <literal>pu
          <literal>systemd-shutdown</literal> is now properly linked on
          shutdown to unmount all filesystems and device mapper devices
          cleanly. This can be disabled using
-          <literal>boot.systemd.shutdown.enable</literal>.
+          <literal>systemd.shutdownRamfs.enable</literal>.
        </para>
      </listitem>
      <listitem>
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -513,7 +513,7 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `systemd-nspawn@.service` settings have been reverted to the default systemd behaviour. User namespaces are now activated by default. If you want to keep running nspawn containers without user namespaces you need to set `systemd.nspawn.<name>.execConfig.PrivateUsers = false`

- `systemd-shutdown` is now properly linked on shutdown to unmount all filesystems and device mapper devices cleanly. This can be disabled using `boot.systemd.shutdown.enable`.
+- `systemd-shutdown` is now properly linked on shutdown to unmount all filesystems and device mapper devices cleanly. This can be disabled using `systemd.shutdownRamfs.enable`.

 - The Tor SOCKS proxy is now actually disabled if `services.tor.client.enable` is set to `false` (the default). If you are using this functionality but didn't change the setting or set it to `false`, you now need to set it to `true`.

--- a/nixos/lib/systemd-types.nix
+++ b/nixos/lib/systemd-types.nix
@ -1,4 +1,4 @@
-{ lib, systemdUtils }:
+{ lib, systemdUtils, pkgs }:

 with systemdUtils.lib;
 with systemdUtils.unitOptions;
@ -34,4 +34,36 @@ rec {

  automounts = with types; listOf (submodule [ stage2AutomountOptions unitConfig automountConfig ]);
  initrdAutomounts = with types; attrsOf (submodule [ stage1AutomountOptions unitConfig automountConfig ]);
+
+  initrdContents = types.attrsOf (types.submodule ({ config, options, name, ... }: {
+    options = {
+      enable = mkEnableOption "copying of this file and symlinking it" // { default = true; };
+
+      target = mkOption {
+        type = types.path;
+        description = ''
+          Path of the symlink.
+        '';
+        default = name;
+      };
+
+      text = mkOption {
+        default = null;
+        type = types.nullOr types.lines;
+        description = "Text of the file.";
+      };
+
+      source = mkOption {
+        type = types.path;
+        description = "Path of the source file.";
+      };
+    };
+
+    config = {
+      source = mkIf (config.text != null) (
+        let name' = "initrd-" + baseNameOf name;
+        in mkDerivedConfig options.text (pkgs.writeText name')
+      );
+    };
+  }));
 }
--- a/nixos/lib/utils.nix
+++ b/nixos/lib/utils.nix
@ -213,6 +213,6 @@ rec {
  systemdUtils = {
    lib = import ./systemd-lib.nix { inherit lib config pkgs; };
    unitOptions = import ./systemd-unit-options.nix { inherit lib systemdUtils; };
-    types = import ./systemd-types.nix { inherit lib systemdUtils; };
+    types = import ./systemd-types.nix { inherit lib systemdUtils pkgs; };
  };
 }
--- a/nixos/modules/config/console.nix
+++ b/nixos/modules/config/console.nix
@ -149,8 +149,11 @@ in
        '');

        boot.initrd.systemd.contents = {
-          "/etc/kbd".source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share";
          "/etc/vconsole.conf".source = vconsoleConf;
+          # Add everything if we want full console setup...
+          "/etc/kbd" = lib.mkIf cfg.earlySetup { source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share"; };
+          # ...but only the keymaps if we don't
+          "/etc/kbd/keymaps" = lib.mkIf (!cfg.earlySetup) { source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share/keymaps"; };
        };
        boot.initrd.systemd.storePaths = [
          "${config.boot.initrd.systemd.package}/lib/systemd/systemd-vconsole-setup"
@ -180,7 +183,7 @@ in
        ];
      })

-      (mkIf cfg.earlySetup {
+      (mkIf (cfg.earlySetup && !config.boot.inird.systemd.enable) {
        boot.initrd.extraUtilsCommands = ''
          mkdir -p $out/share/consolefonts
          ${if substring 0 1 cfg.font == "/" then ''
@ -194,10 +197,6 @@ in
            cp -L $font $out/share/consolefonts/font.psf
          fi
        '';
-        assertions = [{
-          assertion = !config.boot.initrd.systemd.enable;
-          message = "console.earlySetup is implied by systemd stage 1";
-        }];
      })
    ]))
  ];
--- a/nixos/modules/hardware/all-firmware.nix
+++ b/nixos/modules/hardware/all-firmware.nix
@ -85,7 +85,10 @@ in {
        b43Firmware_6_30_163_46
        b43FirmwareCutter
        xow_dongle-firmware
-      ] ++ optional pkgs.stdenv.hostPlatform.isx86 facetimehd-firmware;
+      ] ++ optionals pkgs.stdenv.hostPlatform.isx86 [
+        facetimehd-calibration
+        facetimehd-firmware
+      ];
    })
    (mkIf cfg.wirelessRegulatoryDatabase {
      hardware.firmware = [ pkgs.wireless-regdb ];
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@ -361,11 +361,12 @@ in
    services.udev.extraRules =
      ''
        # Create /dev/nvidia-uvm when the nvidia-uvm module is loaded.
-        KERNEL=="nvidia", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidiactl c $$(grep nvidia-frontend /proc/devices | cut -d \  -f 1) 255'"
-        KERNEL=="nvidia_modeset", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-modeset c $$(grep nvidia-frontend /proc/devices | cut -d \  -f 1) 254'"
-        KERNEL=="card*", SUBSYSTEM=="drm", DRIVERS=="nvidia", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia%n c $$(grep nvidia-frontend /proc/devices | cut -d \  -f 1) %n'"
+        KERNEL=="nvidia", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidiactl c 195 255'"
+        KERNEL=="nvidia_modeset", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-modeset c 195 254'"
+        KERNEL=="card*", SUBSYSTEM=="drm", DRIVERS=="nvidia", PROGRAM="${pkgs.gnugrep}/bin/grep 'Device Minor:' /proc/driver/nvidia/gpus/%b/information", \
+          RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia%c{3} c 195 %c{3}"
        KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 0'"
-        KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm-tools c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 0'"
+        KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm-tools c $$(grep nvidia-uvm /proc/devices | cut -d \  -f 1) 1'"
      '' + optionalString cfg.powerManagement.finegrained ''
        # Remove NVIDIA USB xHCI Host Controller devices, if present
        ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x0c0330", ATTR{remove}="1"
--- a/nixos/modules/hardware/video/webcam/facetimehd.nix
+++ b/nixos/modules/hardware/video/webcam/facetimehd.nix
@ -14,6 +14,18 @@ in

  options.hardware.facetimehd.enable = mkEnableOption "facetimehd kernel module";

+  options.hardware.facetimehd.withCalibration = mkOption {
+    default = false;
+    example = true;
+    type = types.bool;
+    description = ''
+      Whether to include sensor calibration files for facetimehd.
+      This makes colors look much better but is experimental, see
+      <link xlink:href="https://github.com/patjak/facetimehd/wiki/Extracting-the-sensor-calibration-files"/>
+      for details.
+    '';
+  };
+
  config = mkIf cfg.enable {

    boot.kernelModules = [ "facetimehd" ];
@ -22,7 +34,8 @@ in

    boot.extraModulePackages = [ kernelPackages.facetimehd ];

-    hardware.firmware = [ pkgs.facetimehd-firmware ];
+    hardware.firmware = [ pkgs.facetimehd-firmware ]
+      ++ optional cfg.withCalibration pkgs.facetimehd-calibration;

    # unload module during suspend/hibernate as it crashes the whole system
    powerManagement.powerDownCommands = ''
--- a/nixos/modules/installer/cd-dvd/channel.nix
+++ b/nixos/modules/installer/cd-dvd/channel.nix
@ -39,7 +39,8 @@ in
        echo "unpacking the NixOS/Nixpkgs sources..."
        mkdir -p /nix/var/nix/profiles/per-user/root
        ${config.nix.package.out}/bin/nix-env -p /nix/var/nix/profiles/per-user/root/channels \
-          -i ${channelSources} --quiet --option build-use-substitutes false
+          -i ${channelSources} --quiet --option build-use-substitutes false \
+          ${optionalString config.boot.initrd.systemd.enable "--option sandbox false"} # There's an issue with pivot_root
        mkdir -m 0700 -p /root/.nix-defexpr
        ln -s /nix/var/nix/profiles/per-user/root/channels /root/.nix-defexpr/channels
        mkdir -m 0755 -p /var/lib/nixos
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -172,6 +172,7 @@
  ./programs/java.nix
  ./programs/k40-whisperer.nix
  ./programs/kclock.nix
+  ./programs/k3b.nix
  ./programs/kdeconnect.nix
  ./programs/kbdlight.nix
  ./programs/less.nix
@ -662,6 +663,7 @@
  ./services/monitoring/longview.nix
  ./services/monitoring/mackerel-agent.nix
  ./services/monitoring/metricbeat.nix
+  ./services/monitoring/mimir.nix
  ./services/monitoring/monit.nix
  ./services/monitoring/munin.nix
  ./services/monitoring/nagios.nix
@ -1182,13 +1184,14 @@
  ./system/boot/stage-2.nix
  ./system/boot/systemd.nix
  ./system/boot/systemd/coredump.nix
+  ./system/boot/systemd/initrd-secrets.nix
+  ./system/boot/systemd/initrd.nix
  ./system/boot/systemd/journald.nix
  ./system/boot/systemd/logind.nix
  ./system/boot/systemd/nspawn.nix
  ./system/boot/systemd/shutdown.nix
  ./system/boot/systemd/tmpfiles.nix
  ./system/boot/systemd/user.nix
-  ./system/boot/systemd/initrd.nix
  ./system/boot/timesyncd.nix
  ./system/boot/tmp.nix
  ./system/etc/etc-activation.nix
--- a/nixos/modules/profiles/installation-device.nix
+++ b/nixos/modules/profiles/installation-device.nix
@ -99,6 +99,10 @@ with lib;
        stdenvNoCC # for runCommand
        busybox
        jq # for closureInfo
+        # For boot.initrd.systemd
+        makeInitrdNGTool
+        systemdStage1
+        systemdStage1Network
      ];

    # Show all debug messages from the kernel but don't log refused packets
--- a/nixos/modules/profiles/qemu-guest.nix
+++ b/nixos/modules/profiles/qemu-guest.nix
@ -1,13 +1,13 @@
 # Common configuration for virtual machines running under QEMU (using
 # virtio).

-{ ... }:
+{ config, lib, ... }:

 {
  boot.initrd.availableKernelModules = [ "virtio_net" "virtio_pci" "virtio_mmio" "virtio_blk" "virtio_scsi" "9p" "9pnet_virtio" ];
  boot.initrd.kernelModules = [ "virtio_balloon" "virtio_console" "virtio_rng" ];

-  boot.initrd.postDeviceCommands =
+  boot.initrd.postDeviceCommands = lib.mkIf (!config.boot.initrd.systemd.enable)
    ''
      # Set the system time from the hardware clock to work around a
      # bug in qemu-kvm > 1.5.2 (where the VM clock is initialised
--- a/nixos/modules/programs/k3b.nix
+++ b/nixos/modules/programs/k3b.nix
@ -0,0 +1,52 @@
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+{
+  # interface
+  options.programs.k3b = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to enable k3b, the KDE disk burning application.
+
+        Additionally to installing <package>k3b</package> enabling this will
+        add <literal>setuid</literal> wrappers in <literal>/run/wrappers/bin</literal>
+        for both <package>cdrdao</package> and <package>cdrecord</package>. On first
+        run you must manually configure the path of <package>cdrdae</package> and
+        <package>cdrecord</package> to correspond to the appropriate paths under
+        <literal>/run/wrappers/bin</literal> in the "Setup External Programs" menu.
+      '';
+    };
+  };
+
+  # implementation
+  config = mkIf config.programs.k3b.enable {
+
+    environment.systemPackages = with pkgs; [
+      k3b
+      dvdplusrwtools
+      cdrdao
+      cdrkit
+    ];
+
+    security.wrappers = {
+      cdrdao = {
+        setuid = true;
+        owner = "root";
+        group = "cdrom";
+        permissions = "u+wrx,g+x";
+        source = "${pkgs.cdrdao}/bin/cdrdao";
+      };
+      cdrecord = {
+        setuid = true;
+        owner = "root";
+        group = "cdrom";
+        permissions = "u+wrx,g+x";
+        source = "${pkgs.cdrkit}/bin/cdrecord";
+      };
+    };
+
+  };
+}
--- a/nixos/modules/services/databases/couchdb.nix
+++ b/nixos/modules/services/databases/couchdb.nix
@ -193,6 +193,11 @@ in {

      preStart = ''
        touch ${cfg.configFile}
+        if ! test -e ${cfg.databaseDir}/.erlang.cookie; then
+          touch ${cfg.databaseDir}/.erlang.cookie
+          chmod 600 ${cfg.databaseDir}/.erlang.cookie
+          dd if=/dev/random bs=16 count=1 | base64 > ${cfg.databaseDir}/.erlang.cookie
+        fi
      '';

      environment = {
@ -204,6 +209,7 @@ in {
        ERL_FLAGS= ''-couch_ini ${cfg.package}/etc/default.ini ${configFile} ${pkgs.writeText "couchdb-extra.ini" cfg.extraConfig} ${cfg.configFile}'';
        # 5. the vm.args file
        COUCHDB_ARGS_FILE=''${cfg.argsFile}'';
+        HOME =''${cfg.databaseDir}'';
      };

      serviceConfig = {
--- a/nixos/modules/services/monitoring/mimir.nix
+++ b/nixos/modules/services/monitoring/mimir.nix
@ -0,0 +1,63 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib) escapeShellArgs mkEnableOption mkIf mkOption types;
+
+  cfg = config.services.mimir;
+
+  settingsFormat = pkgs.formats.yaml {};
+in {
+  options.services.mimir = {
+    enable = mkEnableOption "mimir";
+
+    configuration = mkOption {
+      type = (pkgs.formats.json {}).type;
+      default = {};
+      description = ''
+        Specify the configuration for Mimir in Nix.
+      '';
+    };
+
+    configFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        Specify a configuration file that Mimir should use.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [{
+      assertion = (
+        (cfg.configuration == {} -> cfg.configFile != null) &&
+        (cfg.configFile != null -> cfg.configuration == {})
+      );
+      message  = ''
+        Please specify either
+        'services.mimir.configuration' or
+        'services.mimir.configFile'.
+      '';
+    }];
+
+    systemd.services.mimir = {
+      description = "mimir Service Daemon";
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = let
+        conf = if cfg.configFile == null
+               then settingsFormat.generate "config.yaml" cfg.configuration
+               else cfg.configFile;
+      in
+      {
+        ExecStart = "${pkgs.grafana-mimir}/bin/mimir --config.file=${conf}";
+        DynamicUser = true;
+        Restart = "always";
+        ProtectSystem = "full";
+        DevicePolicy = "closed";
+        NoNewPrivileges = true;
+        StateDirectory = "mimir";
+      };
+    };
+  };
+}
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@ -992,6 +992,7 @@ in
      ];
      storePaths = [
        "${config.boot.initrd.systemd.package}/lib/systemd/systemd-cryptsetup"
+        "${config.boot.initrd.systemd.package}/lib/systemd/system-generators/systemd-cryptsetup-generator"
      ];

    };
--- a/nixos/modules/system/boot/systemd/initrd-secrets.nix
+++ b/nixos/modules/system/boot/systemd/initrd-secrets.nix
@ -0,0 +1,36 @@
+{ config, pkgs, lib, ... }:
+
+{
+  config = lib.mkIf (config.boot.initrd.enable && config.boot.initrd.systemd.enable) {
+    # Copy secrets into the initrd if they cannot be appended
+    boot.initrd.systemd.contents = lib.mkIf (!config.boot.loader.supportsInitrdSecrets)
+      (lib.mapAttrs' (dest: source: lib.nameValuePair "/.initrd-secrets/${dest}" { source = if source == null then dest else source; }) config.boot.initrd.secrets);
+
+    # Copy secrets to their respective locations
+    boot.initrd.systemd.services.initrd-nixos-copy-secrets = lib.mkIf (config.boot.initrd.secrets != {}) {
+      description = "Copy secrets into place";
+      # Run as early as possible
+      wantedBy = [ "sysinit.target" ];
+      before = [ "cryptsetup-pre.target" ];
+      unitConfig.DefaultDependencies = false;
+
+      # We write the secrets to /.initrd-secrets and move them because this allows
+      # secrets to be written to /run. If we put the secret directly to /run and
+      # drop this service, we'd mount the /run tmpfs over the secret, making it
+      # invisible in stage 2.
+      script = ''
+        for secret in $(cd /.initrd-secrets; find . -type f); do
+          mkdir -p "$(dirname "/$secret")"
+          cp "/.initrd-secrets/$secret" "/$secret"
+        done
+      '';
+
+      unitConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+    };
+    # The script needs this
+    boot.initrd.systemd.extraBin.find = "${pkgs.findutils}/bin/find";
+  };
+}
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@ -105,6 +105,9 @@ let
        opts = options ++ optional autoFormat "x-systemd.makefs" ++ optional autoResize "x-systemd.growfs";
      in "${device} /sysroot${mountPoint} ${fsType} ${lib.concatStringsSep "," opts}") fileSystems);

+  needMakefs = lib.any (fs: fs.autoFormat) fileSystems;
+  needGrowfs = lib.any (fs: fs.autoResize) fileSystems;
+
  kernel-name = config.boot.kernelPackages.kernel.name or "kernel";
  modulesTree = config.system.modulesTree.override { name = kernel-name + "-modules"; };
  firmware = config.hardware.firmware;
@ -155,37 +158,7 @@ in {
      '';
      visible = false;
      default = {};
-      type = types.attrsOf (types.submodule ({ config, options, name, ... }: {
-        options = {
-          enable = mkEnableOption "copying of this file to initrd and symlinking it" // { default = true; };
-
-          target = mkOption {
-            type = types.path;
-            description = ''
-              Path of the symlink.
-            '';
-            default = name;
-          };
-
-          text = mkOption {
-            default = null;
-            type = types.nullOr types.lines;
-            description = "Text of the file.";
-          };
-
-          source = mkOption {
-            type = types.path;
-            description = "Path of the source file.";
-          };
-        };
-
-        config = {
-          source = mkIf (config.text != null) (
-            let name' = "initrd-" + baseNameOf name;
-            in mkDerivedConfig options.text (pkgs.writeText name')
-          );
-        };
-      }));
+      type = utils.systemdUtils.types.initrdContents;
    };

    storePaths = mkOption {
@ -390,18 +363,22 @@ in {
      storePaths = [
        # systemd tooling
        "${cfg.package}/lib/systemd/systemd-fsck"
-        "${cfg.package}/lib/systemd/systemd-growfs"
+        (lib.mkIf needGrowfs "${cfg.package}/lib/systemd/systemd-growfs")
        "${cfg.package}/lib/systemd/systemd-hibernate-resume"
        "${cfg.package}/lib/systemd/systemd-journald"
-        "${cfg.package}/lib/systemd/systemd-makefs"
+        (lib.mkIf needMakefs "${cfg.package}/lib/systemd/systemd-makefs")
        "${cfg.package}/lib/systemd/systemd-modules-load"
        "${cfg.package}/lib/systemd/systemd-remount-fs"
        "${cfg.package}/lib/systemd/systemd-shutdown"
        "${cfg.package}/lib/systemd/systemd-sulogin-shell"
        "${cfg.package}/lib/systemd/systemd-sysctl"

-        # additional systemd directories
-        "${cfg.package}/lib/systemd/system-generators"
+        # generators
+        "${cfg.package}/lib/systemd/system-generators/systemd-debug-generator"
+        "${cfg.package}/lib/systemd/system-generators/systemd-fstab-generator"
+        "${cfg.package}/lib/systemd/system-generators/systemd-gpt-auto-generator"
+        "${cfg.package}/lib/systemd/system-generators/systemd-hibernate-resume-generator"
+        "${cfg.package}/lib/systemd/system-generators/systemd-run-generator"

        # utilities needed by systemd
        "${cfg.package.util-linux}/bin/mount"
@ -439,8 +416,8 @@ in {
        mkdir -p $out/etc/systemd/system
        touch $out/etc/systemd/system/systemd-{makefs,growfs}@.service
      '')];
-      services."systemd-makefs@".unitConfig.IgnoreOnIsolate = true;
-      services."systemd-growfs@".unitConfig.IgnoreOnIsolate = true;
+      services."systemd-makefs@" = lib.mkIf needMakefs { unitConfig.IgnoreOnIsolate = true; };
+      services."systemd-growfs@" = lib.mkIf needGrowfs { unitConfig.IgnoreOnIsolate = true; };

      services.initrd-nixos-activation = {
        after = [ "initrd-fs.target" ];
@ -502,6 +479,21 @@ in {
          ''systemctl --no-block switch-root /sysroot "''${NEW_INIT}"''
        ];
      };
+
+      services.panic-on-fail = {
+        wantedBy = ["emergency.target"];
+        unitConfig = {
+          DefaultDependencies = false;
+          ConditionKernelCommandLine = [
+            "|boot.panic_on_fail"
+            "|stage1panic"
+          ];
+        };
+        script = ''
+          echo c > /proc/sysrq-trigger
+        '';
+        serviceConfig.Type = "oneshot";
+      };
    };

    boot.kernelParams = lib.mkIf (config.boot.resumeDevice != "") [ "resume=${config.boot.resumeDevice}" ];
--- a/nixos/modules/system/boot/systemd/shutdown.nix
+++ b/nixos/modules/system/boot/systemd/shutdown.nix
@ -1,31 +1,57 @@
-{ config, lib, ... }: let
+{ config, lib, utils, pkgs, ... }: let

-  cfg = config.boot.systemd.shutdown;
+  cfg = config.systemd.shutdownRamfs;
+
+  ramfsContents = let
+    storePaths = map (p: "${p}\n") cfg.storePaths;
+    contents = lib.mapAttrsToList (_: v: "${v.source}\n${v.target}") (lib.filterAttrs (_: v: v.enable) cfg.contents);
+  in pkgs.writeText "shutdown-ramfs-contents" (lib.concatStringsSep "\n" (storePaths ++ contents));

 in {
-  options.boot.systemd.shutdown = {
+  options.systemd.shutdownRamfs = {
    enable = lib.mkEnableOption "pivoting back to an initramfs for shutdown" // { default = true; };
+    contents = lib.mkOption {
+      description = "Set of files that have to be linked into the shutdown ramfs";
+      example = lib.literalExpression ''
+        {
+          "/lib/systemd/system-shutdown/zpool-sync-shutdown".source = writeShellScript "zpool" "exec ''${zfs}/bin/zpool sync"
+        }
+      '';
+      type = utils.systemdUtils.types.initrdContents;
+    };
+
+    storePaths = lib.mkOption {
+      description = ''
+        Store paths to copy into the shutdown ramfs as well.
+      '';
+      type = lib.types.listOf lib.types.singleLineStr;
+      default = [];
+    };
  };

  config = lib.mkIf cfg.enable {
+    systemd.shutdownRamfs.contents."/shutdown".source = "${config.systemd.package}/lib/systemd/systemd-shutdown";
+    systemd.shutdownRamfs.storePaths = [pkgs.runtimeShell "${pkgs.coreutils}/bin"];
+
    systemd.services.generate-shutdown-ramfs = {
      description = "Generate shutdown ramfs";
+      wantedBy = [ "shutdown.target" ];
      before = [ "shutdown.target" ];
      unitConfig = {
        DefaultDependencies = false;
        ConditionFileIsExecutable = [
          "!/run/initramfs/shutdown"
-          "/run/current-system/systemd/lib/systemd/systemd-shutdown"
        ];
      };

+      path = [pkgs.util-linux pkgs.makeInitrdNGTool pkgs.glibc pkgs.patchelf];
      serviceConfig.Type = "oneshot";
      script = ''
        mkdir -p /run/initramfs
        if ! mountpoint -q /run/initramfs; then
          mount -t tmpfs tmpfs /run/initramfs
        fi
-        cp /run/current-system/systemd/lib/systemd/systemd-shutdown /run/initramfs/shutdown
+        make-initrd-ng ${ramfsContents} /run/initramfs
      '';
    };
  };
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@ -466,6 +466,11 @@ in
        '') rootPools));
      };

+      systemd.shutdownRamfs.contents."/etc/systemd/system-shutdown/zpool".source = pkgs.writeShellScript "zpool-sync-shutdown" ''
+        exec ${cfgZfs.package}/bin/zpool sync
+      '';
+      systemd.shutdownRamfs.storePaths = ["${cfgZfs.package}/bin/zpool"];
+
      # TODO FIXME See https://github.com/NixOS/nixpkgs/pull/99386#issuecomment-798813567. To not break people's bootloader and as probably not everybody would read release notes that thoroughly add inSystem.
      boot.loader.grub = mkIf (inInitrd || inSystem) {
        zfsSupport = true;
--- a/nixos/modules/testing/test-instrumentation.nix
+++ b/nixos/modules/testing/test-instrumentation.nix
@ -65,33 +65,26 @@ in
      };
    };

-    boot.initrd.preDeviceCommands =
-      ''
-        echo 600 > /proc/sys/kernel/hung_task_timeout_secs
-      '';
+    boot.kernel.sysctl = {
+      "kernel.hung_task_timeout_secs" = 600;
+      # Panic on out-of-memory conditions rather than letting the
+      # OOM killer randomly get rid of processes, since this leads
+      # to failures that are hard to diagnose.
+      "vm.panic_on_oom" = lib.mkDefault 2;
+    };

-    boot.initrd.postDeviceCommands =
-      ''
-        # Using acpi_pm as a clock source causes the guest clock to
-        # slow down under high host load.  This is usually a bad
-        # thing, but for VM tests it should provide a bit more
-        # determinism (e.g. if the VM runs at lower speed, then
-        # timeouts in the VM should also be delayed).
-        echo acpi_pm > /sys/devices/system/clocksource/clocksource0/current_clocksource
-      '';
-
-    boot.postBootCommands =
-      ''
-        # Panic on out-of-memory conditions rather than letting the
-        # OOM killer randomly get rid of processes, since this leads
-        # to failures that are hard to diagnose.
-        echo 2 > /proc/sys/vm/panic_on_oom
-      '';
-
-    # Panic if an error occurs in stage 1 (rather than waiting for
-    # user intervention).
-    boot.kernelParams =
-      [ "console=${qemu-common.qemuSerialDevice}" "panic=1" "boot.panic_on_fail" ];
+    boot.kernelParams = [
+      "console=${qemu-common.qemuSerialDevice}"
+      # Panic if an error occurs in stage 1 (rather than waiting for
+      # user intervention).
+      "panic=1" "boot.panic_on_fail"
+      # Using acpi_pm as a clock source causes the guest clock to
+      # slow down under high host load.  This is usually a bad
+      # thing, but for VM tests it should provide a bit more
+      # determinism (e.g. if the VM runs at lower speed, then
+      # timeouts in the VM should also be delayed).
+      "clock=acpi_pm"
+    ];

    # `xwininfo' is used by the test driver to query open windows.
    environment.systemPackages = [ pkgs.xorg.xwininfo ];
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -754,13 +754,13 @@ in
    );
    boot.loader.grub.gfxmodeBios = with cfg.resolution; "${toString x}x${toString y}";

-    boot.initrd.extraUtilsCommands =
+    boot.initrd.extraUtilsCommands = lib.mkIf (!config.boot.initrd.systemd.enable)
      ''
        # We need mke2fs in the initrd.
        copy_bin_and_libs ${pkgs.e2fsprogs}/bin/mke2fs
      '';

-    boot.initrd.postDeviceCommands =
+    boot.initrd.postDeviceCommands = lib.mkIf (!config.boot.initrd.systemd.enable)
      ''
        # If the disk image appears to be empty, run mke2fs to
        # initialise.
@ -770,7 +770,7 @@ in
        fi
      '';

-    boot.initrd.postMountCommands =
+    boot.initrd.postMountCommands = lib.mkIf (!config.boot.initrd.systemd.enable)
      ''
        # Mark this as a NixOS machine.
        mkdir -p $targetRoot/etc
@ -789,6 +789,11 @@ in
        ''}
      '';

+    systemd.tmpfiles.rules = lib.mkIf config.boot.initrd.systemd.enable [
+      "f /etc/NIXOS 0644 root root -"
+      "d /boot 0644 root root -"
+    ];
+
    # After booting, register the closure of the paths in
    # `virtualisation.additionalPaths' in the Nix database in the VM.  This
    # allows Nix operations to work in the VM.  The path to the
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -235,6 +235,7 @@ in
  input-remapper = handleTest ./input-remapper.nix {};
  inspircd = handleTest ./inspircd.nix {};
  installer = handleTest ./installer.nix {};
+  installer-systemd-stage-1 = handleTest ./installer-systemd-stage-1.nix {};
  invoiceplane = handleTest ./invoiceplane.nix {};
  iodine = handleTest ./iodine.nix {};
  ipfs = handleTest ./ipfs.nix {};
--- a/nixos/tests/custom-ca.nix
+++ b/nixos/tests/custom-ca.nix
@ -1,9 +1,14 @@
 # Checks that `security.pki` options are working in curl and the main browser
-# engines: Gecko (via Firefox), Chromium, QtWebEngine (Falkon) and WebKitGTK
-# (via Midori). The test checks that certificates issued by a custom trusted
-# CA are accepted but those from an unknown CA are rejected.
+# engines: Gecko (via Firefox), Chromium, QtWebEngine (via qutebrowser) and
+# WebKitGTK (via Midori). The test checks that certificates issued by a custom
+# trusted CA are accepted but those from an unknown CA are rejected.

-import ./make-test-python.nix ({ pkgs, lib, ... }:
+{ system ? builtins.currentSystem,
+  config ? {},
+  pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };

 let
  makeCert = { caName, domain }: pkgs.runCommand "example-cert"
@ -68,24 +73,8 @@ let
      domain = "bad.example.com";
    };

-in
-
-{
-  name = "custom-ca";
-  meta.maintainers = with lib.maintainers; [ rnhmjoj ];
-
-  enableOCR = true;
-
-  nodes.machine = { pkgs, ... }:
-    { imports = [ ./common/user-account.nix ./common/x11.nix ];
-
-      # chromium-based browsers refuse to run as root
-      test-support.displayManager.auto.user = "alice";
-
-      # browsers may hang with the default memory
-      virtualisation.memorySize = 600;
-
-      networking.hosts."127.0.0.1" = [ "good.example.com" "bad.example.com" ];
+  webserverConfig =
+    { networking.hosts."127.0.0.1" = [ "good.example.com" "bad.example.com" ];
      security.pki.certificateFiles = [ "${example-good-cert}/ca.crt" ];

      services.nginx.enable = true;
@ -107,73 +96,98 @@ in
            return 200 'It does not work!';
          '';
        };
-
-      environment.systemPackages = with pkgs; [
-        xdotool
-        firefox
-        chromium
-        qutebrowser
-        midori
-      ];
    };

-  testScript = ''
-    from typing import Tuple
-    def execute_as(user: str, cmd: str) -> Tuple[int, str]:
-        """
-        Run a shell command as a specific user.
-        """
-        return machine.execute(f"sudo -u {user} {cmd}")
+  curlTest = makeTest {
+    name = "custom-ca-curl";
+    meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+    nodes.machine = { ... }: webserverConfig;
+    testScript = ''
+        with subtest("Good certificate is trusted in curl"):
+            machine.wait_for_unit("nginx")
+            machine.wait_for_open_port(443)
+            machine.succeed("curl -fv https://good.example.com")
+
+        with subtest("Unknown CA is untrusted in curl"):
+            machine.fail("curl -fv https://bad.example.com")
+    '';
+  };
+
+  mkBrowserTest = browser: testParams: makeTest {
+    name = "custom-ca-${browser}";
+    meta.maintainers = with lib.maintainers; [ rnhmjoj ];
+
+    enableOCR = true;
+
+    nodes.machine = { pkgs, ... }:
+      { imports =
+          [ ./common/user-account.nix
+            ./common/x11.nix
+            webserverConfig
+          ];
+
+        # chromium-based browsers refuse to run as root
+        test-support.displayManager.auto.user = "alice";
+
+        # browsers may hang with the default memory
+        virtualisation.memorySize = 600;
+
+        environment.systemPackages = [ pkgs.xdotool pkgs.${browser} ];
+      };
+
+    testScript = ''
+      from typing import Tuple
+      def execute_as(user: str, cmd: str) -> Tuple[int, str]:
+          """
+          Run a shell command as a specific user.
+          """
+          return machine.execute(f"sudo -u {user} {cmd}")


-    def wait_for_window_as(user: str, cls: str) -> None:
-        """
-        Wait until a X11 window of a given user appears.
-        """
+      def wait_for_window_as(user: str, cls: str) -> None:
+          """
+          Wait until a X11 window of a given user appears.
+          """

-        def window_is_visible(last_try: bool) -> bool:
-            ret, stdout = execute_as(user, f"xdotool search --onlyvisible --class {cls}")
-            if last_try:
-                machine.log(f"Last chance to match {cls} on the window list")
-            return ret == 0
+          def window_is_visible(last_try: bool) -> bool:
+              ret, stdout = execute_as(user, f"xdotool search --onlyvisible --class {cls}")
+              if last_try:
+                  machine.log(f"Last chance to match {cls} on the window list")
+              return ret == 0

-        with machine.nested("Waiting for a window to appear"):
-            retry(window_is_visible)
+          with machine.nested("Waiting for a window to appear"):
+              retry(window_is_visible)


-    machine.start()
+      machine.start()
+      machine.wait_for_x()

-    with subtest("Good certificate is trusted in curl"):
-        machine.wait_for_unit("nginx")
-        machine.wait_for_open_port(443)
-        machine.succeed("curl -fv https://good.example.com")
+      command = "${browser} ${testParams.args or ""}"
+      with subtest("Good certificate is trusted in ${browser}"):
+          execute_as(
+              "alice", f"{command} https://good.example.com >&2 &"
+          )
+          wait_for_window_as("alice", "${browser}")
+          machine.sleep(4)
+          execute_as("alice", "xdotool key ctrl+r")  # reload to be safe
+          machine.wait_for_text("It works!")
+          machine.screenshot("good${browser}")
+          execute_as("alice", "xdotool key ctrl+w")  # close tab

-    with subtest("Unknown CA is untrusted in curl"):
-        machine.fail("curl -fv https://bad.example.com")
+      with subtest("Unknown CA is untrusted in ${browser}"):
+          execute_as("alice", f"{command} https://bad.example.com >&2 &")
+          machine.wait_for_text("${testParams.error}")
+          machine.screenshot("bad${browser}")
+    '';
+  };

-    browsers = {
-      "firefox": "Security Risk",
-      "chromium": "not private",
-      "qutebrowser -T": "Certificate error",
-      "midori": "Security"
-    }
+in

-    machine.wait_for_x()
-    for command, error in browsers.items():
-        browser = command.split()[0]
-        with subtest("Good certificate is trusted in " + browser):
-            execute_as(
-                "alice", f"{command} https://good.example.com >&2 &"
-            )
-            wait_for_window_as("alice", browser)
-            machine.wait_for_text("It works!")
-            machine.screenshot("good" + browser)
-            execute_as("alice", "xdotool key ctrl+w")  # close tab
-
-        with subtest("Unknown CA is untrusted in " + browser):
-            execute_as("alice", f"{command} https://bad.example.com >&2 &")
-            machine.wait_for_text(error)
-            machine.screenshot("bad" + browser)
-            machine.succeed("pkill -f " + browser)
-  '';
-})
+{
+  curl = curlTest;
+} // pkgs.lib.mapAttrs mkBrowserTest {
+  firefox = { error = "Security Risk"; };
+  chromium = { error = "not private"; };
+  qutebrowser = { args = "-T"; error = "Certificate error"; };
+  midori = { error = "Security"; };
+}
--- a/nixos/tests/installer-systemd-stage-1.nix
+++ b/nixos/tests/installer-systemd-stage-1.nix
@ -0,0 +1,33 @@
+{ system ? builtins.currentSystem
+, config ? {}
+, pkgs ? import ../.. { inherit system config; }
+}:
+
+{
+  # Some of these tests don't work with systemd stage 1 yet. Uncomment
+  # them when fixed.
+  inherit (import ./installer.nix { inherit system config pkgs; systemdStage1 = true; })
+    # bcache
+    # btrfsSimple
+    # btrfsSubvolDefault
+    # btrfsSubvols
+    # encryptedFSWithKeyfile
+    # grub1
+    # luksroot
+    # luksroot-format1
+    # luksroot-format2
+    # lvm
+    separateBoot
+    separateBootFat
+    simple
+    simpleLabels
+    simpleProvided
+    simpleSpecialised
+    simpleUefiGrub
+    simpleUefiGrubSpecialisation
+    simpleUefiSystemdBoot
+    # swraid
+    # zfsroot
+    ;
+
+}
--- a/nixos/tests/installer.nix
+++ b/nixos/tests/installer.nix
@ -1,6 +1,7 @@
 { system ? builtins.currentSystem,
  config ? {},
-  pkgs ? import ../.. { inherit system config; }
+  pkgs ? import ../.. { inherit system config; },
+  systemdStage1 ? false
 }:

 with import ../lib/testing-python.nix { inherit system pkgs; };
@ -23,6 +24,8 @@ let
        # To ensure that we can rebuild the grub configuration on the nixos-rebuild
        system.extraDependencies = with pkgs; [ stdenvNoCC ];

+        ${optionalString systemdStage1 "boot.initrd.systemd.enable = true;"}
+
        ${optionalString (bootLoader == "grub") ''
          boot.loader.grub.version = ${toString grubVersion};
          ${optionalString (grubVersion == 1) ''
@ -290,6 +293,8 @@ let
          virtualisation.cores = 8;
          virtualisation.memorySize = 1536;

+          boot.initrd.systemd.enable = systemdStage1;
+
          # Use a small /dev/vdb as the root disk for the
          # installer. This ensures the target disk (/dev/vda) is
          # the same during and after installation.
--- a/nixos/tests/systemd-initrd-luks-keyfile.nix
+++ b/nixos/tests/systemd-initrd-luks-keyfile.nix
@ -32,7 +32,7 @@ in {
        };
      };
      virtualisation.bootDevice = "/dev/mapper/cryptroot";
-      boot.initrd.systemd.contents."/etc/cryptroot.key".source = keyfile;
+      boot.initrd.secrets."/etc/cryptroot.key" = keyfile;
    };
  };

--- a/nixos/tests/systemd-shutdown.nix
+++ b/nixos/tests/systemd-shutdown.nix
@ -1,4 +1,6 @@
-import ./make-test-python.nix ({ pkgs, systemdStage1 ? false, ...} : {
+import ./make-test-python.nix ({ pkgs, systemdStage1 ? false, ...} : let
+  msg = "Shutting down NixOS";
+in {
  name = "systemd-shutdown";
  meta = with pkgs.lib.maintainers; {
    maintainers = [ das_j ];
@ -6,7 +8,9 @@ import ./make-test-python.nix ({ pkgs, systemdStage1 ? false, ...} : {

  nodes.machine = {
    imports = [ ../modules/profiles/minimal.nix ];
-    boot.initrd.systemd.enable = systemdStage1;
+    systemd.shutdownRamfs.contents."/etc/systemd/system-shutdown/shutdown-message".source = pkgs.writeShellScript "shutdown-message" ''
+      echo "${msg}"
+    '';
  };

  testScript = ''
@ -14,7 +18,8 @@ import ./make-test-python.nix ({ pkgs, systemdStage1 ? false, ...} : {
    # .shutdown() would wait for the machine to power off
    machine.succeed("systemctl poweroff")
    # Message printed by systemd-shutdown
-    machine.wait_for_console_text("All filesystems, swaps, loop devices, MD devices and DM devices detached.")
+    machine.wait_for_console_text("Unmounting '/oldroot'")
+    machine.wait_for_console_text("${msg}")
    # Don't try to sync filesystems
    machine.booted = False
  '';
--- a/pkgs/applications/audio/LibreArp/default.nix
+++ b/pkgs/applications/audio/LibreArp/default.nix
@ -0,0 +1,53 @@
+{ stdenv, lib, fetchFromGitLab, cmake, pkg-config, cairo, libxkbcommon
+, xcbutilcursor, xcbutilkeysyms, xcbutil, libXrandr, libXinerama, libXcursor
+, alsa-lib, libjack2, lv2, gcc-unwrapped, curl}:
+
+stdenv.mkDerivation rec {
+  pname = "LibreArp";
+  version = "2.2";
+
+  src = fetchFromGitLab {
+    owner = "LibreArp";
+    repo = "LibreArp";
+    rev = version;
+    hash = "sha256-jCUT/sflO9L57xRTqNR90RbwJ0uZ+xJVXnB3n+FhWBo=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [
+    cairo
+    libxkbcommon
+    xcbutilcursor
+    xcbutilkeysyms
+    xcbutil
+    libXrandr
+    libXinerama
+    libXcursor
+    alsa-lib
+    libjack2
+    lv2
+    curl
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_AR=${gcc-unwrapped}/bin/gcc-ar"
+    "-DCMAKE_RANLIB=${gcc-unwrapped}/bin/gcc-ranlib"
+    "-DCMAKE_NM=${gcc-unwrapped}/bin/gcc-nm"
+  ];
+
+  installPhase = ''
+    mkdir -p $out/lib/vst3
+    cd LibreArp_artefacts/Release
+    cp -r VST3/LibreArp.vst3 $out/lib/vst3
+  '';
+
+  meta = with lib; {
+    description =
+      "A pattern-based arpeggio generator plugin.";
+    homepage = "https://librearp.gitlab.io/";
+    license = licenses.gpl3Plus;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ magnetophon ];
+  };
+}
--- a/pkgs/applications/audio/LibreArp/lv2.nix
+++ b/pkgs/applications/audio/LibreArp/lv2.nix
@ -0,0 +1,53 @@
+{ stdenv, lib, fetchFromGitLab, cmake, pkg-config, cairo, libxkbcommon
+, xcbutilcursor, xcbutilkeysyms, xcbutil, libXrandr, libXinerama, libXcursor
+, alsa-lib, libjack2, lv2, gcc-unwrapped, curl}:
+
+stdenv.mkDerivation rec {
+  pname = "LibreArp-lv2";
+  version = "2.2";
+
+  src = fetchFromGitLab {
+    owner = "LibreArp";
+    repo = "LibreArp";
+    rev = "${version}-lv2";
+    hash = "sha256-j5SksuhC4ZXXILfOpwXNqIu5fO07a/6tiZ5qUo+p0Ug=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ cmake pkg-config ];
+  buildInputs = [
+    cairo
+    libxkbcommon
+    xcbutilcursor
+    xcbutilkeysyms
+    xcbutil
+    libXrandr
+    libXinerama
+    libXcursor
+    alsa-lib
+    libjack2
+    lv2
+    curl
+  ];
+
+  cmakeFlags = [
+    "-DCMAKE_AR=${gcc-unwrapped}/bin/gcc-ar"
+    "-DCMAKE_RANLIB=${gcc-unwrapped}/bin/gcc-ranlib"
+    "-DCMAKE_NM=${gcc-unwrapped}/bin/gcc-nm"
+  ];
+
+  installPhase = ''
+    mkdir -p $out/lib/lv2
+    cd LibreArp_artefacts/Release
+    cp -r LV2/LibreArp.lv2 $out/lib/lv2
+  '';
+
+  meta = with lib; {
+    description =
+      "A pattern-based arpeggio generator plugin.";
+    homepage = "https://librearp.gitlab.io/";
+    license = licenses.gpl3Plus;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with maintainers; [ magnetophon ];
+  };
+}
--- a/pkgs/applications/audio/carla/default.nix
+++ b/pkgs/applications/audio/carla/default.nix
@ -15,13 +15,13 @@ assert withGtk3 -> gtk3 != null;

 stdenv.mkDerivation rec {
  pname = "carla";
-  version = "2.4.2";
+  version = "2.4.3";

  src = fetchFromGitHub {
    owner = "falkTX";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-A0QmyphjsNU06kh2f9rXrR+GkDEI5HqXRA9J82E6qJU=";
+    sha256 = "sha256-FAQTIM5NpcOhLNMf62qiKaxg6QtK5uIJF/XT6KJVnUc=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/cider/default.nix
+++ b/pkgs/applications/audio/cider/default.nix
@ -2,11 +2,11 @@

 appimageTools.wrapType2 rec {
  pname = "cider";
-  version = "1.3.1308";
+  version = "1.4.1.1680";

  src = fetchurl {
-    url = "https://1308-429851205-gh.circle-artifacts.com/0/%7E/Cider/dist/artifacts/Cider-${version}.AppImage";
-    sha256 = "1lbyvn1c8155p039qfzx7jwad7km073phkmrzjm0w3ahdpwz3wgi";
+    url = "https://github.com/ciderapp/cider-releases/releases/download/v${version}/Cider-${builtins.concatStringsSep "." (lib.take 3 (lib.splitVersion version))}-alpha.${builtins.elemAt (lib.splitVersion version) 3}.AppImage";
+    sha256 = "sha256-hEv+vfMMH+Trwa1UF5R8EtyYeyiRVLP0BrXOK2+1q8M=";
  };

  extraInstallCommands =
--- a/pkgs/applications/audio/denemo/default.nix
+++ b/pkgs/applications/audio/denemo/default.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  pname = "denemo";
-  version = "2.5.0";
+  version = "2.6.0";

  src = fetchurl {
    url = "https://ftp.gnu.org/gnu/denemo/denemo-${version}.tar.gz";
-    sha256 = "sha256-B6GbBL/o/z0emT+Iw6XvWmAsJCmIwSGCyV1DkhDyfBY=";
+    sha256 = "sha256-S+WXDGmEf5fx+HYnXJdE5QNOfJg7EqEEX7IMI2SUtV0=";
  };

  buildInputs = [
--- a/pkgs/applications/audio/musikcube/default.nix
+++ b/pkgs/applications/audio/musikcube/default.nix
@ -6,6 +6,7 @@
 , fetchFromGitHub
 , fetchpatch
 , ffmpeg
+, gnutls
 , lame
 , libev
 , libmicrohttpd
@ -20,17 +21,17 @@

 stdenv.mkDerivation rec {
  pname = "musikcube";
-  version = "0.96.10";
+  version = "0.97.0";

  src = fetchFromGitHub {
    owner = "clangen";
    repo = pname;
    rev = version;
-    sha256 = "sha256-Aa52pRGq99Pt++aEVZdmVNhhQuBajgfZp39L1AfKvho=";
+    sha256 = "sha256-W9Ng1kqai5qhaDs5KWg/1sOTIAalBXLng1MG8sl/ZOg=";
  };

  patches = [
-    # Fix pending upstream inclusion for ncuurses-6.3 support:
+    # Fix pending upstream inclusion for ncurses-6.3 support:
    #  https://github.com/clangen/musikcube/pull/474
    (fetchpatch {
      name = "ncurses-6.3.patch";
@ -48,6 +49,7 @@ stdenv.mkDerivation rec {
    boost
    curl
    ffmpeg
+    gnutls
    lame
    libev
    libmicrohttpd
--- a/pkgs/applications/audio/pyradio/default.nix
+++ b/pkgs/applications/audio/pyradio/default.nix
@ -2,7 +2,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "pyradio";
-  version = "0.8.9.16";
+  version = "0.8.9.17";

  propagatedBuildInputs = with python3Packages; [
    requests
@ -13,8 +13,8 @@ python3Packages.buildPythonApplication rec {
  src = fetchFromGitHub {
    owner = "coderholic";
    repo = pname;
-    rev = version;
-    sha256 = "sha256-uerQfyGHWhLbO6UkLSMA1tdfW/8fDQkcm6hYIdwwC7I=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-lfDSD1+xbA6tAKeHKciq/n6YHWS4JTOvjIqOn+FQ2yA=";
  };

  checkPhase = ''
--- a/pkgs/applications/blockchains/btcpayserver/default.nix
+++ b/pkgs/applications/blockchains/btcpayserver/default.nix
@ -3,13 +3,13 @@

 buildDotnetModule rec {
  pname = "btcpayserver";
-  version = "1.4.7";
+  version = "1.5.1";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Qz4BNrhK+NPnKBgjXGYl4P2R878LCuMGZxLECawA12E=";
+    sha256 = "sha256-DcxRrVUen+JxMpiLDPfknpwCe962ifaekBeBnxJ0y88=";
  };

  projectFile = "BTCPayServer/BTCPayServer.csproj";
--- a/pkgs/applications/blockchains/btcpayserver/deps.nix
+++ b/pkgs/applications/blockchains/btcpayserver/deps.nix
@ -31,18 +31,18 @@
  })
  (fetchNuGet {
    pname = "BTCPayServer.Lightning.All";
-    version = "1.3.2";
-    sha256 = "0xcfba8n9zf5m1nb48ilggp03kpki4nv4kx7k7a5w1gxgm6k6j9z";
+    version = "1.3.6";
+    sha256 = "0jdpqy6kxg0lyh4n88wsvrcqc0kk7s7zn5lw7ivwys716m69qrdl";
  })
  (fetchNuGet {
    pname = "BTCPayServer.Lightning.Charge";
-    version = "1.3.1";
-    sha256 = "1xakwnb839dl0qnhqprsnfq8png31iyb0fsngljis5jc8yvb4353";
+    version = "1.3.2";
+    sha256 = "0v5rss6dg7297kq1frhn2pj9gd0rd8g1p5d316x5wkd4w7pmrm2w";
  })
  (fetchNuGet {
    pname = "BTCPayServer.Lightning.CLightning";
-    version = "1.3.1";
-    sha256 = "0a79p6i3xiq6svv08c4hhihkvqa2ac7fphi3g9i0cwh47ak0k5h2";
+    version = "1.3.2";
+    sha256 = "0qs5p6pm54il23j8yysw0pzvrki37y6z8cd2gdknpz2f3wg7slm9";
  })
  (fetchNuGet {
    pname = "BTCPayServer.Lightning.Common";
@ -51,23 +51,23 @@
  })
  (fetchNuGet {
    pname = "BTCPayServer.Lightning.Common";
-    version = "1.3.1";
-    sha256 = "165p1246fn628hlwdrx7sanlxa6qqpn480rq1asn5r1602w21844";
+    version = "1.3.2";
+    sha256 = "119zplkc7iy9wc95iz1qnyi42fr99ar4hp8a11p708a22w941yi0";
  })
  (fetchNuGet {
    pname = "BTCPayServer.Lightning.Eclair";
-    version = "1.3.1";
-    sha256 = "1vlwm5mw8wffp00xhkx19yavk59b5x540sg81vis3q7hjvvgca5c";
+    version = "1.3.2";
+    sha256 = "08gw1gqng1khxzvvhlwsg6lw1w56ylilg738wi6cbcwy7vl7f6bb";
  })
  (fetchNuGet {
    pname = "BTCPayServer.Lightning.LNBank";
-    version = "1.3.1";
-    sha256 = "0qga34vi4fzfr0g4qk0ad8xkqdig2ishmdj9i32s5yrrjrkx7c8d";
+    version = "1.3.4";
+    sha256 = "1vyz63pi5j31y8pz0b4hp9c4j249rszzfcymk3z3b2clwq32s4i4";
  })
  (fetchNuGet {
    pname = "BTCPayServer.Lightning.LND";
-    version = "1.3.1";
-    sha256 = "1b70jlyzy9xjvfywzi6i3l3sd4mkknxpni9akdi0phsfqysmy0wl";
+    version = "1.3.3";
+    sha256 = "137azpxxmp2q69bp07ky1jsgnfy9lf0dg5ba8l654flvvrgxaq6y";
  })
  (fetchNuGet {
    pname = "BuildBundlerMinifier";
@ -89,6 +89,11 @@
    version = "15.0.5";
    sha256 = "01y8bhsnxghn3flz0pr11vj6wjrpmia8rpdrsp7kjfc1zmhqlgma";
  })
+  (fetchNuGet {
+    pname = "Dapper";
+    version = "2.0.123";
+    sha256 = "15hxrchfgiqnmgf8fqhrf4pb4c8l9igg5qnkw9yk3rkagcqfkk91";
+  })
  (fetchNuGet {
    pname = "DigitalRuby.ExchangeSharp";
    version = "0.6.3";
@ -374,11 +379,6 @@
    version = "3.1.6";
    sha256 = "0b9myd7gqbpaw9pkd2bx45jhik9mwj0f1ss57sk2cxmag2lkdws5";
  })
-  (fetchNuGet {
-    pname = "Microsoft.EntityFrameworkCore.Abstractions";
-    version = "6.0.0";
-    sha256 = "1aw13qjkpglc1mm3cv7s73s8fschy8lzdnigsp346b7mycpg7v92";
-  })
  (fetchNuGet {
    pname = "Microsoft.EntityFrameworkCore.Abstractions";
    version = "6.0.1";
@ -831,8 +831,8 @@
  })
  (fetchNuGet {
    pname = "NBitcoin";
-    version = "6.0.15";
-    sha256 = "038dcl2k88w4cijws3pdnjflgy4lmqx70z0l7yqz355kmxjz8ain";
+    version = "6.0.18";
+    sha256 = "1dr669h68cx6yfzr3n97yzzwbgnsv5g2008diyxngdjm55nh3q9s";
  })
  (fetchNuGet {
    pname = "NBitcoin";
@ -856,8 +856,8 @@
  })
  (fetchNuGet {
    pname = "NBXplorer.Client";
-    version = "4.1.3";
-    sha256 = "1nh4jj7yg81825hr7cc99qlnfmdm6jibap81qqi8a968b61z4251";
+    version = "4.2.0";
+    sha256 = "1adbn5cbr42cjfvijaf1lffhcrcn0ws1arfi7mrg3kjshbzfgims";
  })
  (fetchNuGet {
    pname = "NETStandard.Library";
@ -931,13 +931,13 @@
  })
  (fetchNuGet {
    pname = "Npgsql.EntityFrameworkCore.PostgreSQL";
-    version = "6.0.1";
-    sha256 = "108sc62dqdb6ym2ck651kamcv6qf93cmaqzygfblmiglwzi6frnx";
+    version = "6.0.3";
+    sha256 = "0mgwm9psxvrq6vs2cy7m72wnknydgrs71hir2jqal5wbdh8g01np";
  })
  (fetchNuGet {
    pname = "Npgsql";
-    version = "6.0.1";
-    sha256 = "150paiwqxp6zsy5v7vl2a9h3ikzfv3pd04whxifmamq0h1ghw0ld";
+    version = "6.0.3";
+    sha256 = "1crzgi4dfbn8r381m9rvkma5xi2q7gqdzgxhc36hy3r0y63v1l8q";
  })
  (fetchNuGet {
    pname = "NSec.Cryptography";
@ -1086,8 +1086,8 @@
  })
  (fetchNuGet {
    pname = "Selenium.WebDriver.ChromeDriver";
-    version = "98.0.4758.10200";
-    sha256 = "10mc50gm78zbxrwvxlygzmj2a29liiacv8haax0534c26vj9dwkl";
+    version = "100.0.4896.6000";
+    sha256 = "1pfdvxjy4xiw1j7787lf07w9nr0dmj589vf6p4aqmk2cfz8j35c6";
  })
  (fetchNuGet {
    pname = "Selenium.WebDriver";
--- a/pkgs/applications/blockchains/lnd/default.nix
+++ b/pkgs/applications/blockchains/lnd/default.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "lnd";
-  version = "0.14.2-beta";
+  version = "0.14.3-beta";

  src = fetchFromGitHub {
    owner = "lightningnetwork";
    repo = "lnd";
    rev = "v${version}";
-    sha256 = "sha256-JOKitxxWcTlGlxYR1XpySZlI2fT9jgBrOxNUwT/sqdQ=";
+    sha256 = "sha256-ZTvGFmjhQBIWqMGatMAlX59uVyl1oUKo7L5jiz571Gc";
  };

  vendorSha256 = "sha256-shDmJcEyobY7Ih1MHMEY2GQnzAffsH/y4J1bme/bT7I=";
--- a/pkgs/applications/blockchains/nbxplorer/default.nix
+++ b/pkgs/applications/blockchains/nbxplorer/default.nix
@ -2,13 +2,13 @@

 buildDotnetModule rec {
  pname = "nbxplorer";
-  version = "2.2.20";
+  version = "2.3.20";

  src = fetchFromGitHub {
    owner = "dgarage";
    repo = "NBXplorer";
    rev = "v${version}";
-    sha256 = "sha256-C3REnfecNwf3dtk6aLYAEsedHRlIrQZAokXtf6KI8U0=";
+    sha256 = "sha256-cAko5s1bFSI7HOcXg/tZtdMMe0S9zkRBeZ6bispxgwc=";
  };

  projectFile = "NBXplorer/NBXplorer.csproj";
--- a/pkgs/applications/blockchains/nbxplorer/deps.nix
+++ b/pkgs/applications/blockchains/nbxplorer/deps.nix
@ -1,4 +1,9 @@
 { fetchNuGet }: [
+  (fetchNuGet {
+    pname = "Dapper";
+    version = "2.0.123";
+    sha256 = "15hxrchfgiqnmgf8fqhrf4pb4c8l9igg5qnkw9yk3rkagcqfkk91";
+  })
  (fetchNuGet {
    pname = "DBTrie";
    version = "1.0.39";
@ -249,6 +254,11 @@
    version = "1.0.0.18";
    sha256 = "0lgssxafv6cqlw21fb79fm0fcln0clgsk6zadcwrnjv9vampfw7b";
  })
+  (fetchNuGet {
+    pname = "Npgsql";
+    version = "6.0.3";
+    sha256 = "1crzgi4dfbn8r381m9rvkma5xi2q7gqdzgxhc36hy3r0y63v1l8q";
+  })
  (fetchNuGet {
    pname = "NuGet.Frameworks";
    version = "5.0.0";
@ -754,6 +764,11 @@
    version = "4.5.0";
    sha256 = "17labczwqk3jng3kkky73m0jhi8wc21vbl7cz5c0hj2p1dswin43";
  })
+  (fetchNuGet {
+    pname = "System.Runtime.CompilerServices.Unsafe";
+    version = "6.0.0";
+    sha256 = "0qm741kh4rh57wky16sq4m0v05fxmkjjr87krycf5vp9f0zbahbc";
+  })
  (fetchNuGet {
    pname = "System.Runtime.Extensions";
    version = "4.1.0";
--- a/pkgs/applications/editors/cudatext/default.nix
+++ b/pkgs/applications/editors/cudatext/default.nix
@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "cudatext";
-  version = "1.162.5";
+  version = "1.163.0";

  src = fetchFromGitHub {
    owner = "Alexey-T";
    repo = "CudaText";
    rev = version;
-    sha256 = "sha256-CQ0TPZH9A37WK+gm7jgCxL5eF+1SxHlsJTTzMVRkHIs=";
+    sha256 = "sha256-4jGLyAE202GAjaypubKGW1edyKqOti/yTwstC/R94iE=";
  };

  postPatch = ''
--- a/pkgs/applications/editors/cudatext/deps.json
+++ b/pkgs/applications/editors/cudatext/deps.json
@ -16,8 +16,8 @@
  },
  "ATSynEdit": {
    "owner": "Alexey-T",
-    "rev": "2022.04.21",
-    "sha256": "sha256-rPbQ3LNBXNHi9dgQKSaaCsuAY/VIzgq9tqlRXRl2IqU="
+    "rev": "2022.04.26",
+    "sha256": "sha256-aItWkjnFqxeyEywELEBkuvMH1zfI4jJFL10CexSktxU="
  },
  "ATSynEdit_Cmp": {
    "owner": "Alexey-T",
--- a/pkgs/applications/editors/helix/default.nix
+++ b/pkgs/applications/editors/helix/default.nix
@ -17,6 +17,9 @@ rustPlatform.buildRustPackage rec {
  nativeBuildInputs = [ makeWrapper ];

  postInstall = ''
+    # not needed at runtime
+    rm -r runtime/grammars/sources
+
    mkdir -p $out/lib
    cp -r runtime $out/lib
  '';
--- a/pkgs/applications/editors/texmaker/default.nix
+++ b/pkgs/applications/editors/texmaker/default.nix
@ -2,11 +2,11 @@

 mkDerivation rec {
  pname = "texmaker";
-  version = "5.1.2";
+  version = "5.1.3";

  src = fetchurl {
    url = "http://www.xm1math.net/texmaker/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-UmiW8sGuVhEw7seq6BW53Nqejut3K2VB0NyUzpGnEEQ=";
+    sha256 = "0qczc2r01vhap11xmqizwbq21ggn4yjrxim8iqjxaq9w1rg2x9dz";
  };

  buildInputs = [ qtbase qtscript poppler zlib qtwebengine ];
--- a/pkgs/applications/editors/texstudio/default.nix
+++ b/pkgs/applications/editors/texstudio/default.nix
@ -3,13 +3,13 @@

 mkDerivation rec {
  pname = "texstudio";
-  version = "4.2.2";
+  version = "4.2.3";

  src = fetchFromGitHub {
    owner = "${pname}-org";
    repo = pname;
    rev = version;
-    sha256 = "sha256-MZz8DQT1f6RU+euEED1bbg2MsaqC6+W3RoMk2qfIjr4=";
+    sha256 = "19z9dx8258qbjyzgskkg0xdn88mvx191y1sz4nk15yxsdyf2z3p8";
  };

  nativeBuildInputs = [ qmake wrapQtAppsHook pkg-config ];
--- a/pkgs/applications/emulators/mame/default.nix
+++ b/pkgs/applications/emulators/mame/default.nix
@ -45,13 +45,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "mame";
-  version = "0.242";
+  version = "0.243";

  src = fetchFromGitHub {
    owner = "mamedev";
    repo = "mame";
    rev = "mame${builtins.replaceStrings [ "." ] [ "" ] version}";
-    sha256 = "sha256-06iKM9cpjXuNvChQTPjhb9oQptC4KTZEoxzZk8+x3/k=";
+    sha256 = "sha256-dUgYLNvgvolz9M0ySkGJIZjVMBQwejkxsZ6npg8rIqk=";
  };

  hardeningDisable = [ "fortify" ];
--- a/pkgs/applications/emulators/ripes/default.nix
+++ b/pkgs/applications/emulators/ripes/default.nix
@ -0,0 +1,50 @@
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, pkg-config
+, qtbase
+, qtsvg
+, qtcharts
+, wrapQtAppsHook
+, cmake
+, python3
+}:
+
+mkDerivation rec {
+  pname = "ripes";
+  version = "2.2.4";
+
+  src = fetchFromGitHub {
+    owner = "mortbopet";
+    repo = "Ripes";
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "sha256-Aal2A4xypzaY7Oa+boIrXk7ITNKnh5OZIP7DkJjcGu4=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    python3
+    wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qtbase
+    qtsvg
+    qtcharts
+  ];
+
+  installPhase = ''
+    install -D Ripes $out/bin/Ripes
+    cp -r ${src}/appdir/usr/share $out/share
+  '';
+
+  meta = with lib; {
+    description = "A graphical processor simulator and assembly editor for the RISC-V ISA";
+    homepage = "https://github.com/mortbopet/Ripes";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ rewine ];
+  };
+}
--- a/pkgs/applications/finance/irpf/default.nix
+++ b/pkgs/applications/finance/irpf/default.nix
@ -11,13 +11,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "irpf";
-  version = "2022-1.3";
+  version = "2022-1.4";

  src = let
    year = lib.head (lib.splitVersion version);
  in fetchzip {
    url = "https://downloadirpf.receita.fazenda.gov.br/irpf/${year}/irpf/arquivos/IRPF${version}.zip";
-    sha256 = "sha256-nAmcVPSnMIWuq2zj1xq/657RmzaSmdtxlI9cp9v5P0A=";
+    sha256 = "sha256-AKBcBkoPDBknUOyndf9hNigzDHjjgi2v0n1Rs+//j/8=";
  };

  nativeBuildInputs = [ unzip makeWrapper copyDesktopItems ];
--- a/pkgs/applications/gis/grass/default.nix
+++ b/pkgs/applications/gis/grass/default.nix
@ -1,25 +1,25 @@
 { lib, stdenv, fetchFromGitHub, flex, bison, pkg-config, zlib, libtiff, libpng, fftw
-, cairo, readline, ffmpeg, makeWrapper, wxGTK30, wxmac, netcdf, blas
+, cairo, readline, ffmpeg, makeWrapper, wxGTK31, wxmac, netcdf, blas
 , proj, gdal, geos, sqlite, postgresql, libmysqlclient, python3Packages, libLAS, proj-datumgrid
 , zstd, pdal, wrapGAppsHook
 }:

 stdenv.mkDerivation rec {
  pname = "grass";
-  version = "7.8.6";
+  version = "8.0.1";

  src = with lib; fetchFromGitHub {
    owner = "OSGeo";
    repo = "grass";
    rev = version;
-    sha256 = "sha256-zvZqFWuxNyA+hu+NMiRbQVdzzrQPsZrdGdfVB17+SbM=";
+    sha256 = "sha256-rcOT21HRJDR+DEYsZn6BjOOhy28DWapz9PN7cRAdWGc=";
  };

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ flex bison zlib proj gdal libtiff libpng fftw sqlite
  readline ffmpeg makeWrapper netcdf geos postgresql libmysqlclient blas
  libLAS proj-datumgrid zstd wrapGAppsHook ]
-    ++ lib.optionals stdenv.isLinux [ cairo pdal wxGTK30 ]
+    ++ lib.optionals stdenv.isLinux [ cairo pdal wxGTK31 ]
    ++ lib.optional stdenv.isDarwin wxmac
    ++ (with python3Packages; [ python python-dateutil numpy ]
      ++ lib.optional stdenv.isDarwin wxPython_4_0
@ -68,41 +68,15 @@ stdenv.mkDerivation rec {
  /* Ensures that the python script run at build time are actually executable;
   * otherwise, patchShebangs ignores them.  */
  postConfigure = ''
-    chmod +x scripts/d.out.file/d.out.file.py \
-      scripts/d.to.rast/d.to.rast.py \
-      scripts/d.what.rast/d.what.rast.py \
-      scripts/d.what.vect/d.what.vect.py \
-      scripts/g.extension/g.extension.py \
-      scripts/g.extension.all/g.extension.all.py \
-      scripts/r.drain/r.drain.py \
-      scripts/r.pack/r.pack.py \
-      scripts/r.import/r.import.py \
-      scripts/r.tileset/r.tileset.py \
-      scripts/r.unpack/r.unpack.py \
-      scripts/v.clip/v.clip.py \
-      scripts/v.rast.stats/v.rast.stats.py \
-      scripts/v.to.lines/v.to.lines.py \
-      scripts/v.what.strds/v.what.strds.py \
-      scripts/v.unpack/v.unpack.py \
-      scripts/wxpyimgview/*.py \
-      gui/wxpython/animation/g.gui.animation.py \
-      gui/wxpython/datacatalog/g.gui.datacatalog.py \
-      gui/wxpython/rlisetup/g.gui.rlisetup.py \
-      gui/wxpython/vdigit/g.gui.vdigit.py \
-      temporal/t.rast.accumulate/t.rast.accumulate.py \
-      temporal/t.rast.accdetect/t.rast.accdetect.py \
-      temporal/t.rast.algebra/t.rast.algebra.py \
-      temporal/t.rast3d.algebra/t.rast3d.algebra.py \
-      temporal/t.vect.algebra/t.vect.algebra.py \
-      temporal/t.downgrade/t.downgrade.py \
-      temporal/t.select/t.select.py
-    for d in gui lib scripts temporal tools; do
-      patchShebangs $d
+    for f in $(find . -name '*.py'); do
+      chmod +x $f
    done
+
+    patchShebangs */
  '';

  postInstall = ''
-    wrapProgram $out/bin/grass78 \
+    wrapProgram $out/bin/grass \
    --set PYTHONPATH $PYTHONPATH \
    --set GRASS_PYTHON ${python3Packages.python.interpreter} \
    --suffix LD_LIBRARY_PATH ':' '${gdal}/lib'
@ -117,6 +91,6 @@ stdenv.mkDerivation rec {
    description = "GIS software suite used for geospatial data management and analysis, image processing, graphics and maps production, spatial modeling, and visualization";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [mpickering];
+    maintainers = with lib.maintainers; [ mpickering willcohen ];
  };
 }
--- a/pkgs/applications/graphics/cloudcompare/default.nix
+++ b/pkgs/applications/graphics/cloudcompare/default.nix
@ -1,4 +1,5 @@
 { lib
+, stdenv
 , mkDerivation
 , fetchFromGitHub
 , fetchpatch
@ -114,5 +115,6 @@ mkDerivation rec {
    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ nh2 ];
    platforms = with platforms; linux; # only tested here; might work on others
+    broken = stdenv.isLinux; # plugins/core/IO/qPDALIO/CMakeFiles/QPDAL_IO_PLUGIN.dir/src/LASFilter.cpp.o] Error 1
  };
 }
--- a/pkgs/applications/graphics/ovito/default.nix
+++ b/pkgs/applications/graphics/ovito/default.nix
@ -21,13 +21,13 @@

 mkDerivation rec {
  pname = "ovito";
-  version = "3.6.0";
+  version = "3.7.1";

  src = fetchFromGitLab {
    owner = "stuko";
    repo = "ovito";
    rev = "v${version}";
-    sha256 = "sha256-yQ8gSe/QM1RRNxk4bDJ+K5QX0eYjZ+iG3QOHj01tJhY=";
+    sha256 = "sha256-6b/yqfrpeZ6i6DoPe3lcftvuzwvK7rfZhgyHc9GtyBs=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/fspy/default.nix
+++ b/pkgs/applications/misc/fspy/default.nix
@ -2,7 +2,6 @@
 let
  pname = "fspy";
  version = "1.0.3";
-  name = "${pname}-v${version}";

  src = fetchurl {
    url = "https://github.com/stuffmatic/fSpy/releases/download/v${version}/${pname}-${version}-x86_64.AppImage";
@ -10,10 +9,10 @@ let
  };

 in appimageTools.wrapType2 {
-  inherit name src;
+  inherit pname version src;

  extraInstallCommands = ''
-    mv $out/bin/${name} $out/bin/${pname}
+    mv $out/bin/${pname}-v${version} $out/bin/${pname}
  '';

  meta = with lib; {
--- a/pkgs/applications/misc/gallery-dl/default.nix
+++ b/pkgs/applications/misc/gallery-dl/default.nix
@ -2,11 +2,11 @@

 buildPythonApplication rec {
  pname = "gallery_dl";
-  version = "1.21.1";
+  version = "1.21.2";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-oLVrYM7F9JFDYgQL/XgJS9LeUexqcSlvmkwyAk1bpoY=";
+    sha256 = "sha256-xn+Y8WOIH6zkExO3ZNya3ZBwh90oSjSk00xfO0c23To=";
  };

  propagatedBuildInputs = [ requests yt-dlp ];
--- a/pkgs/applications/misc/gnome-secrets/default.nix
+++ b/pkgs/applications/misc/gnome-secrets/default.nix
@ -5,7 +5,6 @@
 , gettext
 , fetchFromGitLab
 , python3Packages
-, libpwquality
 , wrapGAppsHook4
 , gtk4
 , glib
@ -17,7 +16,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "gnome-secrets";
-  version = "6.1";
+  version = "6.4";
  format = "other";
  strictDeps = false; # https://github.com/NixOS/nixpkgs/issues/56943

@ -26,7 +25,7 @@ python3Packages.buildPythonApplication rec {
    owner = "World";
    repo = "secrets";
    rev = version;
-    sha256 = "sha256-TBGNiiR0GW8s/Efi4/Qqvwd87Ir0gCLGPfBmmqqSwQ8=";
+    sha256 = "sha256-qO2DJ/Eb9+G1R3un2+n9Tf6oxpGrEuH3SBrajQ9tCPU=";
  };

  nativeBuildInputs = [
@ -45,6 +44,7 @@ python3Packages.buildPythonApplication rec {
    glib
    gdk-pixbuf
    libadwaita
+    python3Packages.libpwquality.dev # Use python-enabled libpwquality
  ];

  propagatedBuildInputs = with python3Packages; [
@ -52,14 +52,9 @@ python3Packages.buildPythonApplication rec {
    construct
    pykeepass
    pyotp
-  ] ++ [
-    libpwquality # using the python bindings
+    libpwquality
  ];

-  postPatch = ''
-    substituteInPlace meson_post_install.py --replace "gtk-update-icon-cache" "gtk4-update-icon-cache";
-  '';
-
  # Prevent double wrapping, let the Python wrapper use the args in preFixup.
  dontWrapGApps = true;

@ -76,4 +71,3 @@ python3Packages.buildPythonApplication rec {
    maintainers = with maintainers; [ mvnetbiz ];
  };
 }
-
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.96.0";
+  version = "0.98.0";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-3O+ZdOloh5gILPQssztt7s/MwRgDOnpJItwLn7FXnPU=";
+    sha256 = "sha256-oZzjnuu6C522qBs/A83jKIZ3dUrJRmKJ/C8NRX31yvw=";
  };

-  vendorSha256 = "sha256-TgE/ToHBg2QBgtk0gPZTV/icIbQN14RpVAbL/8b+W0U=";
+  vendorSha256 = "sha256-HM5IE/rVNWyTfjUtVOlw+69+YoWYlLtU2FOXeH2BAi8=";

  doCheck = false;

--- a/pkgs/applications/misc/lighthouse/default.nix
+++ b/pkgs/applications/misc/lighthouse/default.nix
@ -1,35 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config
-, libX11, libxcb, cairo, gtk2, pango, python27, python3
-}:
-
-stdenv.mkDerivation rec {
-  pname = "lighthouse";
-  version = "unstable-2016-07-20";
-
-  src = fetchFromGitHub {
-    owner = "emgram769";
-    repo = "lighthouse";
-    rev = "d1813ef8e2aca9f6b3609b1e0c6d1d5ee683281a";
-    sha256 = "0v6ylm49f1b44zwq1y1gqxp2csyqblplr24ajllc2q3r0sc9m1ys";
-   };
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [
-    libX11 libxcb cairo gtk2 pango python27 python3
-  ];
-
-  makeFlags = [ "PREFIX=\${out}" ];
-
-  preFixup = "chmod +x $out/share/lighthouse/.config/lighthouse/google.py";
-
-  postFixup = "chmod -x $out/share/lighthouse/.config/lighthouse/google.py";
-
-  meta = with lib; {
-    description = "A simple flexible popup dialog to run on X";
-    homepage = "https://github.com/emgram769/lighthouse";
-    license = licenses.mit;
-    maintainers = with maintainers; [ ramkromberg ];
-    platforms = platforms.linux;
-  };
-
-}
--- a/pkgs/applications/misc/octoprint/default.nix
+++ b/pkgs/applications/misc/octoprint/default.nix
@ -9,251 +9,11 @@
 , packageOverrides ? self: super: { }
 }:
 let
-  mkOverride = attrname: version: sha256:
-    self: super: {
-      ${attrname} = super.${attrname}.overridePythonAttrs (
-        oldAttrs: {
-          inherit version;
-          src = oldAttrs.src.override {
-            inherit version sha256;
-          };
-        }
-      );
-    };

  py = python3.override {
    self = py;
    packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) (
      [
-        # the following dependencies are non trivial to update since later versions introduce backwards incompatible
-        # changes that might affect plugins, or due to other observed problems
-        (mkOverride "click" "7.1.2" "d2b5255c7c6349bc1bd1e59e08cd12acbbd63ce649f2588755783aa94dfb6b1a")
-        (mkOverride "flask-babel" "1.0.0" "0gmb165vkwv5v7dxsxa2i3zhafns0fh938m2zdcrv4d8z5l099yn")
-        (mkOverride "itsdangerous" "1.1.0" "321b033d07f2a4136d3ec762eac9f16a10ccd60f53c0c91af90217ace7ba1f19")
-        (mkOverride "jinja2" "2.11.3" "a6d58433de0ae800347cab1fa3043cebbabe8baa9d29e668f1c768cb87a333c6")
-        (mkOverride "markdown" "3.1.1" "2e50876bcdd74517e7b71f3e7a76102050edec255b3983403f1a63e7c8a41e7a")
-        (mkOverride "markupsafe" "1.1.1" "29872e92839765e546828bb7754a68c418d927cd064fd4708fab9fe9c8bb116b")
-
-        # black uses hash, not sha256 identifier. Newer black version requires newer click version
-        (
-          self: super: {
-            black = super.black.overridePythonAttrs (oldAttrs: rec {
-              version = "21.12b0";
-              src = oldAttrs.src.override {
-                inherit version;
-                hash = "sha256-d7gPaTpWni5SeVhFljTxjfmwuiYluk4MLV2lvkLm8rM=";
-              };
-              doCheck = false;
-            });
-          }
-        )
-
-        # tests need network
-        (
-          self: super: {
-            curio = super.curio.overridePythonAttrs (oldAttrs: rec {
-              disabledTests = [
-                "test_timeout"
-                "test_ssl_outgoing"
-              ];
-            });
-          }
-        )
-
-        # tests need network
-        (
-          self: super: {
-            trio = super.trio.overridePythonAttrs (oldAttrs: rec {
-              disabledTests = [
-                "test_local_address_real"
-              ];
-              disabledTestPaths = [
-                "trio/tests/test_exports.py"
-                "trio/tests/test_socket.py"
-              ];
-            });
-          }
-        )
-
-        # Requires flask<2, cannot mkOverride because tests need to be disabled
-        (
-          self: super: {
-            flask = super.flask.overridePythonAttrs (oldAttrs: rec {
-              version = "1.1.4";
-              src = oldAttrs.src.override {
-                inherit version;
-                sha256 = "15ni4xlm57a15f5hipp8w0c9zba20179bvfns2392fiq1lcbdghg";
-              };
-              doCheck = false;
-            });
-          }
-        )
-
-        # Requires werkezug<2, cannot mkOverride because tests need to be disabled
-        (
-          self: super: {
-            werkzeug = super.werkzeug.overridePythonAttrs (oldAttrs: rec {
-              version = "1.0.1";
-              src = oldAttrs.src.override {
-                inherit version;
-                sha256 = "6c80b1e5ad3665290ea39320b91e1be1e0d5f60652b964a3070216de83d2e47c";
-              };
-              doCheck = false;
-            });
-          }
-        )
-
-        # Requires unidecode>=0.04.14,<0.05. Upstream changed the source naming between releases
-        (
-          self: super: {
-            unidecode = super.unidecode.overridePythonAttrs (oldAttrs: rec {
-              version = "0.04.21";
-              src = fetchFromGitHub {
-                owner = "avian2";
-                repo = "unidecode";
-                rev = "release-${version}";
-                sha256 = "0p5bkibv0xm1265dlfrz3zq3k9bbx07gl8zyq8mvvb8hi7p5lifg";
-              };
-            });
-          }
-        )
-
-        # Requires websocket-client <1.0, >=0.57. Cannot do mkOverride b/c differing underscore/hyphen in pypi source name
-        (
-          self: super: {
-            websocket-client = super.websocket-client.overridePythonAttrs (
-              oldAttrs: rec {
-                version = "0.59.0";
-                src = oldAttrs.src.override {
-                  inherit version;
-                  sha256 = "0p0cz2mdissq7iw1n7jrmsfir0jfmgs1dvnpnrx477ffx9hbsxnk";
-                };
-                propagatedBuildInputs = with self; [
-                  six
-                  pysocks
-                ];
-                disabledTests = [
-                  "testConnect" # requires network access
-                ];
-              }
-            );
-          }
-        )
-
-        # Octoprint needs zeroconf >=0.24 <0.25. This can't be done via mkOverride, because in zeroconf 0.32
-        # the super package was migrated to fetchFromGitHub.
-        (
-          self: super: {
-            zeroconf = super.zeroconf.overrideAttrs (oldAttrs: rec {
-              version = "0.24.5";
-              src = super.fetchPypi {
-                inherit (oldAttrs) pname;
-                inherit version;
-                sha256 = "0jpgd0rk91si93857mjrizan5gc42kj1q4fi4160qgk68la88fl9";
-              };
-              pythonImportsCheck = [
-                "zeroconf"
-              ];
-              buildInputs = with self; [
-                pytestCheckHook
-                nose
-              ];
-              pytestFlagsArray = [ "zeroconf/test.py" ];
-            });
-          }
-        )
-
-        # Octoprint pulls in celery indirectly but has no support for the up-to-date releases
-        (
-          self: super: {
-            celery = super.celery.overrideAttrs (oldAttrs: rec {
-              version = "5.0.0";
-              src = oldAttrs.src.override {
-                inherit version;
-                hash = "sha256-MTkw/d3nA9jjcCmjBL+RQpzRGu72PFfebayp2Vjh8lU=";
-              };
-              disabledTestPaths = [
-                "t/unit/backends/test_mongodb.py"
-              ];
-            });
-          }
-        )
-
-        # Octoprint would allow later sentry-sdk releases but not later click releases
-        (
-          self: super: {
-            sentry-sdk = super.sentry-sdk.overrideAttrs (oldAttrs: rec {
-              pname = "sentry-sdk";
-              version = "1.4.3";
-
-              src = fetchFromGitHub {
-                owner = "getsentry";
-                repo = "sentry-python";
-                rev = version;
-                sha256 = "sha256-vdE6eqELMM69CWHaNYhF0HMCTV3tQsJlMHAA96oCy8c=";
-              };
-              disabledTests = [
-                "test_apply_simulates_delivery_info"
-                "test_auto_enabling_integrations_catches_import_error"
-                "test_leaks"
-              ];
-              disabledTestPaths = [
-                # Don't test integrations
-                "tests/integrations"
-                # test crashes on aarch64
-                "tests/test_transport.py"
-              ];
-            });
-          }
-        )
-
-        # Octoprint fails due to a newly added test in pytest-httpbin
-        # see https://github.com/NixOS/nixpkgs/issues/159864
-        (
-          self: super: {
-            pytest-httpbin = super.pytest-httpbin.overridePythonAttrs (oldAttrs: rec {
-              disabledTests = [
-                "test_redirect_location_is_https_for_secure_server"
-              ];
-            });
-          }
-        )
-
-        # All test fail on aarch64
-        (
-          self: super: {
-            azure-core = super.azure-core.overridePythonAttrs (oldAttrs: rec {
-              doCheck = stdenv.buildPlatform == "x86_64-linux";
-            });
-          }
-        )
-
-        # needs network
-        (
-          self: super: {
-            falcon = super.falcon.overridePythonAttrs (oldAttrs: rec {
-              #pytestFlagsArray = [ "-W ignore::DeprecationWarning" ];
-              disabledTestPaths = oldAttrs.disabledTestPaths or [] ++ [
-                "tests/asgi/test_asgi_servers.py"
-              ];
-            });
-          }
-        )
-
-        # update broke some tests
-        (
-          self: super: {
-            sanic = super.sanic.overridePythonAttrs (oldAttrs: rec {
-              disabledTestPaths = oldAttrs.disabledTestPaths or [] ++ [
-                "test_cli.py"
-                "test_cookies.py"
-                # requires network
-                "test_worker.py"
-              ];
-            });
-          }
-        )
-
        # Built-in dependency
        (
          self: super: {
@ -294,14 +54,14 @@ let
          self: super: {
            octoprint-pisupport = self.buildPythonPackage rec {
              pname = "OctoPrint-PiSupport";
-              version = "2021.10.28";
+              version = "2022.3.28";
              format = "setuptools";

              src = fetchFromGitHub {
                owner = "OctoPrint";
                repo = "OctoPrint-PiSupport";
                rev = version;
-                sha256 = "01bpvv1sn3113fdpw6b90c2rj8lqay118x609yy64z9ccm93khl9";
+                sha256 = "yzE/jz604nX/CHcW3aa7goH1ey8qZ7rLw31SMfNKJZM=";
              };

              # requires octoprint itself during tests
@ -314,13 +74,13 @@ let
          self: super: {
            octoprint = self.buildPythonPackage rec {
              pname = "OctoPrint";
-              version = "1.7.3";
+              version = "1.8.0rc5";

              src = fetchFromGitHub {
                owner = "OctoPrint";
                repo = "OctoPrint";
                rev = version;
-                sha256 = "sha256-U6g7WysHHOlZ4p5BM4tw3GGAxQmxv6ltYgAp1rO/eCg=";
+                sha256 = "sha256-FeT45w6VXaFV4BsuOMk58nxxiu9jhCNnA2F7Uh/3sB0=";
              };

              propagatedBuildInputs = with super; [
@ -368,7 +128,7 @@ let
                werkzeug
                wrapt
                zeroconf
-                zipstream-new
+                zipstream-ng
              ] ++ lib.optionals stdenv.isDarwin [
                py.pkgs.appdirs
              ];
@ -406,6 +166,8 @@ let
                    "watchdog"
                    "wrapt"
                    "zeroconf"
+                    "Flask-Login"
+                    "werkzeug"
                  ];
                in
                ''
--- a/pkgs/applications/misc/osmscout-server/default.nix
+++ b/pkgs/applications/misc/osmscout-server/default.nix
@ -1,4 +1,4 @@
-{ lib, mkDerivation, fetchFromGitHub, fetchpatch, pkg-config
+{ lib, mkDerivation, fetchFromGitHub, pkg-config
 , qmake, qttools, kirigami2, qtquickcontrols2, qtlocation
 , libosmscout, valhalla, libpostal, osrm-backend, protobuf
 , libmicrohttpd_0_9_70, sqlite, marisa, kyotocabinet, boost
@ -14,30 +14,16 @@ let
 in
 mkDerivation rec {
  pname = "osmscout-server";
-  version = "1.17.1";
+  version = "2.1.2";

  src = fetchFromGitHub {
    owner = "rinigus";
    repo = "osmscout-server";
    rev = version;
-    sha256 = "0rpsi6nyhcz6bv0jab4vixkxhjmn84xi0q2xz15a097hn46cklx9";
+    sha256 = "sha256-I14nQL0H2rMga+RDdAjykqmf7QIZveA6oGWu5PfZ89s=";
    fetchSubmodules = true;
  };

-  # Two patches required to work with valhalla 3.1
-  patches = [
-    # require C++14 to match latest Valhalla
-    (fetchpatch {
-      url = "https://github.com/rinigus/osmscout-server/commit/78b41b9b4c607fe9bfd6fbd61ae31cb7c8a725cd.patch";
-      sha256 = "0gk9mdwa75awl0bj30gm8waj454d8k2yixxwh05m0p550cbv3lg0";
-    })
-    # add Valhalla 3.1 config
-    (fetchpatch {
-      url = "https://github.com/rinigus/osmscout-server/commit/584de8bd47700053960fa139a2d7f8d3d184c876.patch";
-      sha256 = "0liz72n83q93bzzyyiqjkxa6hp9zjx7v9rgsmpwf88gc4caqm2dz";
-    })
-  ];
-
  nativeBuildInputs = [ qmake pkg-config qttools ];
  buildInputs = [
    kirigami2 qtquickcontrols2 qtlocation
@ -45,13 +31,6 @@ mkDerivation rec {
    libpostal sqlite marisa kyotocabinet boost protobuf date
  ];

-  # OSMScout server currently defaults to an earlier version of valhalla,
-  # but valhalla 3.1 support has been added. (See patches above)
-  # Replace the default valhalla.json with the valhalla 3.1 version
-  postPatch = ''
-    mv data/valhalla.json-3.1 data/valhalla.json
-  '';
-
  qmakeFlags = [
    "SCOUT_FLAVOR=kirigami" # Choose to build the kirigami UI variant
    "CONFIG+=disable_mapnik" # Disable the optional mapnik backend
--- a/pkgs/applications/misc/vit/default.nix
+++ b/pkgs/applications/misc/vit/default.nix
@ -8,18 +8,16 @@ with python3Packages;

 buildPythonApplication rec {
  pname = "vit";
-  version = "2.1.0";
-  disabled = lib.versionOlder python.version "3.6";
+  version = "2.2.0";
+  disabled = lib.versionOlder python.version "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "fd34f0b827953dfdecdc39f8416d41c50c24576c33a512a047a71c1263eb3e0f";
+    sha256 = "sha256-6GbIc5giuecxUqswyaAJw675R1M8BvelyyRNFcTqKW8=";
  };

  propagatedBuildInputs = [
-    pytz
    tasklib
-    tzlocal
    urwid
  ];

--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -61,13 +61,6 @@ let
    url = "https://chromium.googlesource.com/chromium/tools/build/+/e77882e0dde52c2ccf33c5570929b75b4a2a2522/recipes/recipe_modules/chromium/resources/clang-format?format=TEXT";
    sha256 = "0ic3hn65dimgfhakli1cyf9j3cxcqsf1qib706ihfhmlzxf7256l";
  };
-  # https://webrtc-review.googlesource.com/c/src/+/255601
-  webrtcWaylandScreenshareCoredumpFix = fetchurl {
-    # PipeWire capturer: check existence of cursor metadata
-    name = "webrtc-wayland-screenshare-coredump-fix.patch";
-    url = "https://webrtc-review.googlesource.com/changes/src~255601/revisions/2/patch?download";
-    hash = "sha256-PHGwEoYhMa+ZL2ner10FwdGUWUxsVr+HWuZOAEugYDY=";
-  };

  # The additional attributes for creating derivations based on the chromium
  # source tree.
@ -169,8 +162,14 @@ let
      ./patches/widevine-79.patch
    ];

-    postPatch = optionalString (versionRange "100" "101") ''
-      base64 --decode ${webrtcWaylandScreenshareCoredumpFix} | patch -p1 -d third_party/webrtc
+    postPatch = optionalString (chromiumVersionAtLeast "102") ''
+      # Workaround/fix for https://bugs.chromium.org/p/chromium/issues/detail?id=1313361:
+      substituteInPlace BUILD.gn \
+        --replace '"//infra/orchestrator:orchestrator_all",' ""
+      # Disable build flags that require LLVM 15:
+      substituteInPlace build/config/compiler/BUILD.gn \
+        --replace '"-Xclang",' "" \
+        --replace '"-no-opaque-pointers",' ""
    '' + ''
      # remove unused third-party
      for lib in ${toString gnSystemLibraries}; do
@ -289,7 +288,6 @@ let
      enable_widevine = true;
      # Provides the enable-webrtc-pipewire-capturer flag to support Wayland screen capture:
      rtc_use_pipewire = true;
-    } // optionalAttrs (chromiumVersionAtLeast "101") {
      # Disable PGO because the profile data requires a newer compiler version (LLVM 14 isn't sufficient):
      chrome_pgo_phase = 0;
    } // optionalAttrs proprietaryCodecs {
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -19,22 +19,9 @@
    }
  },
  "beta": {
-    "version": "101.0.4951.41",
-    "sha256": "0dzsbr309n70jg7fpq2qfnrgcm4553akvdmnzhss1fc85s467609",
-    "sha256bin64": "1jbj5cykxamf32c1s4gsid1wxcsdf4hng2d19q9h7b2ashkvvrbi",
-    "deps": {
-      "gn": {
-        "version": "2022-03-14",
-        "url": "https://gn.googlesource.com/gn",
-        "rev": "bd99dbf98cbdefe18a4128189665c5761263bcfb",
-        "sha256": "0nql15ckjqkm001xajq3qyn4h4q80i7x6dm9zinxxr1a8q5lppx3"
-      }
-    }
-  },
-  "dev": {
-    "version": "102.0.5005.22",
-    "sha256": "12s4w8qs71a7r13mm28w6kld2q21srwalsy2yfcys4kjmfp4gqfa",
-    "sha256bin64": "07jj7nvgalzvxacx6srccc82ggckzj4x10w1k2zskcyxpblnd7fc",
+    "version": "102.0.5005.27",
+    "sha256": "0fznry72w50dpijg55yxkaz1hv1zkvvxini3yxadwpfa5y0mpn3m",
+    "sha256bin64": "0k543zz3njsn5kh1wf90hqywll9s6g4xrnh2zqph066l91gj17rx",
    "deps": {
      "gn": {
        "version": "2022-04-14",
@ -44,20 +31,33 @@
      }
    }
  },
-  "ungoogled-chromium": {
-    "version": "100.0.4896.127",
-    "sha256": "0kgq38dy9mjyc44556i9gxhlsgd7dfvv1xi1ibk92b4p7i2y6427",
-    "sha256bin64": "0mm6lix14bf4ca440dyccnq54z0qvn5c886ghfyzy2q0bqzbq4nh",
+  "dev": {
+    "version": "103.0.5028.0",
+    "sha256": "06i6kgsdril5gfbjl1sh0z5hqvq64bchhb2z8w0h8cw9977bvqk6",
+    "sha256bin64": "09hxvcv5n1kd4qnwh6pxzmrlnc8xijm7rwb1c8c57v0jjb32x9ry",
    "deps": {
      "gn": {
-        "version": "2022-01-21",
+        "version": "2022-04-26",
        "url": "https://gn.googlesource.com/gn",
-        "rev": "0725d7827575b239594fbc8fd5192873a1d62f44",
-        "sha256": "1dzdvcn2r5c9giknvasf3y5y4901kav7igivjvrpww66ywsj8fzr"
+        "rev": "ced9fbfe6943854e65ada4ac1849d1fa4cb19348",
+        "sha256": "14fgjsfqihmma1cr8n30n37vxkf20paa6swq2yxn1agjvfr9cdvl"
+      }
+    }
+  },
+  "ungoogled-chromium": {
+    "version": "101.0.4951.41",
+    "sha256": "0dzsbr309n70jg7fpq2qfnrgcm4553akvdmnzhss1fc85s467609",
+    "sha256bin64": "12nzzsp4040mwc7jah5w0p58ckv8s16wv6ylf6vlmfby06a4xlkq",
+    "deps": {
+      "gn": {
+        "version": "2022-03-14",
+        "url": "https://gn.googlesource.com/gn",
+        "rev": "bd99dbf98cbdefe18a4128189665c5761263bcfb",
+        "sha256": "0nql15ckjqkm001xajq3qyn4h4q80i7x6dm9zinxxr1a8q5lppx3"
      },
      "ungoogled-patches": {
-        "rev": "100.0.4896.127-1",
-        "sha256": "192kyhr0fa97csciv5kp496y9zwcsknwlrmdr4jic3rvv8ig1q9y"
+        "rev": "101.0.4951.41-1",
+        "sha256": "19m31bd04yvba3w5iymkxfjnmilas3cfp383m9fl6pd4wwhy9md0"
      }
    }
  }
--- a/pkgs/applications/networking/browsers/firefox/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/firefox/librewolf/src.json
@ -1,8 +1,8 @@
 {
-  "packageVersion": "99.0.1-3",
+  "packageVersion": "99.0.1-4",
  "source": {
-    "rev": "99.0.1-3",
-    "sha256": "0ag4n86hvyp6kx3hp60yn7q45rgjbx7054frj6226ni2ribjx4ln"
+    "rev": "99.0.1-4",
+    "sha256": "0s0r9smyfr8yhbgp67569ki3lkc2dyv1dw9735njja2gy0nahgni"
  },
  "firefox": {
    "version": "99.0.1",
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@ -366,6 +366,11 @@ stdenv.mkDerivation rec {
      PULSE_SERVER="\''${PULSE_SERVER:-}" \
      PULSE_COOKIE="\''${PULSE_COOKIE:-}" \
      \
+      MOZ_ENABLE_WAYLAND=\$MOZ_ENABLE_WAYLAND \
+      WAYLAND_DISPLAY="\$WAYLAND_DISPLAY" \
+      XDG_RUNTIME_DIR="\$XDG_RUNTIME_DIR" \
+      XCURSOR_PATH="\$XCURSOR_PATH" \
+      \
      APULSE_PLAYBACK_DEVICE="\''${APULSE_PLAYBACK_DEVICE:-plug:dmix}" \
      \
      TOR_SKIP_LAUNCH="\''${TOR_SKIP_LAUNCH:-}" \
@ -404,7 +409,9 @@ stdenv.mkDerivation rec {
    LD_LIBRARY_PATH=$libPath $TBB_IN_STORE/TorBrowser/Tor/tor --version >/dev/null

    echo "Checking tor-browser wrapper ..."
-    DISPLAY="" XAUTHORITY="" DBUS_SESSION_BUS_ADDRESS="" TBB_HOME=$(mktemp -d) \
+    DISPLAY="" MOZ_ENABLE_WAYLAND="" WAYLAND_DISPLAY="" XAUTHORITY="" \
+      XCURSOR_PATH="" XDG_RUNTIME_DIR="" XDG_SESSION_TYPE="" \
+      DBUS_SESSION_BUS_ADDRESS="" TBB_HOME=$(mktemp -d) \
      $out/bin/tor-browser --version >/dev/null
  '';

--- a/pkgs/applications/networking/cluster/flink/default.nix
+++ b/pkgs/applications/networking/cluster/flink/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "flink";
-  version = "1.14.3";
+  version = "1.14.4";

  src = fetchurl {
    url = "mirror://apache/flink/${pname}-${version}/${pname}-${version}-bin-scala_2.11.tgz";
-    sha256 = "sha256-dst0Q1AlDdggtOwYROoV6QcBLRNfmGTo7DL2BV/5PB4=";
+    sha256 = "sha256-qvWUh+EQT/MljN5LCX2JLMEapIEGAbAljrCMTYsFqtw=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@ -1,9 +1,9 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles }:

 let
-  version = "0.29.4";
-  sha256 = "110wbz5dyzrzndr937in663cs9hwfs3glgm63f0md9gjj67mz0kk";
-  manifestsSha256 = "14vrkadv2gsz360s0naqr002sw8n5kvgskc13yx936mcz2vs465y";
+  version = "0.29.5";
+  sha256 = "1nqi7yk5d66fcjf6kyjivm3cbaqkj36ajgfvjm995q7cla2xyawm";
+  manifestsSha256 = "09rq7wiv3ixdp0p8isfp26vikyx523arzdyizi6yb90q6dl6hgc0";

  manifests = fetchzip {
    url =
@ -23,7 +23,7 @@ in buildGoModule rec {
    inherit sha256;
  };

-  vendorSha256 = "sha256-/8gRyaXTCWe+F4X3z5iT8QhE3LdiNEYKHjtoYKJB/HU=";
+  vendorSha256 = "sha256-dQV/8NF+sMiEoFr2wtR/oGqqn72JwH/JGbMREHIr/Tw=";

  postUnpack = ''
    cp -r ${manifests} source/cmd/flux/manifests
--- a/pkgs/applications/networking/cluster/fluxcd/update.sh
+++ b/pkgs/applications/networking/cluster/fluxcd/update.sh
@ -3,36 +3,43 @@

 set -x -eu -o pipefail

-cd $(dirname "${BASH_SOURCE[0]}")
+NIXPKGS_PATH="$(git rev-parse --show-toplevel)"
+FLUXCD_PATH="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"

-TAG=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} --silent https://api.github.com/repos/fluxcd/flux2/releases/latest | jq -r '.tag_name')
+OLD_VERSION="$(nix-instantiate --eval -E "with import $NIXPKGS_PATH {}; fluxcd.version or (builtins.parseDrvName fluxcd.name).version" | tr -d '"')"
+LATEST_TAG=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} --silent https://api.github.com/repos/fluxcd/flux2/releases/latest | jq -r '.tag_name')
+LATEST_VERSION=$(echo ${LATEST_TAG} | sed 's/^v//')

-VERSION=$(echo ${TAG} | sed 's/^v//')
+if [ ! "$OLD_VERSION" = "$LATEST_VERSION" ]; then
+    SHA256=$(nix-prefetch-url --quiet --unpack https://github.com/fluxcd/flux2/archive/refs/tags/${LATEST_TAG}.tar.gz)
+    SPEC_SHA256=$(nix-prefetch-url --quiet --unpack https://github.com/fluxcd/flux2/releases/download/${LATEST_TAG}/manifests.tar.gz)

-SHA256=$(nix-prefetch-url --quiet --unpack https://github.com/fluxcd/flux2/archive/refs/tags/${TAG}.tar.gz)
+    setKV () {
+        sed -i "s|$1 = \".*\"|$1 = \"${2:-}\"|" "${FLUXCD_PATH}/default.nix"
+    }

-SPEC_SHA256=$(nix-prefetch-url --quiet --unpack https://github.com/fluxcd/flux2/releases/download/${TAG}/manifests.tar.gz)
+    setKV version ${LATEST_VERSION}
+    setKV sha256 ${SHA256}
+    setKV manifestsSha256 ${SPEC_SHA256}
+    setKV vendorSha256 "0000000000000000000000000000000000000000000000000000" # The same as lib.fakeSha256

-setKV () {
-    sed -i "s|$1 = \".*\"|$1 = \"${2:-}\"|" ./default.nix
-}
+    set +e
+    VENDOR_SHA256=$(nix-build --no-out-link -A fluxcd $NIXPKGS_PATH 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g')
+    set -e

-setKV version ${VERSION}
-setKV sha256 ${SHA256}
-setKV manifestsSha256 ${SPEC_SHA256}
-setKV vendorSha256 "0000000000000000000000000000000000000000000000000000" # The same as lib.fakeSha256
+    if [ -n "${VENDOR_SHA256:-}" ]; then
+        setKV vendorSha256 ${VENDOR_SHA256}
+    else
+        echo "Update failed. VENDOR_SHA256 is empty."
+        exit 1
+    fi

-cd ../../../../../
-set +e
-VENDOR_SHA256=$(nix-build --no-out-link -A fluxcd 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g')
-set -e
-
-cd - > /dev/null
-
-if [ -n "${VENDOR_SHA256:-}" ]; then
-    setKV vendorSha256 ${VENDOR_SHA256}
+    # `git` flag here is to be used by local maintainers to speed up the bump process
+    if [ "$1" = "git" ]; then
+        git switch -c "package-fluxcd-${LATEST_VERSION}"
+        git add "$FLUXCD_PATH"/default.nix
+        git commit -m "fluxcd: ${OLD_VERSION} -> ${LATEST_VERSION}"
+    fi
 else
-    echo "Update failed. VENDOR_SHA256 is empty."
-    exit 1
+    echo "fluxcd is already up-to-date at $OLD_VERSION"
 fi
-
--- a/pkgs/applications/networking/cluster/talosctl/default.nix
+++ b/pkgs/applications/networking/cluster/talosctl/default.nix
@ -1,10 +1,10 @@
 { lib, buildGoModule, fetchFromGitHub, installShellFiles }:
 let
  # look for GO_LDFLAGS getting set in the Makefile
-  version = "1.0.3";
-  sha256 = "sha256-unGr+T2uYg7/4pAXf8vp9Hpi6IrCsLCqGbyBC7QXGX8=";
-  vendorSha256 = "sha256-9NYr5Ok9oQ1ajYFiTeU9ztmX/55UROBjNawLGjm4HYU=";
-  pkgsVersion = "v1.0.0-8-g76f8c5b";
+  version = "1.0.4";
+  sha256 = "sha256-kO48MRQDQGDUvFfsxAt+CAHn2EGU44NMpSKDWnNwAdk=";
+  vendorSha256 = "sha256-QcD5MKQO51ZZ/NvVIiAmDsN6wLI2N8YkhA387KB77W8=";
+  pkgsVersion = "v1.0.0-10-gbf81bd2";
  extrasVersion = "v1.0.0-2-gc5d3ab0";
 in
 buildGoModule rec {
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -17,6 +17,15 @@
    "vendorSha256": "1gpbc72q7mjyjxk75dyfi3j2fk6glgz0a15m2pq7clyc35kapnkc",
    "version": "2.8.0"
  },
+  "age": {
+    "owner": "clementblaise",
+    "provider-source-address": "registry.terraform.io/clementblaise/age",
+    "repo": "terraform-provider-age",
+    "rev": "v0.1.1",
+    "sha256": "sha256-bJrzjvkrCX93bNqCA+FdRibHnAw6cb61StqtwUY5ok4=",
+    "vendorSha256": "sha256-jK7JuARpoxq7hvq5+vTtUwcYot0YqlOZdtDwq4IqKvk=",
+    "version": "0.1.1"
+  },
  "aiven": {
    "owner": "aiven",
    "provider-source-address": "registry.terraform.io/aiven/aiven",
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json
@ -2,7 +2,7 @@
  "name": "element-desktop",
  "productName": "Element",
  "main": "lib/electron-main.js",
-  "version": "1.10.10",
+  "version": "1.10.11",
  "description": "A feature-rich client for Matrix.org",
  "author": "Element",
  "repository": {
@ -89,6 +89,7 @@
  },
  "build": {
    "appId": "im.riot.app",
+    "asarUnpack": "**/*.node",
    "files": [
      "package.json",
      {
--- a/pkgs/applications/networking/instant-messengers/element/pin.json
+++ b/pkgs/applications/networking/instant-messengers/element/pin.json
@ -1,6 +1,6 @@
 {
-  "version": "1.10.10",
-  "desktopSrcHash": "Atgcu+K28pScYokS/lTu+/mMeEC+1yTcn3Akq+KZJNY=",
+  "version": "1.10.11",
+  "desktopSrcHash": "n74KFmHI6ZQWBEJCR55VZHS//myh2RePcJRVOmZ6XHo=",
  "desktopYarnHash": "0jm0i1yyfkg1ll11pb3qif1vdxx6rp0yl9kd8jg9nhsg2jzw66pr",
-  "webHash": "1xp0rhw3k2znwvqqikhd771l2n6xyx8npcz87m9d4cisl82lpnr0"
+  "webHash": "02m64bhg1ls4a5igmizkkxnqfmbfhs0xy24ycr75vxmn0zmwa3yd"
 }
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@ -110,8 +110,8 @@ stdenv.mkDerivation rec {
    runHook preInstall
    ${rec {
      aarch64-darwin = ''
-        mkdir -p $out/Applications/zoom.us.app
-        cp -R . $out/Applications/zoom.us.app
+        mkdir -p $out/Applications
+        cp -R zoom.us.app $out/Applications/
      '';
      # darwin steps same on both architectures
      x86_64-darwin = aarch64-darwin;
--- a/pkgs/applications/networking/ipfs-cluster/default.nix
+++ b/pkgs/applications/networking/ipfs-cluster/default.nix
@ -2,26 +2,17 @@

 buildGoModule rec {
  pname = "ipfs-cluster";
-  version = "0.14.5";
+  version = "1.0.0";

-  vendorSha256 = "sha256-ykUjq7Svp3+kUNnFkwsBlC+C4nws6Yvu3bk2Wb4c8vY=";
+  vendorSha256 = "sha256-b0k1V1+JikGemSQjyiKcH7cgyDEt0Nn5aVUf6nnE+/0=";

  src = fetchFromGitHub {
    owner = "ipfs";
    repo = "ipfs-cluster";
    rev = "v${version}";
-    sha256 = "sha256-Xb7QbBmCJKgokxvdbtWxtnNIS/iUsYFLlRzgfoABAq8=";
+    sha256 = "sha256-vwu+Fj7PegbK9pmnsNuEl/AQz2gejRiFAAAov5+VNMQ=";
  };

-  # Remove patch when updating to >0.14.5
-  patches = [
-    (fetchpatch {
-      name = "remove-distribution-test.patch";
-      url = "https://github.com/ipfs/ipfs-cluster/pull/1589/commits/49825d1df76f848806f1d76abce5e279221cc8c5.patch";
-      sha256 = "sha256-mM2rc4ai/qhbvxnoRw5jO7BTRlD2/Tp037EuqqS49DE=";
-    })
-  ];
-
  meta = with lib; {
    description = "Allocate, replicate, and track Pins across a cluster of IPFS daemons";
    homepage = "https://cluster.ipfs.io/";
--- a/pkgs/applications/networking/nextcloud-client/default.nix
+++ b/pkgs/applications/networking/nextcloud-client/default.nix
@ -50,15 +50,18 @@ mkDerivation rec {
    done
  '';

+  # required to not include inkscape in the wrapper
+  strictDeps = true;
+
  nativeBuildInputs = [
    pkg-config
    cmake
-    extra-cmake-modules
    inkscape
    sphinx
  ];

  buildInputs = [
+    extra-cmake-modules
    inotify-tools
    libcloudproviders
    libsecret
@ -95,7 +98,7 @@ mkDerivation rec {
    description = "Nextcloud themed desktop client";
    homepage = "https://nextcloud.com";
    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ kranzes ];
+    maintainers = with maintainers; [ kranzes SuperSandro2000 ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/networking/p2p/qbittorrent/default.nix
+++ b/pkgs/applications/networking/p2p/qbittorrent/default.nix
@ -12,13 +12,13 @@ assert trackerSearch -> (python3 != null);
 with lib;
 mkDerivation rec {
  pname = "qbittorrent";
-  version = "4.4.1";
+  version = "4.4.2";

  src = fetchFromGitHub {
    owner = "qbittorrent";
    repo = "qBittorrent";
    rev = "release-${version}";
-    sha256 = "sha256-HNgegPL7M0zwkn7+lcNcsgWgrCbY9/d0nuIlIC5hkAM=";
+    sha256 = "sha256-xBNN9YYKMDcoL1wvERjlAjV8vb2GVgwwlHtb5y0+f+8=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "rclone";
-  version = "1.58.0";
+  version = "1.58.1";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-zCKXi3qeiq2AGT7UioVfCbB4bc5F2tXJ507zPa+O0pc=";
+    sha256 = "sha256-Hh0IVNaLAUOmdYJ6cbYFyDCLwL+0HyZdRzKnXAT0CB8=";
  };

-  vendorSha256 = "sha256-mgupx5SNQ3wUkQCeTVnw3wwdSCrTcwLYxcX6tlqXTyQ=";
+  vendorSha256 = "sha256-MPo1t1gzlrzAzbTOv/dSs2BH8NwlXmf6vo1DOFP2TrM=";

  subPackages = [ "." ];

--- a/pkgs/applications/office/beamerpresenter/default.nix
+++ b/pkgs/applications/office/beamerpresenter/default.nix
@ -1,46 +1,69 @@
-{ lib, stdenv, fetchFromGitHub, installShellFiles,
-  qmake, qtbase, qtmultimedia, wrapQtAppsHook,
-  poppler, mupdf, freetype, jbig2dec, openjpeg, gumbo,
-  renderer ? "mupdf" }:
+{ lib,
+  stdenv,
+  fetchFromGitHub,
+  installShellFiles,
+  pkg-config,
+  cmake,
+  qtbase,
+  qtmultimedia,
+  qttools,
+  wrapQtAppsHook,
+  bash,
+  zlib,
+  gcc,
+  gnumake,
+  coreutils,
+  # only required when using poppler
+  poppler,
+  # only required when using mupdf
+  mupdf,
+  freetype,
+  jbig2dec,
+  openjpeg,
+  gumbo,
+  # choose renderer: mupdf or poppler or both (not recommended)
+  renderer ? "mupdf",
+  # choose major Qt version: "5" or "6" (only 5 is tested)
+  qt_version ? "5"}:

 let
  renderers = {
    mupdf.buildInputs = [ mupdf freetype jbig2dec openjpeg gumbo ];
    poppler.buildInputs = [ poppler ];
  };
-
+  use_poppler = if "${renderer}" == "poppler" || "${renderer}" == "both" then "ON" else "OFF";
+  use_mupdf = if "${renderer}" == "mupdf" || "${renderer}" == "both" then "ON" else "OFF";
 in

 stdenv.mkDerivation rec {
  pname = "beamerpresenter";
-  version = "0.2.1";
+  version = "0.2.2";

  src = fetchFromGitHub {
    owner = "stiglers-eponym";
    repo = "BeamerPresenter";
    rev = "v${version}";
-    sha256 = "sha256-+ZxllYL2wco4bG2pqInIbL9qfOoqoUJJUReqDyEBRcI=";
+    sha256 = "16v263nnnipih3lxg95rmwz0ihnvpl4n1wlj9r6zavnspzlp9dvb";
  };

-  nativeBuildInputs = [ qmake installShellFiles wrapQtAppsHook ];
-  buildInputs = [ qtbase qtmultimedia ] ++ renderers.${renderer}.buildInputs;
+  nativeBuildInputs = [ pkg-config installShellFiles wrapQtAppsHook ];
+  buildInputs = [ gcc cmake coreutils gnumake bash zlib qtbase qtmultimedia qttools ] ++ renderers.${renderer}.buildInputs;

-  qmakeFlags = [ "RENDERER=${renderer}" ];
-
-  postPatch = ''
-    shopt -s globstar
-    for f in **/*.{pro,conf,h,cpp}; do
-      substituteInPlace "$f" \
-        --replace "/usr/" "$out/" \
-        --replace "/etc/" "$out/etc/" \
-        --replace '$${GUI_CONFIG_PATH}' "$out/etc/xdg/beamerpresenter/gui.json"
-    done
-  '';
+  cmakeFlags = [
+    "-DCMAKE_BUILD_TYPE='Release'"
+    "-DGIT_VERSION=OFF"
+    "-DUSE_POPPLER=${use_poppler}"
+    "-DUSE_MUPDF=${use_mupdf}"
+    "-DUSE_MUJS=OFF"
+    "-DUSE_GUMBO=ON"
+    "-DUSE_TRANSLATIONS=ON"
+    "-DQT_VERSION_MAJOR=${qt_version}"
+  ];

  meta = with lib; {
-    description = "Modular multi screen pdf presentation software respecting your window manager";
+    description = "Modular multi screen pdf presentation viewer";
    homepage = "https://github.com/stiglers-eponym/BeamerPresenter";
-    license = licenses.agpl3Plus;
+    license = with licenses; [ agpl3 gpl3Plus ];
    platforms = platforms.all;
    maintainers = with maintainers; [ pacien ];
  };
--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@ -41,12 +41,12 @@

 stdenv.mkDerivation rec {
  pname = "zotero";
-  version = "6.0";
+  version = "6.0.4";

  src = fetchurl {
    url =
      "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    sha256 = "0zkgmmflcj6vbyv8rs51jf3vx1zq8pl7b5d5asgayhrdlwi0qgff";
+    sha256 = "sha256-KPvsyN3qpnG8/qRwTlWe2mZWnI9OfxlHu6OUubItJZc=";
  };

  nativeBuildInputs = [ wrapGAppsHook ];
--- a/pkgs/applications/radio/rtl-sdr/default.nix
+++ b/pkgs/applications/radio/rtl-sdr/default.nix
@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchgit
+, fetchFromGitHub
 , cmake
 , pkg-config
 , libusb1
@ -8,12 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "rtl-sdr";
-  version = "0.6.0";
+  version = "0.8.0";

-  src = fetchgit {
-    url = "git://git.osmocom.org/rtl-sdr.git";
-    rev = "refs/tags/${version}";
-    sha256 = "0lmvsnb4xw4hmz6zs0z5ilsah5hjz29g1s0050n59fllskqr3b8k";
+  src = fetchFromGitHub {
+    owner = "librtlsdr";
+    repo = "librtlsdr";
+    rev = "v${version}";
+    sha256 = "1fgxlkgmdchbrf0nn98ivjr6css5hak3608nr4xrf2qzf7xy2kdk";
  };

  postPatch = ''
@ -28,7 +29,10 @@ stdenv.mkDerivation rec {

  buildInputs = [ libusb1 ];

-  cmakeFlags = lib.optional stdenv.isLinux "-DINSTALL_UDEV_RULES=ON";
+  cmakeFlags = lib.optional stdenv.isLinux [
+    "-DINSTALL_UDEV_RULES=ON"
+    "-DWITH_RPC=ON"
+  ];

  meta = with lib; {
    description = "Turns your Realtek RTL2832 based DVB dongle into a SDR receiver";
--- a/pkgs/applications/radio/uhd/default.nix
+++ b/pkgs/applications/radio/uhd/default.nix
@ -41,6 +41,8 @@ stdenv.mkDerivation rec {
  # and xxx.yyy.zzz. Hrmpf... style keeps changing
  version = "4.1.0.5";

+  outputs = [ "out" "dev" ];
+
  src = fetchFromGitHub {
    owner = "EttusResearch";
    repo = "uhd";
--- a/pkgs/applications/science/biology/blast/default.nix
+++ b/pkgs/applications/science/biology/blast/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "blast";
-  version = "2.12.0";
+  version = "2.13.0";

  src = fetchurl {
    url = "https://ftp.ncbi.nlm.nih.gov/blast/executables/blast+/${version}/ncbi-blast-${version}+-src.tar.gz";
-    sha256 = "122bf45cyj3s3zv2lw1y1rhz7g22v0va560ai30xdjl8sk4wk8zx";
+    sha256 = "sha256-iVU3FNEz2vKMR3+D0zN5Szxi5BSECMByobRiDl7E/rI=";
  };

  sourceRoot = "ncbi-blast-${version}+-src/c++";
--- a/pkgs/applications/science/computer-architecture/qtrvsim/default.nix
+++ b/pkgs/applications/science/computer-architecture/qtrvsim/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "QtRVSim";
-  version = "0.9.2";
+  version = "0.9.3";

  src = fetchFromGitHub {
    owner = "cvut";
    repo = "qtrvsim";
    rev = "refs/tags/v${version}";
-    sha256 = "B1l+ysrodeDbxYfdLLMF8yk4/uPXTcDrTaMtYm89HuU=";
+    sha256 = "BV/nHRvimPaBtY1nfK1PZ2yJ9xWZpNlwiTRfI/9KQec=";
  };

  nativeBuildInputs = [ cmake wrapQtAppsHook ];
--- a/pkgs/applications/science/math/adolc/default.nix
+++ b/pkgs/applications/science/math/adolc/default.nix
@ -0,0 +1,23 @@
+{ lib, stdenv, fetchFromGitHub }:
+
+stdenv.mkDerivation rec {
+  pname = "adolc";
+  version = "2.7.2";
+
+  src = fetchFromGitHub {
+    owner = "coin-or";
+    repo = "ADOL-C";
+    sha256 = "1w0x0p32r1amfmh2lyx33j4cb5bpkwjr5z0ll43zi5wf5gsvckd1";
+    rev = "releases/${version}";
+  };
+
+  configureFlags = [ "--with-openmp-flag=-fopenmp" ];
+
+  meta = with lib; {
+    description = "Automatic Differentiation of C/C++";
+    homepage = "https://github.com/coin-or/ADOL-C";
+    maintainers = [ maintainers.bzizou ];
+    license = licenses.gpl2Plus;
+  };
+}
+
--- a/pkgs/applications/version-management/git-and-tools/git-interactive-rebase-tool/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-interactive-rebase-tool/default.nix
@ -1,25 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, rustPlatform, libiconv, Security }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform, libiconv, Security }:

 rustPlatform.buildRustPackage rec {
  pname = "git-interactive-rebase-tool";
-  version = "2.1.0";
+  version = "2.2.0";

  src = fetchFromGitHub {
    owner = "MitMaro";
    repo = pname;
    rev = version;
-    sha256 = "sha256-DYl/GUbeNtKmXoR3gq8mK8EfsZNVNlrdngAwfzG+epw=";
+    sha256 = "sha256-++KTMzTt84dowoZP+Bc9E/jUS21YN5ybKrlpQUKCir0=";
  };

-  cargoPatches = [
-    # update git2 crate to fix a compile error
-    (fetchpatch {
-      url = "https://github.com/MitMaro/git-interactive-rebase-tool/commit/f4d3026f23118d29a263bbca6c83f963e76c34c4.patch";
-      sha256 = "sha256-6ErPRcPbPRXbEslNiNInbbUhbOWb9ZRll7ZDRgTpWS4=";
-    })
-  ];
-
-  cargoSha256 = "sha256-2aHW9JIiqkO0X0B0D44tSZ8QkmKH/QZoYvKNEQWldo4=";
+  cargoSha256 = "sha256-OUaP/nDs589FYaGYcleRMTQNu3/q/2wBjHSv2q8OyjA=";

  buildInputs = lib.optionals stdenv.isDarwin [ libiconv Security ];

--- a/pkgs/applications/version-management/redmine/Gemfile
+++ b/pkgs/applications/version-management/redmine/Gemfile
@ -3,7 +3,7 @@ source 'https://rubygems.org'
 ruby '>= 2.4.0', '< 2.8.0'
 gem 'bundler', '>= 1.12.0'

-gem 'rails', '5.2.6.2'
+gem 'rails', '5.2.6.3'
 gem 'sprockets', '~> 3.7.2' if RUBY_VERSION < '2.5'
 gem 'globalid', '~> 0.4.2' if Gem.ruby_version < Gem::Version.new('2.6.0')
 gem 'rouge', '~> 3.26.0'
@ -24,7 +24,7 @@ gem 'rubyzip', '~> 2.3.0'
 gem 'tzinfo-data', platforms: [:mingw, :x64_mingw, :mswin]

 # TOTP-based 2-factor authentication
-gem 'rotp'
+gem 'rotp', '>= 5.0.0'
 gem 'rqrcode'

 # Optional gem for LDAP authentication
--- a/pkgs/applications/version-management/redmine/Gemfile.lock
+++ b/pkgs/applications/version-management/redmine/Gemfile.lock
@ -1,19 +1,19 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    actioncable (5.2.6.2)
-      actionpack (= 5.2.6.2)
+    actioncable (5.2.6.3)
+      actionpack (= 5.2.6.3)
      nio4r (~> 2.0)
      websocket-driver (>= 0.6.1)
-    actionmailer (5.2.6.2)
-      actionpack (= 5.2.6.2)
-      actionview (= 5.2.6.2)
-      activejob (= 5.2.6.2)
+    actionmailer (5.2.6.3)
+      actionpack (= 5.2.6.3)
+      actionview (= 5.2.6.3)
+      activejob (= 5.2.6.3)
      mail (~> 2.5, >= 2.5.4)
      rails-dom-testing (~> 2.0)
-    actionpack (5.2.6.2)
-      actionview (= 5.2.6.2)
-      activesupport (= 5.2.6.2)
+    actionpack (5.2.6.3)
+      actionview (= 5.2.6.3)
+      activesupport (= 5.2.6.3)
      rack (~> 2.0, >= 2.0.8)
      rack-test (>= 0.6.3)
      rails-dom-testing (~> 2.0)
@ -21,26 +21,26 @@ GEM
    actionpack-xml_parser (2.0.1)
      actionpack (>= 5.0)
      railties (>= 5.0)
-    actionview (5.2.6.2)
-      activesupport (= 5.2.6.2)
+    actionview (5.2.6.3)
+      activesupport (= 5.2.6.3)
      builder (~> 3.1)
      erubi (~> 1.4)
      rails-dom-testing (~> 2.0)
      rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activejob (5.2.6.2)
-      activesupport (= 5.2.6.2)
+    activejob (5.2.6.3)
+      activesupport (= 5.2.6.3)
      globalid (>= 0.3.6)
-    activemodel (5.2.6.2)
-      activesupport (= 5.2.6.2)
-    activerecord (5.2.6.2)
-      activemodel (= 5.2.6.2)
-      activesupport (= 5.2.6.2)
+    activemodel (5.2.6.3)
+      activesupport (= 5.2.6.3)
+    activerecord (5.2.6.3)
+      activemodel (= 5.2.6.3)
+      activesupport (= 5.2.6.3)
      arel (>= 9.0)
-    activestorage (5.2.6.2)
-      actionpack (= 5.2.6.2)
-      activerecord (= 5.2.6.2)
+    activestorage (5.2.6.3)
+      actionpack (= 5.2.6.3)
+      activerecord (= 5.2.6.3)
      marcel (~> 1.0.0)
-    activesupport (5.2.6.2)
+    activesupport (5.2.6.3)
      concurrent-ruby (~> 1.0, >= 1.0.2)
      i18n (>= 0.7, < 2)
      minitest (~> 5.1)
@ -60,7 +60,7 @@ GEM
      xpath (~> 3.2)
    childprocess (4.1.0)
    chunky_png (1.4.0)
-    concurrent-ruby (1.1.9)
+    concurrent-ruby (1.1.10)
    crass (1.0.6)
    css_parser (1.11.0)
      addressable
@ -72,7 +72,7 @@ GEM
    htmlentities (4.3.4)
    i18n (1.8.11)
      concurrent-ruby (~> 1.0)
-    loofah (2.14.0)
+    loofah (2.16.0)
      crass (~> 1.0.2)
      nokogiri (>= 1.5.9)
    mail (2.7.1)
@ -81,21 +81,19 @@ GEM
    method_source (1.0.0)
    mini_magick (4.11.0)
    mini_mime (1.0.3)
-    mini_portile2 (2.5.3)
    minitest (5.15.0)
    mocha (1.13.0)
    mysql2 (0.5.3)
    net-ldap (0.17.0)
    nio4r (2.5.8)
    nokogiri (1.11.7)
-      mini_portile2 (~> 2.5.0)
      racc (~> 1.4)
-    parallel (1.21.0)
-    parser (3.1.1.0)
+    parallel (1.22.1)
+    parser (3.1.2.0)
      ast (~> 2.4.1)
    pg (1.2.3)
-    public_suffix (4.0.6)
-    puma (5.6.2)
+    public_suffix (4.0.7)
+    puma (5.6.4)
      nio4r (~> 2.0)
    racc (1.6.0)
    rack (2.2.3)
@ -104,27 +102,27 @@ GEM
      ruby-openid (>= 2.1.8)
    rack-test (1.1.0)
      rack (>= 1.0, < 3)
-    rails (5.2.6.2)
-      actioncable (= 5.2.6.2)
-      actionmailer (= 5.2.6.2)
-      actionpack (= 5.2.6.2)
-      actionview (= 5.2.6.2)
-      activejob (= 5.2.6.2)
-      activemodel (= 5.2.6.2)
-      activerecord (= 5.2.6.2)
-      activestorage (= 5.2.6.2)
-      activesupport (= 5.2.6.2)
+    rails (5.2.6.3)
+      actioncable (= 5.2.6.3)
+      actionmailer (= 5.2.6.3)
+      actionpack (= 5.2.6.3)
+      actionview (= 5.2.6.3)
+      activejob (= 5.2.6.3)
+      activemodel (= 5.2.6.3)
+      activerecord (= 5.2.6.3)
+      activestorage (= 5.2.6.3)
+      activesupport (= 5.2.6.3)
      bundler (>= 1.3.0)
-      railties (= 5.2.6.2)
+      railties (= 5.2.6.3)
      sprockets-rails (>= 2.0.0)
    rails-dom-testing (2.0.3)
      activesupport (>= 4.2.0)
      nokogiri (>= 1.6)
    rails-html-sanitizer (1.4.2)
      loofah (~> 2.3)
-    railties (5.2.6.2)
-      actionpack (= 5.2.6.2)
-      activesupport (= 5.2.6.2)
+    railties (5.2.6.3)
+      actionpack (= 5.2.6.3)
+      activesupport (= 5.2.6.3)
      method_source
      rake (>= 0.8.7)
      thor (>= 0.19.0, < 2.0)
@ -160,7 +158,7 @@ GEM
      rubocop-ast (>= 1.2.0, < 2.0)
      ruby-progressbar (~> 1.7)
      unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.16.0)
+    rubocop-ast (1.17.0)
      parser (>= 3.1.1.0)
    rubocop-performance (1.10.2)
      rubocop (>= 0.90.0, < 2.0)
@ -180,7 +178,7 @@ GEM
      docile (~> 1.1)
      simplecov-html (~> 0.11)
    simplecov-html (0.12.3)
-    sprockets (4.0.2)
+    sprockets (4.0.3)
      concurrent-ruby (~> 1.0)
      rack (> 1, < 3)
    sprockets-rails (3.4.2)
@ -227,13 +225,13 @@ DEPENDENCIES
  pg (~> 1.2.2)
  puma
  rack-openid
-  rails (= 5.2.6.2)
+  rails (= 5.2.6.3)
  rails-dom-testing
  rbpdf (~> 1.20.0)
  redcarpet (~> 3.5.1)
  request_store (~> 1.5.0)
  roadie-rails (~> 2.2.0)
-  rotp
+  rotp (>= 5.0.0)
  rouge (~> 3.26.0)
  rqrcode
  rubocop (~> 1.12.0)
@ -248,7 +246,7 @@ DEPENDENCIES
  yard

 RUBY VERSION
-   ruby 2.7.4p191
+   ruby 2.7.6p219

 BUNDLED WITH
-   2.1.4
+   2.2.33
--- a/pkgs/applications/version-management/redmine/default.nix
+++ b/pkgs/applications/version-management/redmine/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, bundlerEnv, ruby, makeWrapper }:

 let
-  version = "4.2.4";
+  version = "4.2.5";
  rubyEnv = bundlerEnv {
    name = "redmine-env-${version}";

@ -15,10 +15,8 @@ in
    inherit version;

    src = fetchurl {
-      # https://www.redmine.org/news/134
-      # > "These releases are not available yet on the releases page from a technical reason, we are sorry for this and we expected to have them uploaded next week. I'll post here an update after we have them uploaded."
-      url = "https://www.redmine.org/attachments/download/28862/${pname}-${version}.tar.gz";
-      sha256 = "7f50fd4a6cf1c1e48091a87696b813ba264e11f04dec67fb006858a1b49a5c7d";
+      url = "https://www.redmine.org/releases/${pname}-${version}.tar.gz";
+      sha256 = "112rc2sjx6x7046fjz7np0ilszvkqapc180ld02ncwmdxaq88w6r";
    };

    nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/version-management/redmine/gemset.nix
+++ b/pkgs/applications/version-management/redmine/gemset.nix
@ -5,10 +5,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0il9l30jz1gfjccrahfk2gl57b31dqgjlzjc8cfifm76ggywmz67";
+      sha256 = "1gmwailk92znzrdpi4116ih6bq609a38rpnszzh5piq7b507ikpn";
      type = "gem";
    };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
  };
  actionmailer = {
    dependencies = ["actionpack" "actionview" "activejob" "mail" "rails-dom-testing"];
@ -16,10 +16,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1cci24da56d467ldq40n3l176h9qdw691w1b703c251izh6c4n5d";
+      sha256 = "103a1nixkazzdk21bg42vs722m6gm0vf17ag2fdad5dycwk3ycpp";
      type = "gem";
    };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
  };
  actionpack = {
    dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
@ -27,10 +27,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1xis55xvs4hja6fnmj4785rzafk553k5f0xb7jprqf38c6dzmiak";
+      sha256 = "15fz3rjk85svpx9lsqfdwlvyd972zf0g5jasnsllcbf6d300gdj6";
      type = "gem";
    };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
  };
  actionpack-xml_parser = {
    dependencies = ["actionpack" "railties"];
@ -49,10 +49,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "00a9g63xwfimnzsrcrnr4vmdwhg7jaic49jas70r695nznwkxr9x";
+      sha256 = "00cfpmbk8gw9c589xnqazsbd860p2368gyh8nyzixcsa6k28wfwv";
      type = "gem";
    };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
  };
  activejob = {
    dependencies = ["activesupport" "globalid"];
@ -60,10 +60,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0fm5qxrv8pxhl7m88p17xxpizddasm9kknaldkax8im3b9vrgnr9";
+      sha256 = "1gczbnk7qy4rjhv0q82nd70xawc9lb1vinvwr4ngpim5rqwzm6d6";
      type = "gem";
    };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
  };
  activemodel = {
    dependencies = ["activesupport"];
@ -71,10 +71,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0k0xizwbcadmslc8rkg2vnsbrsqivm6yj2yjrzb6rhqwphcr9zjf";
+      sha256 = "0ib8qlbwr9hp5284c6bmx08lrfy45zzd4inzmawz08alkgdcrzca";
      type = "gem";
    };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
  };
  activerecord = {
    dependencies = ["activemodel" "activesupport" "arel"];
@ -82,10 +82,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1m00zh62rfn2h15vfn89jg39wxmghc88v2vjb5r4m0c7g24vrb14";
+      sha256 = "0ky3zc8i5rjg2dpdb95icsgb443siim9sv71xwcmryjxp5rhkqyx";
      type = "gem";
    };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
  };
  activestorage = {
    dependencies = ["actionpack" "activerecord" "marcel"];
@ -93,10 +93,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0h3z331xli0j5didh0g9cv4zrlx32b5csp1566fpy0fr2kgqmpi9";
+      sha256 = "1risg5jklxrm7j5i4rzaqpb94822ivbjaasblppwmx5f33vhfpca";
      type = "gem";
    };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
  };
  activesupport = {
    dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo"];
@ -104,10 +104,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "164lmi9w96wdwd00dnly8f9dcak3blv49ymyqz30q2fdjn45c775";
+      sha256 = "09vif5aajkvrsdcl51kvk8crz8hl38awprh7d5wj93nscpxmqgns";
      type = "gem";
    };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
  };
  addressable = {
    dependencies = ["public_suffix"];
@ -186,10 +186,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0nwad3211p7yv9sda31jmbyw6sdafzmdi2i2niaz6f0wk5nq9h0f";
+      sha256 = "0s4fpn3mqiizpmpy2a24k4v365pv75y50292r8ajrv4i1p5b2k14";
      type = "gem";
    };
-    version = "1.1.9";
+    version = "1.1.10";
  };
  crass = {
    groups = ["default"];
@ -280,10 +280,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0z8bdcmw66j3dy6ivcc02yq32lx3n9bavx497llln8qy014xjm4w";
+      sha256 = "15s6z5bvhdhnqv4wg8zcz3mhbc7i4dbqskv5jvhprz33ak7682km";
      type = "gem";
    };
-    version = "2.14.0";
+    version = "2.16.0";
  };
  mail = {
    dependencies = ["mini_mime"];
@ -336,16 +336,6 @@
    };
    version = "1.0.3";
  };
-  mini_portile2 = {
-    groups = ["default" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1ad0mli9rc0f17zw4ibp24dbj1y39zkykijsjmnzl4gwpg5s0j6k";
-      type = "gem";
-    };
-    version = "2.5.3";
-  };
  minitest = {
    groups = ["default" "test"];
    platforms = [];
@ -405,7 +395,7 @@
    version = "2.5.8";
  };
  nokogiri = {
-    dependencies = ["mini_portile2" "racc"];
+    dependencies = ["racc"];
    groups = ["default" "test"];
    platforms = [];
    source = {
@ -420,10 +410,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1hkfpm78c2vs1qblnva3k1grijvxh87iixcnyd83s3lxrxsjvag4";
+      sha256 = "07vnk6bb54k4yc06xnwck7php50l09vvlw1ga8wdz0pia461zpzb";
      type = "gem";
    };
-    version = "1.21.0";
+    version = "1.22.1";
  };
  parser = {
    dependencies = ["ast"];
@ -431,10 +421,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0zaghgvva2q4jqbachg8jvpwgbg3w1jqr0d00m8rqciqznjgsw3c";
+      sha256 = "0xhfghgidj8cbdnqp01f7kvnrv1f60izpkd9dhxsvpdzkfsdg97d";
      type = "gem";
    };
-    version = "3.1.1.0";
+    version = "3.1.2.0";
  };
  pg = {
    groups = ["default"];
@ -459,10 +449,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1xqcgkl7bwws1qrlnmxgh8g4g9m10vg60bhlw40fplninb3ng6d9";
+      sha256 = "1f3knlwfwm05sfbaihrxm4g772b79032q14c16q4b38z8bi63qcb";
      type = "gem";
    };
-    version = "4.0.6";
+    version = "4.0.7";
  };
  puma = {
    dependencies = ["nio4r"];
@ -470,10 +460,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1np2myaxlk5iab1zarwgmp7zsjvm5j8ssg35ijv8b6dpvc3cjd56";
+      sha256 = "0dgr2rybayih2naz3658mbzqwfrg9fxl80zsvhscf6b972kp3jdw";
      type = "gem";
    };
-    version = "5.6.2";
+    version = "5.6.4";
  };
  racc = {
    groups = ["default" "test"];
@ -523,10 +513,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0fgbld733j2j85pf8kpv1mvp8rmlkqs7ccv77q2mwfm7ri4yisy0";
+      sha256 = "19962nkjssr77753a8893yz17kmvb63h9rl3ajq6r8rx9xifq8fn";
      type = "gem";
    };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
  };
  rails-dom-testing = {
    dependencies = ["activesupport" "nokogiri"];
@ -556,10 +546,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1fgyw80j2mss3hdhzxa1b12c7j17az55znq0d16md69if8dwfmic";
+      sha256 = "0waa50li6vvckz9mznyz4jhks46ba09fmbdadrrj35mzwahyb6fy";
      type = "gem";
    };
-    version = "5.2.6.2";
+    version = "5.2.6.3";
  };
  rainbow = {
    groups = ["default" "test"];
@ -723,10 +713,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1bd2z82ly7fix8415gvfiwzb6bjialz5rs3sr72kv1lk68rd23wv";
+      sha256 = "1k9izkr5rhw3zc309yjp17z7496l74j4li3zrcgpgqfnqwz695qx";
      type = "gem";
    };
-    version = "1.16.0";
+    version = "1.17.0";
  };
  rubocop-performance = {
    dependencies = ["rubocop" "rubocop-ast"];
@ -818,10 +808,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0ikgwbl6jv3frfiy3xhg5yxw9d0064rgzghar1rg391xmrc4gm38";
+      sha256 = "19k5cwg8gyb6lkmz4kab7c5nlplpgj64jy7vw8p5l2i2ysq5hym0";
      type = "gem";
    };
-    version = "4.0.2";
+    version = "4.0.3";
  };
  sprockets-rails = {
    dependencies = ["actionpack" "activesupport" "sprockets"];
--- a/pkgs/applications/version-management/redmine/update.sh
+++ b/pkgs/applications/version-management/redmine/update.sh
@ -0,0 +1,17 @@
+#!/usr/bin/env nix-shell
+#!nix-shell --pure -i bash -p cacert bundix
+
+# Do these steps before running this script:
+#   1. Copy Gemfile from new Redmine version to this folder
+#   2. Manually modify the database lines in Gemfile (diff the two files, it's obvious)
+
+pkg_dir="$(dirname "$0")"
+cd ${pkg_dir}
+
+for file in "gemset.nix" "Gemfile.lock"; do
+  if [ -f ${file} ]; then
+    rm ${file}
+  fi
+done
+
+bundix -l
--- a/pkgs/applications/version-management/subversion/default.nix
+++ b/pkgs/applications/version-management/subversion/default.nix
@ -119,11 +119,6 @@ let
  });

 in {
-  subversion_1_10 = common {
-    version = "1.10.8";
-    sha256 = "sha256-CnO6MSe1ov/7j+4rcCmE8qgI3nEKjbKLfdQBDYvlDlo=";
-  };
-
  subversion = common {
    version = "1.14.2";
    sha256 = "sha256-yRMOjQt1copm8OcDj8dwUuZxgw14W1YWqtU7SBDTzCg=";
--- a/pkgs/applications/video/hyperion-ng/default.nix
+++ b/pkgs/applications/video/hyperion-ng/default.nix
@ -0,0 +1,50 @@
+{ avahi-compat, cmake, fetchFromGitHub, flatbuffers, hidapi, lib, libcec
+, libusb1, libX11, libxcb, libXrandr, mbedtls, mkDerivation, protobuf, python3
+, qtbase, qtserialport, qtsvg, qtx11extras, wrapQtAppsHook }:
+
+mkDerivation rec {
+  pname = "hyperion.ng";
+  version = "2.0.12";
+
+  src = fetchFromGitHub {
+    owner = "hyperion-project";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-J31QaWwGNhIpnZmWN9lZEI6fC0VheY5X8fGchQqtAlQ=";
+  };
+
+  buildInputs = [
+    avahi-compat
+    flatbuffers
+    hidapi
+    libcec
+    libusb1
+    libX11
+    libxcb
+    libXrandr
+    mbedtls
+    protobuf
+    python3
+    qtbase
+    qtserialport
+    qtsvg
+    qtx11extras
+  ];
+
+  nativeBuildInputs = [ cmake wrapQtAppsHook ];
+
+  cmakeFlags = [
+    "-DCMAKE_BUILD_TYPE=Release"
+    "-DUSE_SYSTEM_MBEDTLS_LIBS=ON"
+    "-DUSE_SYSTEM_FLATBUFFERS_LIBS=ON"
+    "-DUSE_SYSTEM_PROTO_LIBS=ON"
+  ];
+
+  meta = with lib; {
+    description = "Open Source Ambilight solution";
+    homepage = "https://github.com/hyperion-project/hyperion.ng";
+    license = licenses.mit;
+    maintainers = with maintainers; [ algram ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/applications/video/lightworks/default.nix
+++ b/pkgs/applications/video/lightworks/default.nix
@ -23,15 +23,15 @@ let
  ];

  lightworks = stdenv.mkDerivation rec {
-    version = "2021.2.1";
-    rev = "128456";
+    version = "2022.1.1";
+    rev = "132926";
    pname = "lightworks";

    src =
      if stdenv.hostPlatform.system == "x86_64-linux" then
        fetchurl {
-          url = "https://cdn.lwks.com/releases/${version}/lightworks_${lib.versions.majorMinor version}_r${rev}.deb";
-          sha256 = "sha256-GkTg43IUF1NgEm/wT9CZw68Dw/R2BYBU/F4bsCxQowQ=";
+          url = "https://cdn.lwks.com/releases/${version}/lightworks_${version}_r${rev}.deb";
+          sha256 = "sha256-f2lxfv0sFESpDnINDKlfVcR0pySAueMeOMbkgBWzz7Q=";
        }
      else throw "${pname}-${version} is not supported on ${stdenv.hostPlatform.system}";

--- a/pkgs/applications/virtualization/distrobox/default.nix
+++ b/pkgs/applications/virtualization/distrobox/default.nix
@ -2,13 +2,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "distrobox";
-  version = "1.2.14";
+  version = "1.2.15";

  src = fetchFromGitHub {
    owner = "89luca89";
    repo = pname;
    rev = version;
-    sha256 = "sha256-gHKyuIL4K/SLBJw8xNuPdNifDcHI91AFTiHaiv38gus=";
+    sha256 = "sha256-9rivXnHyEE1MoGY+CwUeDStLGPVq+4FvwPjV7Nblk60=";
  };

  dontConfigure = true;
--- a/pkgs/applications/virtualization/podman-tui/default.nix
+++ b/pkgs/applications/virtualization/podman-tui/default.nix
@ -11,13 +11,13 @@
 }:
 buildGoModule rec {
  pname = "podman-tui";
-  version = "0.3.0";
+  version = "0.3.1";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "podman-tui";
    rev = "v${version}";
-    sha256 = "sha256-1WbDmnKyFosp4Kz9QINr3lOR/wD0UW2QZf7nAAaoClM=";
+    sha256 = "sha256-Xc6F87evQiv4jRbxxRBzJBeI8653HvlQL+UwcVWY0wk=";
  };

  vendorSha256 = null;
--- a/pkgs/build-support/rust/default-crate-overrides.nix
+++ b/pkgs/build-support/rust/default-crate-overrides.nix
@ -170,7 +170,7 @@ in
  };

  security-framework-sys = attr: {
-    propagatedBuildInputs = [ Security ];
+    propagatedBuildInputs = lib.optional stdenv.isDarwin Security;
  };

  sequoia-openpgp = attrs: {
--- a/pkgs/data/fonts/amiri/default.nix
+++ b/pkgs/data/fonts/amiri/default.nix
@ -1,14 +1,14 @@
 { lib, fetchzip }:

 let
-  version = "0.113";
+  version = "0.114";

 in fetchzip rec {
  name = "Amiri-${version}";

  url = "https://github.com/alif-type/amiri/releases/download/${version}/${name}.zip";

-  sha256 = "0v5xm4spyww8wy6j9kpb01ixrakw7wp6jng4xnh220iy6yqcxm7v";
+  sha256 = "sha256-6FA46j1shP0R8iEi/Xop2kXS0OKW1jaGUEOthT3Z5b4=";

  postFetch = ''
    unzip $downloadedFile
--- a/pkgs/data/fonts/annapurna-sil/default.nix
+++ b/pkgs/data/fonts/annapurna-sil/default.nix
@ -0,0 +1,29 @@
+{ lib, fetchzip }:
+
+let
+  version = "1.204";
+in
+  fetchzip rec {
+    name = "annapurna-sil-${version}";
+
+    url = "https://software.sil.org/downloads/r/annapurna/AnnapurnaSIL-${version}.zip";
+
+    postFetch = ''
+      mkdir -p $out/share/{doc,fonts}
+      unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
+      unzip -j $downloadedFile \*OFL.txt \*OFL-FAQ.txt \*README.txt \*FONTLOG.txt -d "$out/share/doc/${name}"
+    '';
+
+    sha256 = "sha256-kVeP9ZX8H+Wn6jzmH1UQvUKY6vJjadMTdEusS7LodFM=";
+
+    meta = with lib; {
+      homepage = "https://software.sil.org/annapurna";
+      description = "Unicode-based font family with broad support for writing systems that use the Devanagari script";
+      longDescription = ''
+        Annapurna SIL is a Unicode-based font family with broad support for writing systems that use the Devanagari script. Inspired by traditional calligraphic forms, the design is intended to be highly readable, reasonably compact, and visually attractive.
+      '';
+      license = licenses.ofl;
+      platforms = platforms.all;
+      maintainers = [ maintainers.kmein ];
+    };
+  }
--- a/pkgs/data/fonts/ezra-sil/default.nix
+++ b/pkgs/data/fonts/ezra-sil/default.nix
@ -0,0 +1,26 @@
+{ lib, fetchzip }:
+
+let
+  version = "2.51";
+in
+  fetchzip rec {
+    name = "ezra-sil-${version}";
+
+    url = "https://software.sil.org/downloads/r/ezra/EzraSIL-${version}.zip";
+
+    postFetch = ''
+      mkdir -p $out/share/{doc,fonts}
+      unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
+      unzip -j $downloadedFile \*OFL-FAQ.txt \*README.txt \*FONTLOG.txt -d "$out/share/doc/${name}"
+    '';
+
+    sha256 = "sha256-1LGw/RPFeNtEvcBWFWZf8+dABvWye2RfZ/jt8rwQewM=";
+
+    meta = with lib; {
+      homepage = "https://software.sil.org/ezra";
+      description = "Typeface fashioned after the square letter forms of the typography of the Biblia Hebraica Stuttgartensia (BHS)";
+      license = licenses.ofl;
+      platforms = platforms.all;
+      maintainers = [ maintainers.kmein ];
+    };
+  }
--- a/Show More
+++ b/Show More