Merge master into haskell-updates

2022-04-03 00:11:52 +00:00 · 2022-04-03 00:11:52 +00:00 · 383143a3c0
commit 383143a3c0
parent 6a36abcd59 21299f3dd3
149 changed files with 3005 additions and 1376 deletions
--- a/.github/workflows/basic-eval.yml
+++ b/.github/workflows/basic-eval.yml
@ -1,14 +1,15 @@
 name: Basic evaluation checks

 on:
-  pull_request:
-    branches:
-     - master
-     - release-**
-  push:
-    branches:
-     - master
-     - release-**
+  workflow_dispatch
+  # pull_request:
+  #   branches:
+  #    - master
+  #    - release-**
+  # push:
+  #   branches:
+  #    - master
+  #    - release-**
 jobs:
  tests:
    runs-on: ubuntu-latest
--- a/maintainers/scripts/feature-freeze-teams.pl
+++ b/maintainers/scripts/feature-freeze-teams.pl
@ -0,0 +1,98 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i perl -p perl -p perlPackages.JSON perlPackages.LWPUserAgent perlPackages.LWPProtocolHttps perlPackages.TermReadKey
+
+# This script generates a list of teams to ping for the Feature Freeze announcement on Discourse.
+# It's intended to be used by Release Managers before creating such posts.
+#
+# The script interactively reads a GitHub username and a corresponding GitHub Personal Access token.
+# This is required to access the GitHub Teams API so the token needs at least the read:org privilege.
+
+## no critic (InputOutput::RequireCheckedSyscalls, InputOutput::ProhibitBacktickOperators)
+use strict;
+use warnings;
+use Carp;
+use Cwd 'abs_path';
+use File::Basename;
+use JSON qw(decode_json);
+use LWP::UserAgent;
+use Term::ReadKey qw(ReadLine ReadMode);
+
+sub github_team_members {
+    my ($team_name, $username, $token) = @_;
+    my @ret;
+
+    my $req = HTTP::Request->new('GET', "https://api.github.com/orgs/NixOS/teams/$team_name/members", [ 'Accept' => 'application/vnd.github.v3+json' ]);
+    $req->authorization_basic($username, $token);
+    my $response = LWP::UserAgent->new->request($req);
+
+    if ($response->is_success) {
+        my $content = decode_json($response->decoded_content);
+        foreach (@{$content}) {
+            push @ret, $_->{'login'};
+        }
+    } else {
+        print {*STDERR} "!! Requesting members of GitHub Team '$team_name' failed: $response->status_line";
+    }
+
+    return \@ret;
+}
+
+# Read GitHub credentials
+print {*STDERR} 'GitHub username: ';
+my $github_user = ReadLine(0);
+ReadMode('noecho');
+print {*STDERR} 'GitHub personal access token (no echo): ';
+my $github_token = ReadLine(0);
+ReadMode('restore');
+print {*STDERR} "\n";
+chomp $github_user;
+chomp $github_token;
+
+# Read nix output
+my $nix_version = `nix --version`;
+my $out;
+my $lib_path = abs_path(dirname(__FILE__)) . '../../../lib';
+if ($nix_version =~ m/2[.]3[.]/msx) {
+    $out = `nix eval --json '(import $lib_path).teams'` || croak 'nix eval failed';
+} else {
+    $out = `nix --extra-experimental-features nix-command eval --json --impure --expr '(import $lib_path).teams'` || croak('nix eval failed');
+}
+my $data = decode_json($out);
+
+# Process teams
+print {*STDERR} "\n";
+while (my ($team_nix_key, $team_config) = each %{$data}) {
+    # Ignore teams that don't want to be or can't be pinged
+    if (not defined $team_config->{enableFeatureFreezePing} or not $team_config->{enableFeatureFreezePing}) {
+        next;
+    }
+    if (not defined $team_config->{shortName}) {
+        print {*STDERR} "!! The team with the nix key '$team_nix_key' has no shortName set - ignoring";
+        next;
+    }
+    #  Team name
+    print {*STDERR} "$team_config->{shortName}:";
+    # GitHub Teams
+    my @github_members;
+    if (defined $team_config->{githubTeams}) {
+        foreach (@{$team_config->{githubTeams}}) {
+            print {*STDERR} " \@NixOS/${_}";
+            push @github_members, @{github_team_members($_, $github_user, $github_token)};
+        }
+    }
+    my %github_members = map { $_ => 1 } @github_members;
+    # Members
+    if (defined $team_config->{members}) {
+        foreach (@{$team_config->{members}}) {
+            my %user = %{$_};
+            my $github_handle = $user{'github'};
+            # Ensure we don't ping team members twice (as team member and directly)
+            if (defined $github_members{$github_handle}) {
+                next;
+            }
+            print {*STDERR} " \@$github_handle";
+        }
+    }
+
+    print {*STDERR} "\n";
+}
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -3,12 +3,19 @@
      # Required
      members = [ maintainer1 maintainer2 ];
      scope = "Maintain foo packages.";
+      shortName = "foo";
+      # Optional
+      enableFeatureFreezePing = true;
+      githubTeams = [ "my-subsystem" ];
    };

  where

  - `members` is the list of maintainers belonging to the group,
  - `scope` describes the scope of the group.
+  - `shortName` short human-readable name
+  - `enableFeatureFreezePing` will ping this team during the Feature Freeze announcements on releases
+  - `githubTeams` will ping specified GitHub teams as well

  More fields may be added in the future.

@ -27,6 +34,7 @@ with lib.maintainers; {
      m1cr0man
    ];
    scope = "Maintain ACME-related packages and modules.";
+    shortName = "ACME";
  };

  bazel = {
@ -41,6 +49,8 @@ with lib.maintainers; {
      ylecornec
    ];
    scope = "Bazel build tool & related tools https://bazel.build/";
+    shortName = "Bazel";
+    enableFeatureFreezePing = true;
  };

  beam = {
@ -53,7 +63,32 @@ with lib.maintainers; {
      minijackson
      yurrriq
    ];
+    githubTeams = [
+      "beam"
+    ];
    scope = "Maintain BEAM-related packages and modules.";
+    shortName = "BEAM";
+    enableFeatureFreezePing = true;
+  };
+
+  blockchains = {
+    members = [
+      mmahut
+      RaghavSood
+    ];
+    scope = "Maintain Blockchain packages and modules.";
+    shortName = "Blockchains";
+    enableFeatureFreezePing = true;
+  };
+
+  c = {
+    members = [
+      matthewbauer
+      mic92
+    ];
+    scope = "Maintain C libraries and tooling.";
+    shortName = "C";
+    enableFeatureFreezePing = true;
  };

  cinnamon = {
@ -61,6 +96,8 @@ with lib.maintainers; {
      mkg20001
    ];
    scope = "Maintain Cinnamon desktop environment and applications made by the LinuxMint team.";
+    shortName = "Cinnamon";
+    enableFeatureFreezePing = true;
  };

  chia = {
@ -68,6 +105,41 @@ with lib.maintainers; {
      lourkeur
    ];
    scope = "Maintain the Chia blockchain and its dependencies";
+    shortName = "Chia Blockchain";
+  };
+
+  cleanup = {
+    members = [
+      ajs124
+    ];
+    scope = "Cleaning of the nixpkgs source tree.";
+    shortName = "Cleanup";
+    enableFeatureFreezePing = true;
+  };
+
+  coq = {
+    members = [
+      cohencyril
+      Zimmi48
+      # gares has no entry in the maintainers list
+      siraben
+      vbgl
+    ];
+    scope = "Maintain the Coq theorem prover and related packages.";
+    shortName = "Coq";
+    enableFeatureFreezePing = true;
+  };
+
+  darwin = {
+    members = [
+      toonn
+    ];
+    githubTeams = [
+      "darwin-maintainers"
+    ];
+    scope = "Maintain Darwin compatibility of packages and Darwin-only packages.";
+    shortName = "Darwin";
+    enableFeatureFreezePing = true;
  };

  cosmopolitan = {
@ -84,6 +156,7 @@ with lib.maintainers; {
      limeytexan
    ];
    scope = "Group registration for D. E. Shaw employees who collectively maintain packages.";
+    shortName = "Shaw employees";
  };

  determinatesystems = {
@ -93,11 +166,63 @@ with lib.maintainers; {
      grahamc
    ];
    scope = "Group registration for packages maintained by Determinate Systems.";
+    shortName = "Determinate Systems employees";
+  };
+
+  dhall = {
+    members = [
+      Gabriel439
+      ehmry
+    ];
+    scope = "Maintain Dhall and related packages.";
+    shortName = "Dhall";
+    enableFeatureFreezePing = true;
+  };
+
+  docker = {
+    members = [
+      roberth
+      utdemir
+    ];
+    scope = "Maintain Docker and related tools.";
+    shortName = "DockerTools";
+    enableFeatureFreezePing = true;
+  };
+
+  docs = {
+    members = [
+      ryantm
+    ];
+    scope = "Maintain nixpkgs/NixOS documentation and tools for building it.";
+    shortName = "Docs";
+    enableFeatureFreezePing = true;
+  };
+
+  emacs = {
+    members = [
+      adisbladis
+    ];
+    scope = "Maintain the Emacs editor and packages.";
+    shortName = "Emacs";
+    enableFeatureFreezePing = true;
+  };
+
+  # Dummy group for the "everyone else" section
+  feature-freeze-everyone-else = {
+    members = [ ];
+    githubTeams = [
+      "nixpkgs-committers"
+      "release-engineers"
+    ];
+    scope = "Dummy team for the #everyone else' section during feture freezes, not to be used as package maintainers!";
+    shortName = "Everyone else";
+    enableFeatureFreezePing = true;
  };

  freedesktop = {
    members = [ jtojnar ];
    scope = "Maintain Freedesktop.org packages for graphical desktop.";
+    shortName = "freedesktop.org packaging";
  };

  gcc = {
@ -107,6 +232,7 @@ with lib.maintainers; {
      ericson2314
    ];
    scope = "Maintain GCC (GNU Compiler Collection) compilers";
+    shortName = "GCC";
  };

  golang = {
@ -121,6 +247,8 @@ with lib.maintainers; {
      zowoq
    ];
    scope = "Maintain Golang compilers.";
+    shortName = "Go";
+    enableFeatureFreezePing = true;
  };

  gnome = {
@ -131,7 +259,12 @@ with lib.maintainers; {
      dasj19
      maxeaubrey
    ];
+    githubTeams = [
+      "gnome"
+    ];
    scope = "Maintain GNOME desktop environment and platform.";
+    shortName = "GNOME";
+    enableFeatureFreezePing = true;
  };

  haskell = {
@ -141,7 +274,12 @@ with lib.maintainers; {
      maralorn
      sternenseemann
    ];
+    githubTeams = [
+      "haskell"
+    ];
    scope = "Maintain Haskell packages and infrastructure.";
+    shortName = "Haskell";
+    enableFeatureFreezePing = true;
  };

  home-assistant = {
@ -152,6 +290,7 @@ with lib.maintainers; {
      mic92
    ];
    scope = "Maintain the Home Assistant ecosystem";
+    shortName = "Home Assistant";
  };

  iog = {
@ -163,6 +302,7 @@ with lib.maintainers; {
      nrdxp
    ];
    scope = "Input-Output Global employees, which maintain critical software";
+    shortName = "Input-Output Global employees";
  };

  jitsi = {
@ -173,6 +313,7 @@ with lib.maintainers; {
      yuka
    ];
    scope = "Maintain Jitsi.";
+    shortName = "Jitsi";
  };

  kubernetes = {
@ -184,6 +325,7 @@ with lib.maintainers; {
      zowoq
    ];
    scope = "Maintain the Kubernetes package and module";
+    shortName = "Kubernetes";
  };

  kodi = {
@ -196,6 +338,7 @@ with lib.maintainers; {
      sephalon
    ];
    scope = "Maintain Kodi and related packages.";
+    shortName = "Kodi";
  };

  linux-kernel = {
@ -206,6 +349,17 @@ with lib.maintainers; {
      qyliss
    ];
    scope = "Maintain the Linux kernel.";
+    shortName = "Linux Kernel";
+  };
+
+  marketing = {
+    members = [
+      garbas
+      tomberek
+    ];
+    scope = "Marketing of Nix/NixOS/nixpkgs.";
+    shortName = "Marketing";
+    enableFeatureFreezePing = true;
  };

  mate = {
@ -214,6 +368,7 @@ with lib.maintainers; {
      romildo
    ];
    scope = "Maintain Mate desktop environment and related packages.";
+    shortName = "MATE";
  };

  matrix = {
@ -227,6 +382,40 @@ with lib.maintainers; {
      sumnerevans
    ];
    scope = "Maintain the ecosystem around Matrix, a decentralized messenger.";
+    shortName = "Matrix";
+  };
+
+  mobile = {
+    members = [
+      samueldr
+    ];
+    scope = "Maintain Mobile NixOS.";
+    shortName = "Mobile";
+    enableFeatureFreezePing = true;
+  };
+
+  nix = {
+    members = [
+      Profpatsch
+      eelco
+      grahamc
+      pierron
+    ];
+    scope = "Maintain the Nix package manager.";
+    shortName = "Nix/nix-cli ecosystem";
+    enableFeatureFreezePing = true;
+  };
+
+  nixos-modules = {
+    members = [
+      ericson2314
+      infinisil
+      qyliss
+      roberth
+    ];
+    scope = "Maintain nixpkgs module system internals.";
+    shortName = "NixOS Modules / internals";
+    enableFeatureFreezePing = true;
  };

  openstack = {
@ -235,6 +424,7 @@ with lib.maintainers; {
      SuperSandro2000
    ];
    scope = "Maintain the ecosystem around OpenStack";
+    shortName = "OpenStack";
  };

  pantheon = {
@ -242,7 +432,21 @@ with lib.maintainers; {
      davidak
      bobby285271
    ];
+    githubTeams = [
+      "pantheon"
+    ];
    scope = "Maintain Pantheon desktop environment and platform.";
+    shortName = "Pantheon";
+    enableFeatureFreezePing = true;
+  };
+
+  perl = {
+    members = [
+      sgo
+    ];
+    scope = "Maintain the Perl interpreter and Perl packages.";
+    shortName = "Perl";
+    enableFeatureFreezePing = true;
  };

  php = {
@ -254,7 +458,12 @@ with lib.maintainers; {
      ma27
      talyz
    ];
+    githubTeams = [
+      "php"
+    ];
    scope = "Maintain PHP related packages and extensions.";
+    shortName = "PHP";
+    enableFeatureFreezePing = true;
  };

  podman = {
@ -264,7 +473,54 @@ with lib.maintainers; {
      vdemeester
      zowoq
    ];
+    githubTeams = [
+      "podman"
+    ];
    scope = "Maintain Podman and CRI-O related packages and modules.";
+    shortName = "Podman";
+    enableFeatureFreezePing = true;
+  };
+
+  postgres = {
+    members = [
+      thoughtpolice
+    ];
+    scope = "Maintain the PostgreSQL package and plugins along with the NixOS module.";
+    shortName = "PostgreSQL";
+    enableFeatureFreezePing = true;
+  };
+
+  python = {
+    members = [
+      fridh
+      hexa
+      jonringer
+    ];
+    scope = "Maintain the Python interpreter and related packages.";
+    shortName = "Python";
+    enableFeatureFreezePing = true;
+  };
+
+  qt-kde = {
+    members = [
+      ttuegel
+    ];
+    githubTeams = [
+      "qt-kde"
+    ];
+    scope = "Maintain the KDE desktop environment and Qt.";
+    shortName = "Qt / KDE";
+    enableFeatureFreezePing = true;
+  };
+
+  r = {
+    members = [
+      bcdarwin
+      jbedo
+    ];
+    scope = "Maintain the R programming language and related packages.";
+    shortName = "R";
+    enableFeatureFreezePing = true;
  };

  redcodelabs = {
@ -274,6 +530,38 @@ with lib.maintainers; {
      wintrmvte
    ];
    scope = "Maintain Red Code Labs related packages and modules.";
+    shortName = "Red Code Labs";
+  };
+
+  release = {
+    members = [ ];
+    githubTeams = [
+      "nixos-release-managers"
+    ];
+    scope = "Manage the current nixpkgs/NixOS release.";
+    shortName = "Release";
+    enableFeatureFreezePing = true;
+  };
+
+  ruby = {
+    members = [
+      marsam
+    ];
+    scope = "Maintain the Ruby interpreter and related packages.";
+    shortName = "Ruby";
+    enableFeatureFreezePing = true;
+  };
+
+  rust = {
+    members = [
+      andir
+      lnl7
+      mic92
+      zowoq
+    ];
+    scope = "Maintain the Rust compiler toolchain and nixpkgs integration.";
+    shortName = "Rust";
+    enableFeatureFreezePing = true;
  };

  sage = {
@ -284,6 +572,7 @@ with lib.maintainers; {
      collares
    ];
    scope = "Maintain SageMath and the dependencies that are likely to break it.";
+    shortName = "SageMath";
  };

  sphinx = {
@ -291,6 +580,7 @@ with lib.maintainers; {
      SuperSandro2000
    ];
    scope = "Maintain Sphinx related packages.";
+    shortName = "Sphinx";
  };

  serokell = {
@ -300,6 +590,26 @@ with lib.maintainers; {
      mkaito
    ];
    scope = "Group registration for Serokell employees who collectively maintain packages.";
+    shortName = "Serokell employees";
+  };
+
+  systemd = {
+    members = [ ];
+    githubTeams = [
+      "systemd"
+    ];
+    scope = "Maintain systemd for NixOS.";
+    shortName = "systemd";
+    enableFeatureFreezePing = true;
+  };
+
+  tests = {
+    members = [
+      tfc
+    ];
+    scope = "Maintain the NixOS VM test runner.";
+    shortName = "NixOS tests";
+    enableFeatureFreezePing = true;
  };

  tts = {
@ -308,6 +618,18 @@ with lib.maintainers; {
      mic92
    ];
    scope = "coqui-ai TTS (formerly Mozilla TTS) and leaf packages";
+    shortName = "coqui-ai TTS";
+  };
+
+  vim = {
+    members = [
+      jonringer
+      softinio
+      teto
+    ];
+    scope = "Maintain the vim and neovim text editors and related packages.";
+    shortName = "Vim/Neovim";
+    enableFeatureFreezePing = true;
  };

  xfce = {
@ -315,5 +637,6 @@ with lib.maintainers; {
      romildo
    ];
    scope = "Maintain Xfce desktop environment and related packages.";
+    shortName = "Xfce";
  };
 }
--- a/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json
+++ b/nixos/modules/services/desktops/pipewire/daemon/pipewire-pulse.conf.json
@ -29,14 +29,7 @@
    },
    {
      "name": "libpipewire-module-protocol-pulse",
-      "args": {
-        "server.address": [
-          "unix:native"
-        ],
-        "vm.overrides": {
-          "pulse.min.quantum": "1024/48000"
-        }
-      }
+      "args": {}
    }
  ],
  "context.exec": [
@ -46,6 +39,14 @@
    }
  ],
  "stream.properties": {},
+  "pulse.properties": {
+    "server.address": [
+      "unix:native"
+    ],
+    "vm.overrides": {
+      "pulse.min.quantum": "1024/48000"
+    }
+  },
  "pulse.rules": [
    {
      "matches": [
--- a/nixos/modules/services/monitoring/prometheus/exporters/bird.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/bird.nix
@ -17,7 +17,7 @@ in
    };
    birdSocket = mkOption {
      type = types.path;
-      default = "/var/run/bird.ctl";
+      default = "/run/bird/bird.ctl";
      description = ''
        Path to BIRD2 (or BIRD1 v4) socket.
      '';
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@ -877,7 +877,7 @@ in
        copy_bin_and_libs ${pkgs.yubikey-personalization}/bin/ykinfo
        copy_bin_and_libs ${pkgs.openssl.bin}/bin/openssl

-        cc -O3 -I${pkgs.openssl.dev}/include -L${pkgs.openssl.out}/lib ${./pbkdf2-sha512.c} -o pbkdf2-sha512 -lcrypto
+        cc -O3 -I${pkgs.openssl.dev}/include -L${lib.getLib pkgs.openssl}/lib ${./pbkdf2-sha512.c} -o pbkdf2-sha512 -lcrypto
        strip -s pbkdf2-sha512
        copy_bin_and_libs pbkdf2-sha512

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -281,6 +281,7 @@ in
  #logstash = handleTest ./logstash.nix {};
  lorri = handleTest ./lorri/default.nix {};
  maddy = handleTest ./maddy.nix {};
+  maestral = handleTest ./maestral.nix {};
  magic-wormhole-mailbox-server = handleTest ./magic-wormhole-mailbox-server.nix {};
  magnetico = handleTest ./magnetico.nix {};
  mailcatcher = handleTest ./mailcatcher.nix {};
@ -315,6 +316,7 @@ in
  moosefs = handleTest ./moosefs.nix {};
  mpd = handleTest ./mpd.nix {};
  mpv = handleTest ./mpv.nix {};
+  mtp = handleTest ./mtp.nix {};
  mumble = handleTest ./mumble.nix {};
  musescore = handleTest ./musescore.nix {};
  munin = handleTest ./munin.nix {};
--- a/nixos/tests/maestral.nix
+++ b/nixos/tests/maestral.nix
@ -0,0 +1,72 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "maestral";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ peterhoeg ];
+  };
+
+  nodes =
+    let
+      common = attrs:
+        pkgs.lib.recursiveUpdate
+          {
+            imports = [ ./common/user-account.nix ];
+            systemd.user.services.maestral = {
+              description = "Maestral Dropbox Client";
+              serviceConfig.Type = "exec";
+            };
+          }
+          attrs;
+
+    in
+    {
+      cli = { ... }: common {
+        systemd.user.services.maestral = {
+          wantedBy = [ "default.target" ];
+          serviceConfig.ExecStart = "${pkgs.maestral}/bin/maestral start --foreground";
+        };
+      };
+
+      gui = { ... }: common {
+        services.xserver = {
+          enable = true;
+          displayManager.sddm.enable = true;
+          displayManager.defaultSession = "plasma";
+          desktopManager.plasma5.enable = true;
+          desktopManager.plasma5.runUsingSystemd = true;
+          displayManager.autoLogin = {
+            enable = true;
+            user = "alice";
+          };
+        };
+
+        systemd.user.services = {
+          maestral = {
+            wantedBy = [ "graphical-session.target" ];
+            serviceConfig.ExecStart = "${pkgs.maestral-gui}/bin/maestral_qt";
+          };
+          # PowerDevil doesn't like our VM
+          plasma-powerdevil.enable = false;
+        };
+      };
+    };
+
+  testScript = { nodes, ... }:
+    let
+      user = nodes.cli.config.users.users.alice;
+    in
+    ''
+      start_all()
+
+      with subtest("CLI"):
+        # we need SOME way to give the user an active login session
+        cli.execute("loginctl enable-linger ${user.name}")
+        cli.systemctl("start user@${toString user.uid}")
+        cli.wait_for_unit("maestral.service", "${user.name}")
+
+      with subtest("GUI"):
+        gui.wait_for_x()
+        gui.succeed("xauth merge ${user.home}/.Xauthority")
+        gui.wait_for_window("^Desktop ")
+        gui.wait_for_unit("maestral.service", "${user.name}")
+    '';
+})
--- a/nixos/tests/mtp.nix
+++ b/nixos/tests/mtp.nix
@ -0,0 +1,109 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "mtp";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ matthewcroughan nixinator ];
+  };
+
+  nodes =
+  {
+    client = { config, pkgs, ... }: {
+      # DBUS runs only once a user session is created, which means a user has to
+      # login. Here, we log in as root. Once logged in, the gvfs-daemon service runs
+      # as UID 0 in User-0.service
+      services.getty.autologinUser = "root";
+
+      # XDG_RUNTIME_DIR is needed for running systemd-user services such as
+      # gvfs-daemon as root.
+      environment.variables.XDG_RUNTIME_DIR = "/run/user/0";
+
+      environment.systemPackages = with pkgs; [ usbutils glib jmtpfs tree ];
+      services.gvfs.enable = true;
+
+      # Creates a usb-mtp device inside the VM, which is mapped to the host's
+      # /tmp folder, it is able to write files to this location, but only has
+      # permissions to read its own creations.
+      virtualisation.qemu.options = [
+        "-usb"
+        "-device usb-mtp,rootdir=/tmp,readonly=false"
+      ];
+    };
+  };
+
+
+  testScript = { nodes, ... }:
+    let
+      # Creates a list of QEMU MTP devices matching USB ID (46f4:0004). This
+      # value can be sourced in a shell script. This is so we can loop over the
+      # devices we find, as this test may want to use more than one MTP device
+      # in future.
+      mtpDevices = pkgs.writeScript "mtpDevices.sh" ''
+        export mtpDevices=$(lsusb -d 46f4:0004 | awk {'print $2","$4'} | sed 's/[:-]/ /g')
+      '';
+      # Qemu is only capable of creating an MTP device with Picture Transfer
+      # Protocol. This means that gvfs must use gphoto2:// rather than mtp://
+      # when mounting.
+      # https://github.com/qemu/qemu/blob/970bc16f60937bcfd334f14c614bd4407c247961/hw/usb/dev-mtp.c#L278
+      gvfs = rec {
+        mountAllMtpDevices = pkgs.writeScript "mountAllMtpDevices.sh" ''
+          set -e
+          source ${mtpDevices}
+          for i in $mtpDevices
+          do
+            gio mount "gphoto2://[usb:$i]/"
+          done
+        '';
+        unmountAllMtpDevices = pkgs.writeScript "unmountAllMtpDevices.sh" ''
+          set -e
+          source ${mtpDevices}
+          for i in $mtpDevices
+          do
+            gio mount -u "gphoto2://[usb:$i]/"
+          done
+        '';
+        # gvfsTest:
+        # 1. Creates a 10M test file
+        # 2. Copies it to the device using GIO tools
+        # 3. Checks for corruption with `diff`
+        # 4. Removes the file, then unmounts the disks.
+        gvfsTest = pkgs.writeScript "gvfsTest.sh" ''
+          set -e
+          source ${mtpDevices}
+          ${mountAllMtpDevices}
+          dd if=/dev/urandom of=testFile10M bs=1M count=10
+          for i in $mtpDevices
+          do
+            gio copy ./testFile10M gphoto2://[usb:$i]/
+            ls -lah /run/user/0/gvfs/*/testFile10M
+            gio remove gphoto2://[usb:$i]/testFile10M
+          done
+          ${unmountAllMtpDevices}
+        '';
+      };
+      jmtpfs = {
+        # jmtpfsTest:
+        # 1. Mounts the device on a dir named `phone` using jmtpfs
+        # 2. Puts the current Nixpkgs libmtp version into a file
+        # 3. Checks for corruption with `diff`
+        # 4. Prints the directory tree
+        jmtpfsTest = pkgs.writeScript "jmtpfsTest.sh" ''
+          set -e
+          mkdir phone
+          jmtpfs phone
+          echo "${pkgs.libmtp.version}" > phone/tmp/testFile
+          echo "${pkgs.libmtp.version}" > testFile
+          diff phone/tmp/testFile testFile
+          tree phone
+        '';
+      };
+    in
+    # Using >&2 allows the results of the scripts to be printed to the terminal
+    # when building this test with Nix. Scripts would otherwise complete
+    # silently.
+    ''
+    start_all()
+    client.wait_for_unit("multi-user.target")
+    client.wait_for_unit("dbus.service")
+    client.succeed("${gvfs.gvfsTest} >&2")
+    client.succeed("${jmtpfs.jmtpfsTest} >&2")
+  '';
+})
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio4.nix
@ -6,11 +6,11 @@

 stdenv.mkDerivation rec {
  pname = "bitwig-studio";
-  version = "4.2";
+  version = "4.2.1";

  src = fetchurl {
    url = "https://downloads.bitwig.com/stable/${version}/${pname}-${version}.deb";
-    sha256 = "sha256-hIIEVj5sM/NdhBiwerFvyIXqj0R8EvcxwM6UZ0CE428=";
+    sha256 = "sha256-kkpb8tLuj4QO+TBW2yNDugS4c6dCQ9Lddv6Z8NS0uio=";
  };

  nativeBuildInputs = [ dpkg makeWrapper wrapGAppsHook ];
--- a/pkgs/applications/audio/spotify/default.nix
+++ b/pkgs/applications/audio/spotify/default.nix
@ -126,8 +126,8 @@ stdenv.mkDerivation {
      # Work around Spotify referring to a specific minor version of
      # OpenSSL.

-      ln -s ${openssl.out}/lib/libssl.so $libdir/libssl.so.1.0.0
-      ln -s ${openssl.out}/lib/libcrypto.so $libdir/libcrypto.so.1.0.0
+      ln -s ${lib.getLib openssl}/lib/libssl.so $libdir/libssl.so.1.0.0
+      ln -s ${lib.getLib openssl}/lib/libcrypto.so $libdir/libcrypto.so.1.0.0
      ln -s ${nspr.out}/lib/libnspr4.so $libdir/libnspr4.so
      ln -s ${nspr.out}/lib/libplc4.so $libdir/libplc4.so

--- a/pkgs/applications/blockchains/snarkos/default.nix
+++ b/pkgs/applications/blockchains/snarkos/default.nix
@ -27,7 +27,7 @@ rustPlatform.buildRustPackage rec {

  # Needed to get openssl-sys to use pkg-config.
  OPENSSL_NO_VENDOR = 1;
-  OPENSSL_LIB_DIR = "${openssl.out}/lib";
+  OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
  OPENSSL_DIR="${lib.getDev openssl}";

  LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib";
--- a/pkgs/applications/blockchains/solana/default.nix
+++ b/pkgs/applications/blockchains/solana/default.nix
@ -37,7 +37,7 @@ rustPlatform.buildRustPackage rec {
  # checkInputs = lib.optionals stdenv.isDarwin [ pkg-config rustfmt ];
  # Needed to get openssl-sys to use pkg-config.
  # OPENSSL_NO_VENDOR = 1;
-  # OPENSSL_LIB_DIR = "${openssl.out}/lib";
+  # OPENSSL_LIB_DIR = "${lib.getLib openssl}/lib";
  # OPENSSL_DIR="${lib.getDev openssl}";
  # LLVM_CONFIG_PATH="${llvm}/bin/llvm-config";
  # LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib";
--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@ -547,6 +547,13 @@ let
              '';
          });
        });
+
+        mozc = super.mozc.overrideAttrs (attrs: {
+          postPatch = attrs.postPatch or "" + ''
+            substituteInPlace src/unix/emacs/mozc.el \
+              --replace '"mozc_emacs_helper"' '"${pkgs.ibus-engines.mozc}/lib/mozc/mozc_emacs_helper"'
+          '';
+        });
      };

    in lib.mapAttrs (n: v: if lib.hasAttr n overrides then overrides.${n} else v) super);
--- a/pkgs/applications/editors/kodestudio/default.nix
+++ b/pkgs/applications/editors/kodestudio/default.nix
@ -57,7 +57,7 @@ in
          $out/kodestudio
      patchelf \
          --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-          --set-rpath ".:${stdenv.cc.libc}/lib:${xorg.libXinerama}/lib:${xorg.libX11}/lib:${alsa-lib}/lib:${libGL}/lib:${libGLU}/lib:${openssl.out}/lib" \
+          --set-rpath ".:${stdenv.cc.libc}/lib:${xorg.libXinerama}/lib:${xorg.libX11}/lib:${alsa-lib}/lib:${libGL}/lib:${libGLU}/lib:${lib.getLib openssl}/lib" \
          $out/resources/app/extensions/krom/Krom/linux/Krom
      patchelf \
          --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
--- a/pkgs/applications/editors/sublime/3/common.nix
+++ b/pkgs/applications/editors/sublime/3/common.nix
@ -101,7 +101,7 @@ in let
        "''${gappsWrapperArgs[@]}"

      # Without this, plugin_host crashes, even though it has the rpath
-      wrapProgram $out/plugin_host --prefix LD_PRELOAD : ${stdenv.cc.cc.lib}/lib${lib.optionalString stdenv.is64bit "64"}/libgcc_s.so.1:${openssl.out}/lib/libssl.so:${bzip2.out}/lib/libbz2.so
+      wrapProgram $out/plugin_host --prefix LD_PRELOAD : ${stdenv.cc.cc.lib}/lib${lib.optionalString stdenv.is64bit "64"}/libgcc_s.so.1:${lib.getLib openssl}/lib/libssl.so:${bzip2.out}/lib/libbz2.so
    '';
  };
 in stdenv.mkDerivation (rec {
--- a/pkgs/applications/editors/vscode/extensions/ms-dotnettools-csharp/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-dotnettools-csharp/default.nix
@ -107,7 +107,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
      patchelf_add_icu_as_needed "$elf"
      patchelf --add-needed "libssl.so" "$elf"
      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath "${lib.makeLibraryPath [ stdenv.cc.cc openssl.out icu.out ]}:\$ORIGIN" \
+        --set-rpath "${lib.makeLibraryPath [ stdenv.cc.cc openssl icu.out ]}:\$ORIGIN" \
        "$elf"
    }

--- a/pkgs/applications/finance/cryptowatch/default.nix
+++ b/pkgs/applications/finance/cryptowatch/default.nix
@ -0,0 +1,57 @@
+{ stdenv
+, lib
+, fetchurl
+, autoPatchelfHook
+, wrapGAppsHook
+, dbus
+, libGL
+, libX11
+, libXcursor
+, libXi
+, libXrandr
+, udev
+, unzip
+}:
+
+stdenv.mkDerivation rec {
+  pname = "cryptowatch-desktop";
+  version = "0.5.0";
+
+  src = fetchurl {
+    url = "https://cryptowat.ch/desktop/download/linux/${version}";
+    sha256 = "0lr5fsd0f44b1v9f2dvx0a0lmz9dyivyz5d98qx2gcv3jkngw34v";
+  };
+
+  unpackPhase = "unzip $src";
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    wrapGAppsHook
+    unzip
+  ];
+
+  buildInputs = [
+    dbus
+    udev
+  ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    install -m755 -D cryptowatch_desktop $out/bin/cryptowatch_desktop
+  '';
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libGL libX11 libXcursor libXrandr libXi ]}"
+    )
+  '';
+
+  meta = with lib; {
+    homepage = "https://cryptowat.ch";
+    description = "Application for visualising real-time cryptocurrency market data";
+    platforms = platforms.linux;
+    license = licenses.unfree;
+    maintainers = with maintainers; [ livnev ];
+  };
+}
--- a/pkgs/applications/graphics/ImageMagick/6.x.nix
+++ b/pkgs/applications/graphics/ImageMagick/6.x.nix
@ -83,7 +83,7 @@ stdenv.mkDerivation rec {
    changelog = "https://legacy.imagemagick.org/script/changelog.php";
    description = "A software suite to create, edit, compose, or convert bitmap images";
    platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ erictapen ];
+    maintainers = with maintainers; [ ];
    license = licenses.asl20;
  };
 }
--- a/pkgs/applications/graphics/drawing/default.nix
+++ b/pkgs/applications/graphics/drawing/default.nix
@ -18,7 +18,7 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "drawing";
-  version = "0.8.5";
+  version = "1.0.0";

  format = "other";

@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "maoschanz";
    repo = pname;
    rev = version;
-    sha256 = "1q4a1gwmzz0rm10cnd4nzd51zfc2bjc6dsvf90qk1di9x7svis64";
+    sha256 = "sha256-qNaljtuA5E/QaLJ9QILPRQCqOvKmX4ZGq/0z5unA8KA=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/gofu/default.nix
+++ b/pkgs/applications/misc/gofu/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "gofu";
-  version = "unstable-2021-09-11";
+  version = "unstable-2022-04-01";

  src = fetchFromGitHub {
    owner = "majewsky";
    repo = pname;
-    rev = "cb398f58a5cb4f3e858fe60e84debde6ab58f7c8";
-    sha256 = "sha256-R8Pr8SyLeoTaYKKV+PzHDPi1/RY4j7pkUbW8kE4ydBU=";
+    rev = "be0e424eecec3fec19ba3518f8fd1bb07b6908dc";
+    sha256 = "sha256-jMOmvCsuRtL9EgPicdNEksVgFepL/JZA53o2wzr8uzQ=";
  };

  vendorSha256 = null;
--- a/pkgs/applications/misc/gpxsee/default.nix
+++ b/pkgs/applications/misc/gpxsee/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "gpxsee";
-  version = "10.4";
+  version = "10.5";

  src = fetchFromGitHub {
    owner = "tumic0";
    repo = "GPXSee";
    rev = version;
-    sha256 = "sha256-3AwUfx8IIWJO4uVAhXJE5Oola+60VUpXUwmALqJo2vw=";
+    sha256 = "sha256-TvOdyzWvGSdl8aSA+pAOpPVpQzK9POmqtClqdXAMsws=";
  };

  patches = (substituteAll {
--- a/pkgs/applications/misc/taskwarrior-tui/default.nix
+++ b/pkgs/applications/misc/taskwarrior-tui/default.nix
@ -5,19 +5,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "taskwarrior-tui";
-  version = "0.21.1";
+  version = "0.22.0";

  src = fetchFromGitHub {
    owner = "kdheepak";
    repo = "taskwarrior-tui";
    rev = "v${version}";
-    sha256 = "sha256-fgoK7Y+3h2VFfP8yiR8JM8Xf7UJbkX9PO1RoJRoYLW4=";
+    sha256 = "sha256-121TfmaWrWppsOiuF+8gxy+3J5YzbliYj88nw4aLt9w=";
  };

  # Because there's a test that requires terminal access
  doCheck = false;

-  cargoSha256 = "sha256-3rDvla1mCcQclALbomUTvE3aLzsMeIjcIbEv4KfCKZE=";
+  cargoSha256 = "sha256-oTb1pSA9g9cExCXKaQjNm+h5WB4bWuqODkU7MvvspGQ=";

  meta = with lib; {
    description = "A terminal user interface for taskwarrior ";
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@ -87,7 +87,7 @@ mkChromiumDerivation (base: rec {
      then "https://github.com/Eloston/ungoogled-chromium"
      else "https://www.chromium.org/";
    maintainers = with maintainers; if ungoogled
-      then [ squalus primeos ]
+      then [ squalus primeos michaeladler ]
      else [ primeos thefloweringash ];
    license = if enableWideVine then licenses.unfree else licenses.bsd3;
    platforms = platforms.linux;
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@ -31,6 +31,8 @@
 , zip
 , zlib
 , withGTK3 ? true, gtk3, gtk2
+, testVersion
+, palemoon
 }:

 # Only specific GCC versions are supported with branding
@ -44,12 +46,12 @@ assert with lib.strings; (

 stdenv.mkDerivation rec {
  pname = "palemoon";
-  version = "29.4.5";
+  version = "29.4.5.1";

  src = fetchzip {
    name = "${pname}-${version}";
    url = "http://archive.palemoon.org/source/${pname}-${version}.source.tar.xz";
-    sha256 = "sha256-ls4uhfFaiFHkmAVbwwBenm71sNm6Tql2tMpzk9D2b5Y=";
+    sha256 = "sha256-IC7E88dECAz2diVLEEdjMltpNMBhPTlPvbz05BniBMI=";
  };

  nativeBuildInputs = [
@ -194,18 +196,23 @@ stdenv.mkDerivation rec {
    platforms = [ "i686-linux" "x86_64-linux" ];
  };

-  passthru.updateScript = writeScript "update-${pname}" ''
-    #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p common-updater-scripts curl libxml2
+  passthru = {
+    updateScript = writeScript "update-${pname}" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p common-updater-scripts curl libxml2

-    set -eu -o pipefail
+      set -eu -o pipefail

-    # Only release note announcement == finalized release
-    version="$(
-      curl -s 'http://www.palemoon.org/releasenotes.shtml' |
-      xmllint --html --xpath 'html/body/table/tbody/tr/td/h3/text()' - 2>/dev/null | head -n1 |
-      sed 's/v\(\S*\).*/\1/'
-    )"
-    update-source-version ${pname} "$version"
-  '';
+      # Only release note announcement == finalized release
+      version="$(
+        curl -s 'http://www.palemoon.org/releasenotes.shtml' |
+        xmllint --html --xpath 'html/body/table/tbody/tr/td/h3/text()' - 2>/dev/null | head -n1 |
+        sed 's/v\(\S*\).*/\1/'
+      )"
+      update-source-version ${pname} "$version"
+    '';
+    tests.version = testVersion {
+      package = palemoon;
+    };
+  };
 }
--- a/pkgs/applications/networking/browsers/qutebrowser/default.nix
+++ b/pkgs/applications/networking/browsers/qutebrowser/default.nix
@ -31,12 +31,12 @@ let

 in mkDerivationWith python3Packages.buildPythonApplication rec {
  pname = "qutebrowser";
-  version = "2.4.0";
+  version = "2.5.0";

  # the release tarballs are different from the git checkout!
  src = fetchurl {
    url = "https://github.com/qutebrowser/qutebrowser/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "8s2auxTrq/ljBXOy+4RHvhkod3h9xOOWThtV9yqFkuw=";
+    sha256 = "1zai8ivc9cqax2idspwvyp24dkis0x6sv29fia8ja3sp62i45171";
  };

  # Needs tox
--- a/pkgs/applications/networking/cluster/argo/default.nix
+++ b/pkgs/applications/networking/cluster/argo/default.nix
@ -19,13 +19,13 @@ let
 in
 buildGoModule rec {
  pname = "argo";
-  version = "3.3.0";
+  version = "3.3.1";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo";
    rev = "v${version}";
-    sha256 = "sha256-BDHbbb3WqQvRJB1A4NInfvujjB3r/AMmVvos8i/CnyU=";
+    sha256 = "sha256-IcKueb/bxPNwJ9bZWwmz4ywCtZGk0PSuH3KYDMp6Qd4=";
  };

  vendorSha256 = "sha256-YeSeaYOkNRjQgxsK9G7iPbVpfrPs4HRRFwfoUDxoCm0=";
--- a/pkgs/applications/networking/cluster/driftctl/default.nix
+++ b/pkgs/applications/networking/cluster/driftctl/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "driftctl";
-  version = "0.25.0";
+  version = "0.26.0";

  src = fetchFromGitHub {
    owner = "snyk";
    repo = "driftctl";
    rev = "v${version}";
-    sha256 = "sha256-opR1NkMGptZilSPVZ7yNjYBBjnOXxrqAFCYzQ1tNS78=";
+    sha256 = "sha256-cwI27hAfnSKT7P2rfM86tRtSKRR9bruRV9w440uGLIU=";
  };

  vendorSha256 = "sha256-I0OCRhUvuaF4k5qqPaV6R24mrd9AG5GgQCCF6yodK0E=";
--- a/pkgs/applications/networking/cluster/fluxctl/default.nix
+++ b/pkgs/applications/networking/cluster/fluxctl/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "fluxctl";
-  version = "1.24.3";
+  version = "1.25.0";

  src = fetchFromGitHub {
    owner = "weaveworks";
    repo = "flux";
    rev = version;
-    sha256 = "sha256-i86WwSR14hxaXWMesvG2mG8nqXd97M3TekK2FLTLL+Y=";
+    sha256 = "sha256-EFB8iAs7e4FigYnTvkh+dpZq6ymX7Qfy0cUDtUaPdmM=";
  };

-  vendorSha256 = "sha256-Fw3/SMO66eExlDNcIaHM+G2kB4zb1Cih7kp8xfel/iY=";
+  vendorSha256 = "sha256-9RyTeGjp7mEpmWnQeK2uG1krO6+1sK6fsID6JVrejHw=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/networking/cluster/helmfile/default.nix
+++ b/pkgs/applications/networking/cluster/helmfile/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "helmfile";
-  version = "0.143.3";
+  version = "0.143.5";

  src = fetchFromGitHub {
    owner = "roboll";
    repo = "helmfile";
    rev = "v${version}";
-    sha256 = "sha256-A0xpXsMWUaJYTzo9O4KkdyjonSGZ+FylTK140pqnJX8=";
+    sha256 = "sha256-48DbN3O5HVlNpHct6uKw9CjeaDlAZqY+/Tqd4a9mmUw=";
  };

-  vendorSha256 = "sha256-qolmWat7An4HFm4O5vSCYZe+w79nsRIrnBLJacUCeA4=";
+  vendorSha256 = "sha256-ddf3m0DGsjubzp/aERvhfJ51UKKSNMC1Xu7ybyif8HA=";

  doCheck = false;

--- a/pkgs/applications/networking/cluster/spark/default.nix
+++ b/pkgs/applications/networking/cluster/spark/default.nix
@ -14,7 +14,7 @@
 with lib;

 let
-  spark = { pname, version, sha256 }:
+  spark = { pname, version, sha256, extraMeta ? {} }:
    stdenv.mkDerivation rec {
      inherit pname version;
      src = fetchzip {
@ -63,7 +63,7 @@ let
        license = lib.licenses.asl20;
        platforms = lib.platforms.all;
        maintainers = with maintainers; [ thoughtpolice offline kamilchm illustris ];
-      };
+      } // extraMeta;
    };
 in
 {
@ -74,12 +74,13 @@ in
  };
  spark_3_1 = spark rec {
    pname = "spark";
-    version = "3.1.2";
-    sha256 = "1bgh2y6jm7wqy6yc40rx68xkki31i3jiri2yixb1bm0i9pvsj9yf";
+    version = "3.1.3";
+    sha256 = "sha256-RIQyN5YjxFLfNIrETR3Vv99zsHxt77rhOXHIThCI2Y8=";
  };
  spark_2_4 = spark rec {
    pname = "spark";
    version = "2.4.8";
    sha256 = "1mkyq0gz9fiav25vr0dba5ivp0wh0mh7kswwnx8pvsmb6wbwyfxv";
+    extraMeta.knownVulnerabilities = [ "CVE-2021-38296" ];
  };
 }
--- a/pkgs/applications/networking/cluster/vcluster/default.nix
+++ b/pkgs/applications/networking/cluster/vcluster/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "vcluster";
-  version = "0.6.0";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "loft-sh";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-kY12bsZyDb36KE2dWx6RVYlKTbJh+XFQcBpFXoCLgEM=";
+    sha256 = "sha256-Yf2ZLhB6yfXySvPajI9mvdcYQPPpKI+LZ6+PMvOS4qo=";
  };

  vendorSha256 = null;
--- a/pkgs/applications/networking/instant-messengers/chatty/default.nix
+++ b/pkgs/applications/networking/instant-messengers/chatty/default.nix
@ -3,6 +3,7 @@
 , fetchFromGitLab
 , appstream-glib
 , desktop-file-utils
+, itstool
 , meson
 , ninja
 , pkg-config
@ -46,6 +47,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [
    appstream-glib
    desktop-file-utils
+    itstool
    meson
    ninja
    pkg-config
--- a/pkgs/applications/networking/instant-messengers/zulip/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zulip/default.nix
@ -5,12 +5,12 @@

 let
  pname = "zulip";
-  version = "5.8.1";
+  version = "5.9.0";
  name = "${pname}-${version}";

  src = fetchurl {
    url = "https://github.com/zulip/zulip-desktop/releases/download/v${version}/Zulip-${version}-x86_64.AppImage";
-    sha256 = "02m18y5j6jmmlygv8ycwaaq6n7mvj97ljhd3l9pvii0adwcvrpfz";
+    hash = "sha256-qiGkZuGJsKuquMuAcO+9wbU4KW++uyOb4TKb9lCgZmI=";
    name="${pname}-${version}.AppImage";
  };

--- a/pkgs/applications/networking/ipfs/default.nix
+++ b/pkgs/applications/networking/ipfs/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "ipfs";
-  version = "0.12.0"; # When updating, also check if the repo version changed and adjust repoVersion below
+  version = "0.12.1"; # When updating, also check if the repo version changed and adjust repoVersion below
  rev = "v${version}";

  repoVersion = "12"; # Also update ipfs-migrator when changing the repo version
@ -10,7 +10,7 @@ buildGoModule rec {
  # go-ipfs makes changes to it's source tarball that don't match the git source.
  src = fetchurl {
    url = "https://github.com/ipfs/go-ipfs/releases/download/${rev}/go-ipfs-source.tar.gz";
-    sha256 = "jWoMm/xIp3Zn/FiHWQ5/q39i6Lh4Fdoi9OdnRVc51Xk=";
+    sha256 = "sha256-fUExCvE6x5VFBl66y52DGvr8ZNSXZ6MYpVQP/D7X328=";
  };

  # tarball contains multiple files/directories
--- a/pkgs/applications/networking/irc/wraith/configure.patch
+++ b/pkgs/applications/networking/irc/wraith/configure.patch
@ -52,7 +52,7 @@
 -fi
 -unset cf_openssl_basedir
 +SSL_INCLUDES="-I@openssl.dev@/include"
-+SSL_LIBS="-L@openssl.out@/lib"
+SSL_LIBS="-L@openssl-lib@/lib"
 
 save_CXX="$CXX"
 CXX="$CXX $SSL_INCLUDES"
--- a/pkgs/applications/networking/irc/wraith/default.nix
+++ b/pkgs/applications/networking/irc/wraith/default.nix
@ -12,9 +12,9 @@ stdenv.mkDerivation rec {
  patches = [ ./configure.patch ./dlopen.patch ];
  postPatch = ''
    substituteInPlace configure        --subst-var-by openssl.dev ${openssl.dev} \
-                                       --subst-var-by openssl.out ${openssl.out}
-    substituteInPlace src/libssl.cc    --subst-var-by openssl ${openssl.out}
-    substituteInPlace src/libcrypto.cc --subst-var-by openssl ${openssl.out}
+                                       --subst-var-by openssl-lib ${lib.getLib openssl}
+    substituteInPlace src/libssl.cc    --subst-var-by openssl ${lib.getLib openssl}
+    substituteInPlace src/libcrypto.cc --subst-var-by openssl ${lib.getLib openssl}
  '';
  installPhase = ''
    mkdir -p $out/bin
--- a/pkgs/applications/networking/maestral-qt/default.nix
+++ b/pkgs/applications/networking/maestral-qt/default.nix
@ -2,6 +2,7 @@
 , fetchFromGitHub
 , python3
 , wrapQtAppsHook
+, nixosTests
 }:

 python3.pkgs.buildPythonApplication rec {
@ -44,6 +45,8 @@ python3.pkgs.buildPythonApplication rec {

  pythonImportsCheck = [ "maestral_qt" ];

+  passthru.tests.maestral = nixosTests.maestral;
+
  meta = with lib; {
    description = "GUI front-end for maestral (an open-source Dropbox client) for Linux";
    license = licenses.mit;
--- a/pkgs/applications/networking/mailreaders/mailspring/default.nix
+++ b/pkgs/applications/networking/mailreaders/mailspring/default.nix
@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
      --replace dirname ${coreutils}/bin/dirname

    ln -s $out/share/mailspring/mailspring $out/bin/mailspring
-    ln -s ${openssl.out}/lib/libcrypto.so $out/lib/libcrypto.so.1.0.0
+    ln -s ${lib.getLib openssl}/lib/libcrypto.so $out/lib/libcrypto.so.1.0.0

    runHook postInstall
  '';
--- a/pkgs/applications/networking/remote/citrix-workspace/generic.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/generic.nix
@ -14,7 +14,7 @@ let
  openssl' = symlinkJoin {
    name = "openssl-backwards-compat";
    nativeBuildInputs = [ makeWrapper ];
-    paths = [ openssl.out ];
+    paths = [ (lib.getLib openssl) ];
    postBuild = ''
      ln -sf $out/lib/libcrypto.so $out/lib/libcrypto.so.1.0.0
      ln -sf $out/lib/libssl.so $out/lib/libssl.so.1.0.0
--- a/pkgs/applications/terminal-emulators/kitty/default.nix
+++ b/pkgs/applications/terminal-emulators/kitty/default.nix
@ -90,6 +90,11 @@ buildPythonApplication rec {
      url = "https://github.com/kovidgoyal/kitty/commit/d8ed42ae8e014d9abf9550a65ae203468f8bfa43.patch";
      sha256 = "sha256-Azgzqf5atW999FVn9rSGKMyZLsI692dYXhJPx07GBO0=";
    })
+    (fetchpatch {
+      name = "fix-build-with-non-framework-python-on-darwin.patch";
+      url = "https://github.com/kovidgoyal/kitty/commit/57cffc71b78244e6a9d49f4c9af24d1a88dbf537.patch";
+      sha256 = "sha256-1IGONSVCVo5SmLKw90eqxaI5Mwc764O1ur+aMsc7h94=";
+    })
  ];

  # Causes build failure due to warning
--- a/pkgs/applications/version-management/subversion/default.nix
+++ b/pkgs/applications/version-management/subversion/default.nix
@ -92,7 +92,7 @@ let
          --replace "${expat.dev}/lib" "${expat.out}/lib" \
          --replace "${zlib.dev}/lib" "${zlib.out}/lib" \
          --replace "${sqlite.dev}/lib" "${sqlite.out}/lib" \
-          --replace "${openssl.dev}/lib" "${openssl.out}/lib"
+          --replace "${openssl.dev}/lib" "${lib.getLib openssl}/lib"
      done
    '';

--- a/pkgs/applications/version-management/verco/default.nix
+++ b/pkgs/applications/version-management/verco/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "verco";
-  version = "6.7.0";
+  version = "6.8.0";

  src = fetchFromGitHub {
    owner = "vamolessa";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-H8rDaRVU3G3iuBv0Tz/YOuYbL2k8wEoEIIEG7hjU6eM=";
+    sha256 = "sha256-E1kqJLnTLPu38zvDGaPHiKSW/yKormbx5N1CBSzQxgc=";
  };

-  cargoSha256 = "sha256-4Ou/stedL3WCY4Awsl++lc5fZ9gxd4uorf4G2/0DiPc=";
+  cargoSha256 = "sha256-9342LAChCv61kxTJoeOy7EdafMfR10s8dtkc2pTgXT0=";

  meta = with lib; {
    description = "A simple Git/Mercurial/PlasticSCM tui client based on keyboard shortcuts";
--- a/pkgs/applications/video/davinci-resolve/default.nix
+++ b/pkgs/applications/video/davinci-resolve/default.nix
@ -0,0 +1,179 @@
+{ stdenv
+, lib
+, cacert
+, curl
+, runCommandLocal
+, targetPlatform
+, unzip
+, appimage-run
+, addOpenGLRunpath
+, libGLU
+, xorg
+, buildFHSUserEnv
+, bash
+, writeText
+, ocl-icd
+, xkeyboard_config
+, glib
+, libarchive
+, python
+}:
+
+let
+  davinci = (
+    stdenv.mkDerivation rec {
+      pname = "davinci-resolve";
+      version = "17.4.3";
+
+      nativeBuildInputs = [ unzip appimage-run addOpenGLRunpath ];
+
+      # Pretty sure, there are missing dependencies ...
+      buildInputs = [ libGLU xorg.libXxf86vm ];
+
+      src = runCommandLocal "${pname}-src.zip"
+        rec {
+          outputHashMode = "recursive";
+          outputHashAlgo = "sha256";
+          outputHash = "0hq374n26mbcds8f1z644cvnh4h2rjdrbxxxbj4p34mx9b04ab28";
+
+          impureEnvVars = lib.fetchers.proxyImpureEnvVars;
+
+          nativeBuildInputs = [ curl ];
+
+          # ENV VARS
+          SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+
+          DOWNLOADID = "5efad1a052e8471989f662338d5247f1";
+          REFERID = "263d62f31cbb49e0868005059abcb0c9";
+          SITEURL = "https://www.blackmagicdesign.com/api/register/us/download/${DOWNLOADID}";
+
+          USERAGENT = builtins.concatStringsSep " " [
+            "User-Agent: Mozilla/5.0 (X11; Linux ${targetPlatform.linuxArch})"
+            "AppleWebKit/537.36 (KHTML, like Gecko)"
+            "Chrome/77.0.3865.75"
+            "Safari/537.36"
+          ];
+
+          REQJSON = builtins.toJSON {
+            "firstname" = "NixOS";
+            "lastname" = "Linux";
+            "email" = "someone@nixos.org";
+            "phone" = "+31 71 452 5670";
+            "country" = "nl";
+            "state" = "Province of Utrecht";
+            "city" = "Utrecht";
+            "product" = "DaVinci Resolve";
+          };
+
+        } ''
+        RESOLVEURL=$(curl \
+          -s \
+          -H 'Host: www.blackmagicdesign.com' \
+          -H 'Accept: application/json, text/plain, */*' \
+          -H 'Origin: https://www.blackmagicdesign.com' \
+          -H "$USERAGENT" \
+          -H 'Content-Type: application/json;charset=UTF-8' \
+          -H "Referer: https://www.blackmagicdesign.com/support/download/$REFERID/Linux" \
+          -H 'Accept-Encoding: gzip, deflate, br' \
+          -H 'Accept-Language: en-US,en;q=0.9' \
+          -H 'Authority: www.blackmagicdesign.com' \
+          -H 'Cookie: _ga=GA1.2.1849503966.1518103294; _gid=GA1.2.953840595.1518103294' \
+          --data-ascii "$REQJSON" \
+          --compressed \
+          "$SITEURL")
+
+        curl \
+          --retry 3 --retry-delay 3 \
+          -H "Host: sw.blackmagicdesign.com" \
+          -H "Upgrade-Insecure-Requests: 1" \
+          -H "$USERAGENT" \
+          -H "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8" \
+          -H "Accept-Language: en-US,en;q=0.9" \
+          --compressed \
+          "$RESOLVEURL" \
+          > $out
+      '';
+
+      # The unpack phase won't generate a directory
+      setSourceRoot = ''
+        sourceRoot=$PWD
+      '';
+
+      installPhase = ''
+        runHook preInstall
+
+        export HOME=$PWD/home
+        mkdir -p $HOME
+
+        mkdir -p $out
+        appimage-run ./DaVinci_Resolve_${version}_Linux.run -i -y -n -C $out
+
+        mkdir -p $out/{configs,DolbyVision,easyDCP,Fairlight,GPUCache,logs,Media,"Resolve Disk Database",.crashreport,.license,.LUT}
+        runHook postInstall
+      '';
+
+      dontStrip = true;
+
+      postFixup = ''
+        for program in $out/bin/*; do
+          isELF "$program" || continue
+          addOpenGLRunpath "$program"
+        done
+
+        for program in $out/libs/*; do
+          isELF "$program" || continue
+          if [[ "$program" != *"libcudnn_cnn_infer"* ]];then
+            echo $program
+            addOpenGLRunpath "$program"
+          fi
+        done
+      '';
+    }
+  );
+in
+buildFHSUserEnv {
+  name = "davinci-resolve";
+  targetPkgs = pkgs: with pkgs; [
+    librsvg
+    libGLU
+    libGL
+    xorg.libICE
+    xorg.libSM
+    xorg.libXxf86vm
+    xorg.libxcb
+    udev
+    opencl-headers
+    alsa-lib
+    xorg.libX11
+    xorg.libXext
+    expat
+    zlib
+    libuuid
+    bzip2
+    libtool
+    ocl-icd
+    glib
+    libarchive
+    xdg-utils # xdg-open needed to open URLs
+    python
+    # currently they want python 3.6 which is EOL
+    #python3
+  ];
+
+  runScript = "${bash}/bin/bash ${
+    writeText "davinci-wrapper"
+    ''
+    export QT_XKB_CONFIG_ROOT="${xkeyboard_config}/share/X11/xkb"
+    export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:${davinci}/libs
+    ${davinci}/bin/resolve
+    ''
+  }";
+
+  meta = with lib; {
+    description = "Professional Video Editing, Color, Effects and Audio Post";
+    homepage = "https://www.blackmagicdesign.com/products/davinciresolve/";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ jshcmpbll ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -88,6 +88,11 @@ stdenv.mkDerivation rec {

  patches = [
    ./fix-qemu-ga.patch
+    # MTP Devices were broken in QEMU 6.1.0, this patch fixes that.
+     (fetchpatch {
+       url = "https://gitlab.com/qemu-project/qemu/-/commit/9d30c78c7d3b994825cbe63fa277279ae3ef4248.patch";
+       sha256 = "sha256-AChB9HMEShrM+2UW2aOT9+MqlAm568sG3HxHK3nDC/M=";
+     })
    # Cocoa clipboard support only works on macOS 10.14+
    (fetchpatch {
      url = "https://gitlab.com/qemu-project/qemu/-/commit/7e3e20d89129614f4a7b2451fe321cc6ccca3b76.diff";
--- a/pkgs/data/fonts/noto-fonts/default.nix
+++ b/pkgs/data/fonts/noto-fonts/default.nix
@ -71,11 +71,11 @@ let
        owner = "googlefonts";
        repo = "noto-cjk";
        inherit rev sha256;
-        sparseCheckout = "${typeface}/OTC";
+        sparseCheckout = "${typeface}/Variable/OTC";
      };

      installPhase = ''
-        install -m444 -Dt $out/share/fonts/opentype/noto-cjk ${typeface}/OTC/*.ttc
+        install -m444 -Dt $out/share/fonts/opentype/noto-cjk ${typeface}/Variable/OTC/*.otf.ttc
      '';

      passthru.tests.noto-fonts = nixosTests.noto-fonts;
@ -117,14 +117,14 @@ in
    typeface = "Sans";
    version = "2.004";
    rev = "9f7f3c38eab63e1d1fddd8d50937fe4f1eacdb1d";
-    sha256 = "sha256-pNC/WJCYHSlU28E/CSFsrEMbyCe/6tjevDlOvDK9RwU=";
+    sha256 = "sha256-11d/78i21yuzxrfB5t2VQN9OBz/qZKeozuS6BrLFjzw=";
  };

  noto-fonts-cjk-serif = mkNotoCJK {
    typeface = "Serif";
    version = "2.000";
    rev = "9f7f3c38eab63e1d1fddd8d50937fe4f1eacdb1d";
-    sha256 = "sha256-Iy4lmWj5l+/Us/dJJ/Jl4MEojE9mrFnhNQxX2zhVngY=";
+    sha256 = "sha256-G+yl3LZvSFpbEUuuvattPDctKTzBCshOi970DcbPliE=";
  };

  noto-fonts-emoji = let
--- a/pkgs/desktops/gnome/core/gucharmap/default.nix
+++ b/pkgs/desktops/gnome/core/gucharmap/default.nix
@ -45,7 +45,7 @@ let
  };
 in stdenv.mkDerivation rec {
  pname = "gucharmap";
-  version = "14.0.2";
+  version = "14.0.3";

  outputs = [ "out" "lib" "dev" "devdoc" ];

@ -54,7 +54,7 @@ in stdenv.mkDerivation rec {
    owner = "GNOME";
    repo = pname;
    rev = version;
-    sha256 = "sha256-gyOm/S0ae0kX4AFUiglqyGRGB8C/KUuaG/dr/Wf1ug0=";
+    sha256 = "sha256-xO34CR+SWxtHuP6G8m0jla0rivVp3ddrsODNo50MhHw=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/core/sushi/default.nix
+++ b/pkgs/desktops/gnome/core/sushi/default.nix
@ -23,11 +23,11 @@

 stdenv.mkDerivation rec {
  pname = "sushi";
-  version = "41.0";
+  version = "41.1";

  src = fetchurl {
    url = "mirror://gnome/sources/sushi/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    sha256 = "m3UlaQzkNmJO+gpgV3NJNDLNDva49GSYLouETtqYmO4=";
+    sha256 = "JifbYWLnV3hZDAfhZbLzbqJNEjGlE7FkAj/G3fx1xKM=";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/games/aisleriot/default.nix
+++ b/pkgs/desktops/gnome/games/aisleriot/default.nix
@ -10,7 +10,7 @@
 , librsvg
 , libxml2
 , desktop-file-utils
-, guile_3_0
+, guile
 , libcanberra-gtk3
 , ninja
 , appstream-glib
@ -19,14 +19,14 @@

 stdenv.mkDerivation rec {
  pname = "aisleriot";
-  version = "3.22.21";
+  version = "3.22.22";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "GNOME";
    repo = pname;
    rev = version;
-    sha256 = "sha256-dpzuePxSoJcwUlj314r5G9A8aF1Yz49r+DxNTfA8/Ks=";
+    sha256 = "sha256-Jr4XEj6h+gI1gNqoJ/cJ3cDBB4mSbpzvOUQkwGxkLPs=";
  };

  nativeBuildInputs = [
@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
  buildInputs = [
    gtk3
    librsvg
-    guile_3_0
+    guile
    libcanberra-gtk3
  ];

--- a/pkgs/desktops/gnome/games/five-or-more/default.nix
+++ b/pkgs/desktops/gnome/games/five-or-more/default.nix
@ -1,21 +1,46 @@
-{ lib, stdenv, fetchurl, meson, ninja, pkg-config, gnome, gtk3, wrapGAppsHook
-, librsvg, libgnome-games-support, gettext, itstool, libxml2, python3, vala }:
+{ stdenv
+, lib
+, fetchurl
+, meson
+, ninja
+, pkg-config
+, gnome
+, gtk3
+, wrapGAppsHook
+, librsvg
+, libgnome-games-support
+, gettext
+, itstool
+, libxml2
+, python3
+, vala
+}:

 stdenv.mkDerivation rec {
  pname = "five-or-more";
-  version = "3.32.2";
+  version = "3.32.3";

  src = fetchurl {
    url = "mirror://gnome/sources/five-or-more/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "19pf8wzbf3ciqf2k4bj9sddvyhckfd62x86pnqr6s8h4vn9jc6ii";
+    sha256 = "LRDXLu/esyS0R9YyrwwySW4l/BWjwB230vAMm1HQnvQ=";
  };

  nativeBuildInputs = [
-    meson ninja pkg-config gettext itstool libxml2 python3 wrapGAppsHook
+    meson
+    ninja
+    pkg-config
+    gettext
+    itstool
+    libxml2
+    python3
+    wrapGAppsHook
    vala
  ];
+
  buildInputs = [
-    gtk3 librsvg libgnome-games-support gnome.adwaita-icon-theme
+    gtk3
+    librsvg
+    libgnome-games-support
  ];

  postPatch = ''
--- a/pkgs/development/compilers/elm/packages/node-packages.nix
+++ b/pkgs/development/compilers/elm/packages/node-packages.nix
--- a/pkgs/development/compilers/gambit/build.nix
+++ b/pkgs/development/compilers/gambit/build.nix
@ -86,8 +86,8 @@ gccStdenv.mkDerivation rec {

    # OS-specific paths are hardcoded in ./configure
    substituteInPlace config.status \
-      --replace "/usr/local/opt/openssl@1.1" "${openssl.out}" \
-      --replace "/usr/local/opt/openssl" "${openssl.out}"
+      --replace "/usr/local/opt/openssl@1.1" "${lib.getLib openssl}" \
+      --replace "/usr/local/opt/openssl" "${lib.getLib openssl}"

    ./config.status
  '';
--- a/pkgs/development/compilers/graalvm/community-edition/default.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/default.nix
@ -1,17 +1,60 @@
-{ lib, callPackage, Foundation }:
+{ callPackage, Foundation }:
+/*
+  Add new graal versions and products here and then see update.nix on how to
+  generate the sources.
+*/

 let
  mkGraal = opts: callPackage (import ./mkGraal.nix opts) {
    inherit Foundation;
  };
+
+  /*
+    Looks a bit ugly but makes version update in the update script using sed
+    much easier
+  */
+  graalvm11-ce-release-version = "22.0.0.2";
+  graalvm17-ce-release-version = "22.0.0.2";
+  graalvm11-ce-dev-version = "22.2.0-dev-20220401_1942";
+  graalvm17-ce-dev-version = "22.2.0-dev-20220401_1942";
+
+  commonProducts = [
+    "graalvm-ce"
+    "native-image-installable-svm"
+    "ruby-installable-svm"
+    "wasm-installable-svm"
+  ];
+
 in
 {
  inherit mkGraal;

  graalvm11-ce = mkGraal rec {
-    version = "22.0.0.2";
+    config = {
+      x86_64-darwin = {
+        arch = "darwin-amd64";
+        products = commonProducts ++ [ "python-installable-svm" ];
+      };
+      x86_64-linux = {
+        arch = "linux-amd64";
+        products = commonProducts ++ [ "python-installable-svm" ];
+      };
+      aarch64-darwin = {
+        arch = "darwin-aarch64";
+        products = [
+          "graalvm-ce"
+          "native-image-installable-svm"
+        ];
+        version = graalvm11-ce-dev-version;
+      };
+      aarch64-linux = {
+        arch = "linux-aarch64";
+        products = commonProducts;
+      };
+    };
+    defaultVersion = graalvm11-ce-release-version;
    javaVersion = "11";
-    platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" ];
+    platforms = builtins.attrNames config;
  };

  # TODO: fix aarch64-linux, failing during Native Image compilation
@ -20,8 +63,26 @@ in
  # directory"/tmp/SVM-4194439592488143713"): error=0, Failed to exec spawn
  # helper: pid: 19865, exit value: 1"
  graalvm17-ce = mkGraal rec {
-    version = "22.0.0.2";
+    config = {
+      x86_64-darwin = {
+        arch = "darwin-amd64";
+        products = commonProducts ++ [ "python-installable-svm" ];
+      };
+      x86_64-linux = {
+        arch = "linux-amd64";
+        products = commonProducts ++ [ "python-installable-svm" ];
+      };
+      aarch64-darwin = {
+        arch = "darwin-aarch64";
+        products = [
+          "graalvm-ce"
+          "native-image-installable-svm"
+        ];
+        version = graalvm17-ce-dev-version;
+      };
+    };
+    defaultVersion = graalvm17-ce-release-version;
    javaVersion = "17";
-    platforms = [ "x86_64-linux" "x86_64-darwin" ];
+    platforms = builtins.attrNames config;
  };
 }
--- a/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json
+++ b/pkgs/development/compilers/graalvm/community-edition/graalvm11-ce-sources.json
@ -0,0 +1,74 @@
+{
+  "darwin-aarch64": {
+    "graalvm-ce|java11|22.2.0-dev-20220401_1942": {
+      "sha256": "c83dee740ae148486598759e44a717b09d8124e4ea50f9da1e7d49d016572b89",
+      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220401_1942/graalvm-ce-java11-darwin-aarch64-dev.tar.gz"
+    },
+    "native-image-installable-svm|java11|22.2.0-dev-20220401_1942": {
+      "sha256": "661311ae26bfd6c46360b9e65aabe9361dc5cd05878a404343adf16925ae78fa",
+      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220401_1942/native-image-installable-svm-java11-darwin-aarch64-dev.jar"
+    }
+  },
+  "darwin-amd64": {
+    "graalvm-ce|java11|22.0.0.2": {
+      "sha256": "8280159b8a66c51a839c8079d885928a7f759d5da0632f3af7300df2b63a6323",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/graalvm-ce-java11-darwin-amd64-22.0.0.2.tar.gz"
+    },
+    "native-image-installable-svm|java11|22.0.0.2": {
+      "sha256": "03c27de6cce61ee8073e89252212457f3fbac2c0bc9bfa4acbff12176476c176",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/native-image-installable-svm-java11-darwin-amd64-22.0.0.2.jar"
+    },
+    "python-installable-svm|java11|22.0.0.2": {
+      "sha256": "67ee2f1cc10b0189e359344c31b22f423e636ff4ec2dd7d9437c3eb0ef54e601",
+      "url": "https://github.com/graalvm/graalpython/releases/download/vm-22.0.0.2/python-installable-svm-java11-darwin-amd64-22.0.0.2.jar"
+    },
+    "ruby-installable-svm|java11|22.0.0.2": {
+      "sha256": "a25c0099a21ca1ca9904dd3acdeef509f67a13b96c6135b6de199e9805330df9",
+      "url": "https://github.com/oracle/truffleruby/releases/download/vm-22.0.0.2/ruby-installable-svm-java11-darwin-amd64-22.0.0.2.jar"
+    },
+    "wasm-installable-svm|java11|22.0.0.2": {
+      "sha256": "d74c210a8a87b8eb0c4d18a65fde6f2c03ebc94d9bf7ed87bbb9cacc460006d7",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/wasm-installable-svm-java11-darwin-amd64-22.0.0.2.jar"
+    }
+  },
+  "linux-aarch64": {
+    "graalvm-ce|java11|22.0.0.2": {
+      "sha256": "1cc0263d95f642dada4e290dca7f49c0456cefa7b690b67e3e5c159b537b2c58",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/graalvm-ce-java11-linux-aarch64-22.0.0.2.tar.gz"
+    },
+    "native-image-installable-svm|java11|22.0.0.2": {
+      "sha256": "51d41e890a5aabf8e7b9d4f4e0f88206ee70a261f7dbb0315d51770ab8f3009e",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/native-image-installable-svm-java11-linux-aarch64-22.0.0.2.jar"
+    },
+    "ruby-installable-svm|java11|22.0.0.2": {
+      "sha256": "e0fb582a9c6b4167e7dc267c58ca1968bd1c471b3bc5c56061b436f175486d80",
+      "url": "https://github.com/oracle/truffleruby/releases/download/vm-22.0.0.2/ruby-installable-svm-java11-linux-aarch64-22.0.0.2.jar"
+    },
+    "wasm-installable-svm|java11|22.0.0.2": {
+      "sha256": "a48470ae391c75cb2805b7fe27cde2c925c0466fdbc0623dfbb67c54f19dbf8c",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/wasm-installable-svm-java11-linux-aarch64-22.0.0.2.jar"
+    }
+  },
+  "linux-amd64": {
+    "graalvm-ce|java11|22.0.0.2": {
+      "sha256": "bc86083bb7e2778c7e4fe4f55d74790e42255b96f7806a7fefa51d06f3bc7103",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/graalvm-ce-java11-linux-amd64-22.0.0.2.tar.gz"
+    },
+    "native-image-installable-svm|java11|22.0.0.2": {
+      "sha256": "8504a3441f5b28b8fd625f676674a9216f082ae63a4e30d43930c80f9672e71d",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/native-image-installable-svm-java11-linux-amd64-22.0.0.2.jar"
+    },
+    "python-installable-svm|java11|22.0.0.2": {
+      "sha256": "2f01d1bbc2ed2c507952d8ceaab1cb2176fc67e2d8c4b3bf5864e8d930c60c55",
+      "url": "https://github.com/graalvm/graalpython/releases/download/vm-22.0.0.2/python-installable-svm-java11-linux-amd64-22.0.0.2.jar"
+    },
+    "ruby-installable-svm|java11|22.0.0.2": {
+      "sha256": "e90f7ebc13b6c1f8e3f98881bb4fe2336870744174b2b6d41dc672d15f0b9a40",
+      "url": "https://github.com/oracle/truffleruby/releases/download/vm-22.0.0.2/ruby-installable-svm-java11-linux-amd64-22.0.0.2.jar"
+    },
+    "wasm-installable-svm|java11|22.0.0.2": {
+      "sha256": "c0fdfc40374b70f6f1597dd21660535c813dc5c3948c8a6ea9559a20f4d3fb5e",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/wasm-installable-svm-java11-linux-amd64-22.0.0.2.jar"
+    }
+  }
+}
--- a/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json
+++ b/pkgs/development/compilers/graalvm/community-edition/graalvm17-ce-sources.json
@ -0,0 +1,56 @@
+{
+  "darwin-aarch64": {
+    "graalvm-ce|java17|22.2.0-dev-20220401_1942": {
+      "sha256": "f0409c59adbce62da7be46ab7d0e01abe5c080ef97d0b555e6c773f94dbfdecf",
+      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220401_1942/graalvm-ce-java17-darwin-aarch64-dev.tar.gz"
+    },
+    "native-image-installable-svm|java17|22.2.0-dev-20220401_1942": {
+      "sha256": "3770dc4810d7ebae8f9ca2212e91112629096a964d3caea1667b0aaf5f70c1e0",
+      "url": "https://github.com/graalvm/graalvm-ce-dev-builds/releases/download/22.2.0-dev-20220401_1942/native-image-installable-svm-java17-darwin-aarch64-dev.jar"
+    }
+  },
+  "darwin-amd64": {
+    "graalvm-ce|java17|22.0.0.2": {
+      "sha256": "d54af9d1f4d0d351827395a714ed84d2489b023b74a9c13a431cc9d31d1e8f9a",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/graalvm-ce-java17-darwin-amd64-22.0.0.2.tar.gz"
+    },
+    "native-image-installable-svm|java17|22.0.0.2": {
+      "sha256": "007fa742cd139d447f83d776b6d78e717c9df11d56a61061a5937547c20028b7",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/native-image-installable-svm-java17-darwin-amd64-22.0.0.2.jar"
+    },
+    "python-installable-svm|java17|22.0.0.2": {
+      "sha256": "af887b0304d5ec98fab1be2cd1fca2aa3b10e84e823142a7f274560b1e0ea7c1",
+      "url": "https://github.com/graalvm/graalpython/releases/download/vm-22.0.0.2/python-installable-svm-java17-darwin-amd64-22.0.0.2.jar"
+    },
+    "ruby-installable-svm|java17|22.0.0.2": {
+      "sha256": "fc5eb6f833136ae3fda61f46fe0af66a8454ca2f803ca35eaff7336521cb468d",
+      "url": "https://github.com/oracle/truffleruby/releases/download/vm-22.0.0.2/ruby-installable-svm-java17-darwin-amd64-22.0.0.2.jar"
+    },
+    "wasm-installable-svm|java17|22.0.0.2": {
+      "sha256": "b76e6d872ce07ca9facd5b997dbb6e557ba72aa369ddd5f1664431bd11b98796",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/wasm-installable-svm-java17-darwin-amd64-22.0.0.2.jar"
+    }
+  },
+  "linux-amd64": {
+    "graalvm-ce|java17|22.0.0.2": {
+      "sha256": "4f743e0ed3d974b7d619ca2ed6014554e8c12e5ebbb38b9bc9e820b182169bd4",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/graalvm-ce-java17-linux-amd64-22.0.0.2.tar.gz"
+    },
+    "native-image-installable-svm|java17|22.0.0.2": {
+      "sha256": "8c25f650d58c2649c97061cb806dfaec9e685d5d2b80afc7cf72fe61d6891831",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/native-image-installable-svm-java17-linux-amd64-22.0.0.2.jar"
+    },
+    "python-installable-svm|java17|22.0.0.2": {
+      "sha256": "b3b78a15bd29b4eaaf0f2607e21181ca2a5b41b38ba43a3ff2656c2f6effda8a",
+      "url": "https://github.com/graalvm/graalpython/releases/download/vm-22.0.0.2/python-installable-svm-java17-linux-amd64-22.0.0.2.jar"
+    },
+    "ruby-installable-svm|java17|22.0.0.2": {
+      "sha256": "d86c9ad50cbed980fa69d69b2eccd47d31880d8c55553483f59ce9eda15628bd",
+      "url": "https://github.com/oracle/truffleruby/releases/download/vm-22.0.0.2/ruby-installable-svm-java17-linux-amd64-22.0.0.2.jar"
+    },
+    "wasm-installable-svm|java17|22.0.0.2": {
+      "sha256": "7f7e51e4a24384b3dd960c12ab9b05b1fea58a0457d6b80e3797228fab93c0bd",
+      "url": "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/wasm-installable-svm-java17-linux-amd64-22.0.0.2.jar"
+    }
+  }
+}
--- a/pkgs/development/compilers/graalvm/community-edition/hashes.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/hashes.nix
@ -1,57 +0,0 @@
-# Generated by ./update.sh script
-{ javaVersionPlatform, ... }:
-[
-  {
-    sha256 = {
-      "11-linux-aarch64" = "0n1cgd9rn5aw7rzbd45nlzpnqif095zwl3999vddlhpnjlyjdh0w";
-      "17-linux-aarch64" = "1iw27igiyzzl43yfgid1h6h7hd0xnv0rfdkp4r7r8i51sa3q7my7";
-      "11-linux-amd64" = "00vipkrhc7d5xxznm07pjrdjahhfg5s5vxg49xz8qxz2nwxhi1mw";
-      "17-linux-amd64" = "1m4v2s1b2878r6dqpcxvbqpc3s2l8l0xcbna37bbfx6rsc73wx2g";
-      "11-darwin-amd64" = "08v37avg439hywx2yqx0bnfpazwaja2xhyc0kj1imib6iadib042";
-      "17-darwin-amd64" = "16lg3qfx7j8w8cxc3abl7c19nj6jhkni99wmff153lyhyk8zjjnm";
-    }.${javaVersionPlatform} or null;
-    url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/graalvm-ce-java${javaVersionPlatform}-22.0.0.2.tar.gz";
-  }
-  {
-    sha256 = {
-      "11-linux-aarch64" = "17h0yfw0lxsiblqv1nzpc6i71vh6hbwf1x6lp7kziass1a4ixm2i";
-      "17-linux-aarch64" = "1nvm04smzbis1jy9znac2a4yf9ajqvvmadcf5ffr521rm784g2br";
-      "11-linux-amd64" = "07g7fab0zj1h77a30kiswqm0hvr1m5s6crszcbyvha2v3x2a6145";
-      "17-linux-amd64" = "0c8qi7b63zkjrz3sz01bbmfni7pcz9nq1jv1f34lj9lcsm8gc9cc";
-      "11-darwin-amd64" = "0xn1frj1f4pzrd5gm6xwq31blgvz8l9249c97q3yh7p6rkk7vhh3";
-      "17-darwin-amd64" = "1dr80314fxcklmhi19jn3pqrsz3iivbvcxnphdzl978krm1afzq0";
-    }.${javaVersionPlatform} or null;
-    url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/native-image-installable-svm-java${javaVersionPlatform}-22.0.0.2.jar";
-  }
-  {
-    sha256 = {
-      "11-linux-aarch64" = "103d91sz2dmlc5hcbi9v3d3irgb83755hz16vkknfhbbkhm5iyz0";
-      "17-linux-aarch64" = "0vas98knpvpajmv8bkgcf0fh7n5fy361nd47002cpppg6hrp7k9q";
-      "11-linux-amd64" = "0h4s1dgx2wn63pabdckl85s70s1kw97vp0c8z7izihdn2fy7w3z9";
-      "17-linux-amd64" = "1g98ashyvscwyn1k8mamih6qhcbxsk62x6ynd7x81ndy1karlv6q";
-      "11-darwin-amd64" = "1y8d6c2ri7hrvsv3aqbcp49pmxh9yppcsfnx0jcwm88wlach0p52";
-      "17-darwin-amd64" = "13a6rchnaczpmxga6g405z55913ayq5gwihzlvyy6shk6gwbcppw";
-    }.${javaVersionPlatform} or null;
-    url = "https://github.com/oracle/truffleruby/releases/download/vm-22.0.0.2/ruby-installable-svm-java${javaVersionPlatform}-22.0.0.2.jar";
-  }
-  {
-    sha256 = {
-      "11-linux-aarch64" = "135zkpqm8z5nzcyn5h6vdx3c09f9wb6jgzmp0llcnx8w76p71154";
-      "17-linux-aarch64" = "0pij3kh70lxrzmbzx8zw97f9nb0rr492l7x3n13wcr859cr8akas";
-      "11-linux-amd64" = "0ppvsgs216jmm5p8m34lqg2kv0awadh1dlkxb7qzcw2b6x0grzf0";
-      "17-linux-amd64" = "1gf0jfmqy8lp6w7bimjp0j5abzmi0ndsn4hcjvfv7123lbj52zkz";
-      "11-darwin-amd64" = "1mq6013crjmrpf3yvxwv9p4yn0rcdzg5z9hq9l6fpf47i8522k6p";
-      "17-darwin-amd64" = "15l7p48vsca4cvqxbpb9lcmafysmdsxpv6avrpxajz705j3nsvmp";
-    }.${javaVersionPlatform} or null;
-    url = "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-22.0.0.2/wasm-installable-svm-java${javaVersionPlatform}-22.0.0.2.jar";
-  }
-  {
-    sha256 = {
-      "11-linux-amd64" = "0m8cqqqdks34b2zv7i6qw9kzqxi1rfqsmknqa9wm0b7dqaxx209g";
-      "17-linux-amd64" = "12nszxp2yv35y8zkm94bnd0mnanah48y41r61ypymd19plaqmdxk";
-      "11-darwin-amd64" = "00g6akpv0gkw8gcxfbgcyipn6gj25yr32k1lb7iqj08bq4f2zvk7";
-      "17-darwin-amd64" = "1hd71qg0nmklyakl4cc29vl10fxalbyd2b5yn7x9iv6m0h1pp25g";
-    }.${javaVersionPlatform} or null;
-    url = "https://github.com/graalvm/graalpython/releases/download/vm-22.0.0.2/python-installable-svm-java${javaVersionPlatform}-22.0.0.2.jar";
-  }
-]
--- a/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/mkGraal.nix
@ -1,7 +1,7 @@
-{ version
-, javaVersion
+{ javaVersion
+, defaultVersion
 , platforms
-, hashes ? import ./hashes.nix
+, config
 , useMusl ? false
 }:

@ -33,16 +33,19 @@
 , cairo
 , glib
 , gtk3
+, writeShellScript
+, jq
+, gnused
 }:

 assert useMusl -> stdenv.isLinux;

 let
-  platform = {
-    aarch64-linux = "linux-aarch64";
-    x86_64-linux = "linux-amd64";
-    x86_64-darwin = "darwin-amd64";
-  }.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
+  platform = config.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  version = platform.version or defaultVersion;
+  name = "graalvm${javaVersion}-ce";
+  sourcesFilename = "${name}-sources.json";
+  sources = builtins.fromJSON (builtins.readFile (./. + "/${sourcesFilename}"));

  runtimeLibraryPath = lib.makeLibraryPath
    ([ cups ] ++ lib.optionals gtkSupport [ cairo glib gtk3 ]);
@ -56,21 +59,11 @@ let
    (writeShellScriptBin "${stdenv.system}-musl-gcc" ''${lib.getDev musl}/bin/musl-gcc "$@"'')
  ]);

-  javaVersionPlatform = "${javaVersion}-${platform}";
-
  graalvmXXX-ce = stdenv.mkDerivation rec {
    inherit version;
-    name = "graalvm${javaVersion}-ce";
-    srcs =
-      let
-        # Some platforms doesn't have all GraalVM features
-        # e.g.: GraalPython on aarch64-linux
-        # When the platform doesn't have a feature, sha256 is null on hashes.nix
-        # To update hashes.nix file, run `./update.sh <graalvm-ce-version>`
-        maybeFetchUrl = url: if url.sha256 != null then (fetchurl url) else null;
-      in
-      (lib.remove null
-        (map maybeFetchUrl (hashes { inherit javaVersionPlatform; })));
+    pname = name;
+
+    srcs = map fetchurl (builtins.attrValues sources.${platform.arch});

    buildInputs = lib.optionals stdenv.isLinux [
      alsa-lib # libasound.so wanted by lib/libjsound.so
@ -86,7 +79,8 @@ let
      zlib
    ];

-    nativeBuildInputs = [ unzip perl autoPatchelfHook makeWrapper ];
+    nativeBuildInputs = [ unzip perl makeWrapper ]
+      ++ lib.optional stdenv.hostPlatform.isLinux autoPatchelfHook;

    unpackPhase = ''
      unpack_jar() {
@ -139,65 +133,40 @@ let

    outputs = [ "out" "lib" ];

-    installPhase =
-      let
-        copyClibrariesToOut = basepath: ''
-          # provide libraries needed for static compilation
-          ${
-            if useMusl then
-              "for f in ${musl.stdenv.cc.cc}/lib/* ${musl}/lib/* ${zlib.static}/lib/*; do"
-            else
-              "for f in ${glibc}/lib/* ${glibc.static}/lib/* ${zlib.static}/lib/*; do"
-          }
-            ln -s $f ${basepath}/${platform}/$(basename $f)
-          done
-        '';
-        copyClibrariesToLib = ''
-          # add those libraries to $lib output too, so we can use them with
-          # `native-image -H:CLibraryPath=''${lib.getLib graalvm11-ce}/lib ...` and reduce
-          # closure size by not depending on GraalVM $out (that is much bigger)
-          mkdir -p $lib/lib
-          for f in ${glibc}/lib/*; do
-            ln -s $f $lib/lib/$(basename $f)
-          done
-        '';
-      in
-      {
-        "11-linux-amd64" = ''
-          ${copyClibrariesToOut "$out/lib/svm/clibraries"}
+    installPhase = ''
+      # ensure that $lib/lib exists to avoid breaking builds
+      mkdir -p $lib/lib
+      # jni.h expects jni_md.h to be in the header search path.
+      ln -s $out/include/linux/*_md.h $out/include/

-          ${copyClibrariesToLib}
-        '';
-        "17-linux-amd64" = ''
-          ${copyClibrariesToOut "$out/lib/svm/clibraries"}
+      # copy-paste openjdk's preFixup
+      # Set JAVA_HOME automatically.
+      mkdir -p $out/nix-support
+      cat > $out/nix-support/setup-hook << EOF
+        if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
+      EOF
+      ${
+      lib.optionalString (stdenv.isLinux) ''
+        # provide libraries needed for static compilation
+        ${
+          if useMusl then
+            "for f in ${musl.stdenv.cc.cc}/lib/* ${musl}/lib/* ${zlib.static}/lib/*; do"
+          else
+            "for f in ${glibc}/lib/* ${glibc.static}/lib/* ${zlib.static}/lib/*; do"
+        }
+          ln -s $f $out/lib/svm/clibraries/${platform.arch}/$(basename $f)
+        done

-          ${copyClibrariesToLib}
-        '';
-        "11-linux-aarch64" = ''
-          ${copyClibrariesToOut "$out/lib/svm/clibraries"}
-
-          ${copyClibrariesToLib}
-        '';
-        "17-linux-aarch64" = ''
-          ${copyClibrariesToOut "$out/lib/svm/clibraries"}
-
-          ${copyClibrariesToLib}
-        '';
-        "11-darwin-amd64" = "";
-        "17-darwin-amd64" = "";
-      }.${javaVersionPlatform} + ''
-        # ensure that $lib/lib exists to avoid breaking builds
+        # add those libraries to $lib output too, so we can use them with
+        # `native-image -H:CLibraryPath=''${lib.getLib graalvmXX-ce}/lib ...` and reduce
+        # closure size by not depending on GraalVM $out (that is much bigger)
        mkdir -p $lib/lib
-        # jni.h expects jni_md.h to be in the header search path.
-        ln -s $out/include/linux/*_md.h $out/include/
-
-        # copy-paste openjdk's preFixup
-        # Set JAVA_HOME automatically.
-        mkdir -p $out/nix-support
-        cat <<EOF > $out/nix-support/setup-hook
-          if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out; fi
-        EOF
-      '';
+        for f in ${glibc}/lib/*; do
+          ln -s $f $lib/lib/$(basename $f)
+        done
+      ''
+      }
+    '';

    dontStrip = true;

@ -281,7 +250,7 @@ let
      }

      ${
-        lib.optionalString (platform != "linux-aarch64") ''
+        lib.optionalString (builtins.any (a: a == "python-installable-svm") platform.products) ''
          echo "Testing GraalPython"
          $out/bin/graalpython -c 'print(1 + 1)'
          echo '1 + 1' | $out/bin/graalpython
@ -289,10 +258,14 @@ let
      }

      echo "Testing TruffleRuby"
+      ${
+        lib.optionalString (builtins.any (a: a == "ruby-installable-svm") platform.products) ''
      # Hide warnings about wrong locale
      export LANG=C
      export LC_ALL=C
      $out/bin/ruby -e 'puts(1 + 1)'
+      ''
+      }
      ${# FIXME: irb is broken in all platforms
        # TODO: `irb` on MacOS gives an error saying "Could not find OpenSSL
        # headers, install via Homebrew or MacPorts or set OPENSSL_PREFIX", even
@ -311,7 +284,11 @@ let

    passthru = {
      home = graalvmXXX-ce;
-      updateScript = ./update.sh;
+      updateScript = import ./update.nix {
+        inherit lib writeShellScript jq sourcesFilename name config gnused defaultVersion;
+        graalVersion = version;
+        javaVersion = "java${javaVersion}";
+      };
    };

    meta = with lib; {
--- a/pkgs/development/compilers/graalvm/community-edition/update.nix
+++ b/pkgs/development/compilers/graalvm/community-edition/update.nix
@ -0,0 +1,223 @@
+{ javaVersion
+, graalVersion
+, defaultVersion
+, config
+, sourcesFilename
+, name
+, lib
+, writeShellScript
+, jq
+, gnused
+}:
+
+/*
+  How to  use:
+  run `nix-shell maintainers/scripts/update.nix --argstr package graalvmXX-ce`
+  to update the graalvmXX-ce-sources.json file.
+  E.g: nix-shell maintainers/scripts/update.nix --argstr package graalvm17-ce
+
+  Basic idea:
+  If we know the platform, product, javaVersion and graalVersion
+  we can create the url. This leads to the following json structure:
+  {
+  "platform/arch1": {
+  "product1|javaVersion|graalVersion": { "sha256": "...", "url": "..."},
+  "product2|javaVersion|graalVersion": { "sha256": "...", "url": "..."},
+  ...
+  },
+  "platform/arch2": {
+  ...
+  }
+  }
+*/
+
+let
+  separator = "|";
+
+  # isDev :: String -> Boolean
+  isDev = version:
+    lib.hasInfix "dev" version;
+
+  # getLatestVersion :: String -> String
+  getLatestVersion = currentVersion:
+    let
+      dev = if isDev currentVersion then "dev-" else "";
+      url = "https://api.github.com/repos/graalvm/graalvm-ce-${dev}builds/releases/latest";
+      file = builtins.fetchurl url;
+      json = builtins.fromJSON (builtins.readFile file);
+    in
+    lib.removePrefix "vm-" json.tag_name;
+
+  # getArchString :: String -> String
+  getArchString = nixArchString:
+    {
+      "aarch64-linux" = "linux-aarch64";
+      "x86_64-linux" = "linux-amd64";
+      "x86_64-darwin" = "darwin-amd64";
+    }.${nixArchString};
+
+
+  # getProductSuffix :: String -> String
+  getProductSuffix = productName:
+    {
+      "graalvm-ce" = ".tar.gz";
+      "native-image-installable-svm" = ".jar";
+      "ruby-installable-svm" = ".jar";
+      "wasm-installable-svm" = ".jar";
+      "python-installable-svm" = ".jar";
+    }.${productName};
+
+  # getProductSuffix :: String -> String
+  getProductBaseUrl = productName:
+    {
+      "graalvm-ce" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
+      "native-image-installable-svm" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
+      "ruby-installable-svm" = "https://github.com/oracle/truffleruby/releases/download";
+      "wasm-installable-svm" = "https://github.com/graalvm/graalvm-ce-builds/releases/download";
+      "python-installable-svm" = "https://github.com/graalvm/graalpython/releases/download";
+    }.${productName};
+
+  # getDevUrl :: String
+  getDevUrl = { arch, graalVersion, product, javaVersion }:
+    let
+      baseUrl = https://github.com/graalvm/graalvm-ce-dev-builds/releases/download;
+    in
+    "${baseUrl}/${graalVersion}/${product}-${javaVersion}-${arch}-dev${getProductSuffix product}";
+
+  # getReleaseUrl :: AttrSet -> String
+  getReleaseUrl = { arch, graalVersion, product, javaVersion }:
+    let baseUrl = getProductBaseUrl product;
+    in
+    "${baseUrl}/vm-${graalVersion}/${product}-${javaVersion}-${arch}-${graalVersion}${getProductSuffix product}";
+
+  # getUrl :: AttrSet -> String
+  getUrl = args@{ arch, graalVersion, product, javaVersion }:
+    if isDev graalVersion
+    then getDevUrl args
+    else getReleaseUrl args;
+
+  # computeSha256 :: String -> String
+  computeSha256 = url:
+    builtins.hashFile "sha256" (builtins.fetchurl url);
+
+  # downloadSha256 :: String -> String
+  downloadSha256 = url:
+    let sha256Url = url + ".sha256";
+    in
+    builtins.readFile (builtins.fetchurl sha256Url);
+
+  # getSha256 :: String -> String -> String
+  getSha256 = graalVersion: url:
+    if isDev graalVersion
+    then computeSha256 url
+    else downloadSha256 url;
+
+  # cartesianZipListsWith :: (a -> b -> c) -> [a] -> [b] -> [c]
+  cartesianZipListsWith = f: fst: snd:
+    let
+      cartesianProduct = lib.cartesianProductOfSets { a = fst; b = snd; };
+      fst' = builtins.catAttrs "a" cartesianProduct;
+      snd' = builtins.catAttrs "b" cartesianProduct;
+    in
+    lib.zipListsWith f fst' snd';
+
+  # zipListsToAttrs :: [a] -> [b] -> AttrSet
+  zipListsToAttrs = names: values:
+    lib.listToAttrs (
+      lib.zipListsWith (name: value: { inherit name value; }) names values
+    );
+
+  # genProductJavaVersionGraalVersionAttrSet :: String -> AttrSet
+  genProductJavaVersionGraalVersionAttrSet = product_javaVersion_graalVersion:
+    let
+      attrNames = [ "product" "javaVersion" "graalVersion" ];
+      attrValues = lib.splitString separator product_javaVersion_graalVersion;
+    in
+    zipListsToAttrs attrNames attrValues;
+
+  # genUrlAndSha256 :: String -> String -> AttrSet
+  genUrlAndSha256 = arch: product_javaVersion_graalVersion:
+    let
+      productJavaVersionGraalVersion =
+        (genProductJavaVersionGraalVersionAttrSet product_javaVersion_graalVersion)
+        // { inherit arch; };
+      url = getUrl productJavaVersionGraalVersion;
+      sha256 = getSha256 productJavaVersionGraalVersion.graalVersion url;
+    in
+    {
+      ${arch} = {
+        ${product_javaVersion_graalVersion} = {
+          inherit sha256 url;
+        };
+      };
+    };
+
+  # genArchProductVersionPairs :: String -> -> String -> AttrSet -> [AttrSet]
+  genArchProductVersionList = javaVersion: graalVersion: archProducts:
+    let
+      arch = archProducts.arch;
+      products = archProducts.products;
+      javaGraalVersion = javaVersion + separator + (getLatestVersion (archProducts.version or graalVersion));
+      productJavaGraalVersionList =
+        cartesianZipListsWith (a: b: a + separator + b)
+          products [ javaGraalVersion ];
+    in
+    cartesianZipListsWith (genUrlAndSha256) [ arch ] productJavaGraalVersionList;
+
+
+  # genSources :: String -> String -> AttrSet -> Path String
+  genSources = javaVersion: defaultVersion: config:
+    let
+      archProducts = builtins.attrValues config;
+      sourcesList = builtins.concatMap (genArchProductVersionList javaVersion defaultVersion) archProducts;
+      sourcesAttr = builtins.foldl' (lib.recursiveUpdate) { } sourcesList;
+    in
+    builtins.toFile "sources.json" (builtins.toJSON sourcesAttr);
+
+  # isNew :: String -> String -> Boolean
+  isNew = newVersion: currentVersion:
+    {
+      "-1" = false;
+      "0" = false;
+      "1" = true;
+    }.${builtins.toString (builtins.compareVersions newVersion currentVersion)};
+
+  newVersion = getLatestVersion graalVersion;
+  sourcesJson = genSources javaVersion defaultVersion config;
+  sourcesJsonPath = lib.strings.escapeShellArg ./. + "/${sourcesFilename}";
+
+  # versionKeyInDefaultNix String -> String
+  versionKeyInDefaultNix = graalVersion:
+    if isDev graalVersion
+    then "${name}-dev-version"
+    else "${name}-release-version";
+
+  /*
+    updateScriptText :: String -> String -> String
+    Writes the json file and updates the version in default.nix using sed
+    because update-source-version does not work srcs.
+  */
+  updateScriptText = newVersion: currentVersion:
+
+    if isNew newVersion currentVersion
+    then
+      let
+        versionKey = versionKeyInDefaultNix currentVersion;
+      in
+      ''
+        echo "New version found. Updating ${currentVersion} -> ${newVersion}".
+        export PATH="${lib.makeBinPath [ jq gnused ]}:$PATH"
+        jq . ${sourcesJson} > ${sourcesJsonPath}
+        sed -i 's|${versionKey} = "${currentVersion}";|${versionKey} = "${newVersion}";|' \
+          ${lib.strings.escapeShellArg ./default.nix}
+      ''
+    else ''echo "No new version found. Skip updating."'';
+
+in
+writeShellScript "update-graal.sh" ''
+  set -o errexit
+  set -o nounset
+  set -o pipefail
+
+  ${updateScriptText newVersion graalVersion}
+''
--- a/pkgs/development/compilers/graalvm/community-edition/update.sh
+++ b/pkgs/development/compilers/graalvm/community-edition/update.sh
@ -1,81 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -p coreutils curl nix jq gnused -i bash
-
-set -eou pipefail
-
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-info() { echo "[INFO] $*"; }
-
-echo_file() { echo "$@" >> hashes.nix; }
-
-verlte() {
-    [  "$1" = "$(echo -e "$1\n$2" | sort -V | head -n1)" ]
-}
-
-readonly nixpkgs=../../../../..
-
-readonly old_version="$(nix-instantiate "$nixpkgs" --eval --strict -A graalvm11-ce.version)"
-
-if [[ -z "${1:-}" ]]; then
-  readonly gh_version="$(curl \
-      ${GITHUB_TOKEN:+"-u \":$GITHUB_TOKEN\""} \
-      -s https://api.github.com/repos/graalvm/graalvm-ce-builds/releases/latest | \
-      jq --raw-output .tag_name)"
-  readonly new_version="${gh_version//vm-/}"
-else
-  readonly new_version="$1"
-fi
-
-if verlte "$old_version" "$new_version"; then
-  info "graalvm-ce $old_version is up-to-date."
-  [[ -z "${FORCE:-}" ]]  && exit 0
-else
-  info "graalvm-ce $old_version is out-of-date. Updating..."
-fi
-
-readonly urls=(
-  "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/graalvm-ce-java@platform@-${new_version}.tar.gz"
-  "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/native-image-installable-svm-java@platform@-${new_version}.jar"
-  "https://github.com/oracle/truffleruby/releases/download/vm-${new_version}/ruby-installable-svm-java@platform@-${new_version}.jar"
-  "https://github.com/graalvm/graalvm-ce-builds/releases/download/vm-${new_version}/wasm-installable-svm-java@platform@-${new_version}.jar"
-  "https://github.com/graalvm/graalpython/releases/download/vm-${new_version}/python-installable-svm-java@platform@-${new_version}.jar"
-)
-
-readonly platforms=(
-  "11-linux-aarch64"
-  "17-linux-aarch64"
-  "11-linux-amd64"
-  "17-linux-amd64"
-  "11-darwin-amd64"
-  "17-darwin-amd64"
-)
-
-info "Deleting old hashes.nix file..."
-rm -f hashes.nix
-info "Generating hashes.nix file for 'graalvm-ce' $new_version. This will take a while..."
-
-echo_file "# Generated by $0 script"
-echo_file "{ javaVersionPlatform, ... }:"
-echo_file "["
-
-for url in "${urls[@]}"; do
-  echo_file "  {"
-  echo_file "    sha256 = {"
-  for platform in "${platforms[@]}"; do
-    if hash="$(nix-prefetch-url "${url//@platform@/$platform}")"; then
-      echo_file "      \"$platform\" = \"$hash\";"
-    fi
-  done
-  echo_file '    }.${javaVersionPlatform} or null;'
-  echo_file "    url = \"${url//@platform@/\$\{javaVersionPlatform\}}\";"
-  echo_file "  }"
-done
-
-echo_file "]"
-
-info "Updating graalvm-ce version..."
-# update-source-version does not work here since it expects src attribute
-sed "s|$old_version|\"$new_version\"|" -i default.nix
-
-info "Done!"
--- a/pkgs/development/compilers/obliv-c/default.nix
+++ b/pkgs/development/compilers/obliv-c/default.nix
@ -1,17 +1,19 @@
 { lib, stdenv, libgcrypt, fetchFromGitHub, ocamlPackages, perl }:
 stdenv.mkDerivation rec {
  pname = "obliv-c";
-  version = "0.0pre20180624";
+  version = "0.0pre20210621";
  buildInputs = [ perl ]
  ++ (with ocamlPackages; [ ocaml findlib ocamlbuild ]);
  propagatedBuildInputs = [ libgcrypt ];
  src = fetchFromGitHub {
    owner = "samee";
    repo = "obliv-c";
-    rev = "3d6804ca0fd85868207a0ccbd2509ec064723ac2";
-    sha256 = "1ib21ngn7zr58xxq4sjigrpaxb0wx35x3k9l4qvwflzrmvnman20";
+    rev = "e02e5c590523ef4dae06e167a7fa00037bb3fdaf";
+    sha256 = "sha256:02vyr4689f4dmwqqs0q1mrack9h3g8jz3pj8zqiz987dk0r5mz7a";
  };

+  hardeningDisable = [ "fortify" ];
+
  patches = [ ./ignore-complex-float128.patch ];

  preBuild = ''
--- a/pkgs/development/compilers/urweb/default.nix
+++ b/pkgs/development/compilers/urweb/default.nix
@ -27,7 +27,7 @@ stdenv.mkDerivation rec {

    export CC="${gcc}/bin/gcc";
    export CCARGS="-I$out/include \
-                   -L${openssl.out}/lib \
+                   -L${lib.getLib openssl}/lib \
                   -L${libmysqlclient}/lib \
                   -L${postgresql.lib}/lib \
                   -L${sqlite.out}/lib";
--- a/pkgs/development/interpreters/acl2/default.nix
+++ b/pkgs/development/interpreters/acl2/default.nix
@ -36,8 +36,8 @@ in stdenv.mkDerivation rec {
  patches = [(substituteAll {
    src = ./0001-Fix-some-paths-for-Nix-build.patch;
    libipasir = "${libipasir}/lib/${libipasir.libname}";
-    libssl = "${openssl.out}/lib/libssl${stdenv.hostPlatform.extensions.sharedLibrary}";
-    libcrypto = "${openssl.out}/lib/libcrypto${stdenv.hostPlatform.extensions.sharedLibrary}";
+    libssl = "${lib.getLib openssl}/lib/libssl${stdenv.hostPlatform.extensions.sharedLibrary}";
+    libcrypto = "${lib.getLib openssl}/lib/libcrypto${stdenv.hostPlatform.extensions.sharedLibrary}";
  })];

  buildInputs = [
@ -47,7 +47,7 @@ in stdenv.mkDerivation rec {
    # To build community books, we need Perl and a couple of utilities:
    which perl hostname makeWrapper
    # Some of the books require one or more of these external tools:
-    openssl.out glucose minisat abc-verifier libipasir
+    glucose minisat abc-verifier libipasir
    z3 (python2.withPackages (ps: [ ps.z3 ]))
  ];

--- a/pkgs/development/libraries/apr-util/default.nix
+++ b/pkgs/development/libraries/apr-util/default.nix
@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
      substituteInPlace $f \
        --replace "${expat.dev}/lib" "${expat.out}/lib" \
        --replace "${db.dev}/lib" "${db.out}/lib" \
-        --replace "${openssl.dev}/lib" "${openssl.out}/lib"
+        --replace "${openssl.dev}/lib" "${lib.getLib openssl}/lib"
    done

    # Give apr1 access to sed for runtime invocations.
--- a/pkgs/development/libraries/aqbanking/gwenhywfar.nix
+++ b/pkgs/development/libraries/aqbanking/gwenhywfar.nix
@ -23,7 +23,7 @@ in stdenv.mkDerivation rec {

  configureFlags = [
    "--with-openssl-includes=${openssl.dev}/include"
-    "--with-openssl-libs=${openssl.out}/lib"
+    "--with-openssl-libs=${lib.getLib openssl}/lib"
  ];

  preConfigure = ''
--- a/pkgs/development/libraries/gcr/default.nix
+++ b/pkgs/development/libraries/gcr/default.nix
@ -16,7 +16,7 @@
 , openssh
 , systemd
 , gobject-introspection
-, makeWrapper
+, wrapGAppsHook
 , libxslt
 , vala
 , gnome
@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
    gettext
    gobject-introspection
    libxslt
-    makeWrapper
+    wrapGAppsHook
    vala
    shared-mime-info
  ];
@ -96,11 +96,6 @@ stdenv.mkDerivation rec {
    patchShebangs meson_post_install.py
  '';

-  preFixup = ''
-    wrapProgram "$out/bin/gcr-viewer" \
-      --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
-  '';
-
  passthru = {
    updateScript = gnome.updateScript {
      packageName = pname;
--- a/pkgs/development/libraries/ggz_base_libs/default.nix
+++ b/pkgs/development/libraries/ggz_base_libs/default.nix
@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
  patchPhase = ''
    substituteInPlace configure \
      --replace "/usr/local/ssl/include" "${openssl.dev}/include" \
-      --replace "/usr/local/ssl/lib" "${openssl.out}/lib"
+      --replace "/usr/local/ssl/lib" "${lib.getLib openssl}/lib"
  '';

  configureFlags = [
--- a/pkgs/development/libraries/glib/default.nix
+++ b/pkgs/development/libraries/glib/default.nix
@ -115,7 +115,7 @@ stdenv.mkDerivation rec {
  strictDeps = true;

  nativeBuildInputs = [
-    (meson.override {
+    (buildPackages.meson.override {
      withDarwinFrameworksGtkDocPatch = stdenv.isDarwin;
    })
    ninja pkg-config perl python3 gettext gtk-doc docbook_xsl docbook_xml_dtd_45 libxml2
--- a/pkgs/development/libraries/libarchive/default.nix
+++ b/pkgs/development/libraries/libarchive/default.nix
@ -46,7 +46,7 @@ stdenv.mkDerivation rec {

  preFixup = ''
    sed -i $lib/lib/libarchive.la \
-      -e 's|-lcrypto|-L${openssl.out}/lib -lcrypto|' \
+      -e 's|-lcrypto|-L${lib.getLib openssl}/lib -lcrypto|' \
      -e 's|-llzo2|-L${lzo}/lib -llzo2|'
  '';

--- a/pkgs/development/libraries/live555/default.nix
+++ b/pkgs/development/libraries/live555/default.nix
@ -27,8 +27,8 @@ stdenv.mkDerivation rec {

  postPatch = ''
    substituteInPlace config.macosx-catalina \
-      --replace '/usr/lib/libssl.46.dylib' "${openssl.out}/lib/libssl.dylib" \
-      --replace '/usr/lib/libcrypto.44.dylib' "${openssl.out}/lib/libcrypto.dylib"
+      --replace '/usr/lib/libssl.46.dylib' "${lib.getLib openssl}/lib/libssl.dylib" \
+      --replace '/usr/lib/libcrypto.44.dylib' "${lib.getLib openssl}/lib/libcrypto.dylib"
    sed -i -e 's|/bin/rm|rm|g' genMakefiles
    sed -i \
      -e 's/$(INCLUDES) -I. -O2 -DSOCKLEN_T/$(INCLUDES) -I. -O2 -I. -fPIC -DRTSPCLIENT_SYNCHRONOUS_INTERFACE=1 -DSOCKLEN_T/g' \
--- a/pkgs/development/libraries/openldap/default.nix
+++ b/pkgs/development/libraries/openldap/default.nix
@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
    rm -r libraries/*/.libs
    rm -r contrib/slapd-modules/passwd/*/.libs
    for f in $out/lib/libldap.la $out/lib/libldap_r.la; do
-      substituteInPlace "$f" --replace '-lssl' '-L${openssl.out}/lib -lssl'
+      substituteInPlace "$f" --replace '-lssl' '-L${lib.getLib openssl}/lib -lssl'
  '' + lib.optionalString withCyrusSasl ''
      substituteInPlace "$f" --replace '-lsasl2' '-L${cyrus_sasl.out}/lib -lsasl2'
  '' + ''
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@ -68,7 +68,7 @@ let

  self = stdenv.mkDerivation rec {
    pname = "pipewire";
-    version = "0.3.48";
+    version = "0.3.49";

    outputs = [
      "out"
@ -86,7 +86,7 @@ let
      owner = "pipewire";
      repo = "pipewire";
      rev = version;
-      sha256 = "sha256-+gk/MJ9YimHBwN2I42DRP+I2OqBFFtZ81Fd/l89HcSk=";
+      sha256 = "sha256-8heX/9BsPguIOzHOuqEQdt6MS3eS4HxR4A+FUZKNpdo=";
    };

    patches = [
@ -102,6 +102,12 @@ let
      ./0090-pipewire-config-template-paths.patch
      # Place SPA data files in lib output to avoid dependency cycles
      ./0095-spa-data-dir.patch
+      # Fixes missing function declarations in pipewire headers
+      # Should be removed after the next release
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/a2e98e28c1e6fb58b273ef582398d8bee4d2b769.patch";
+        sha256 = "sha256-tqiiAW2fTEp23HT59XR2D/G08pVENJtpxUI7UVufj/A=";
+      })
    ];

    nativeBuildInputs = [
--- a/pkgs/development/libraries/qt-5/modules/qtbase.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtbase.nix
@ -261,7 +261,7 @@ stdenv.mkDerivation {
    "-I" "${harfbuzz.dev}/include"
    "-system-pcre"
    "-openssl-linked"
-    "-L" "${openssl.out}/lib"
+    "-L" "${lib.getLib openssl}/lib"
    "-I" "${openssl.dev}/include"
    "-system-sqlite"
    ''-${if libmysqlclient != null then "plugin" else "no"}-sql-mysql''
--- a/pkgs/development/libraries/unixODBCDrivers/default.nix
+++ b/pkgs/development/libraries/unixODBCDrivers/default.nix
@ -157,7 +157,7 @@
    '';

    postFixup = ''
-      patchelf --set-rpath ${lib.makeLibraryPath [ unixODBC openssl.out libkrb5 libuuid stdenv.cc.cc ]} \
+      patchelf --set-rpath ${lib.makeLibraryPath [ unixODBC openssl libkrb5 libuuid stdenv.cc.cc ]} \
        $out/lib/libmsodbcsql-${versionMajor}.${versionMinor}.so.${versionAdditional}
    '';

--- a/pkgs/development/lisp-modules/quicklisp-to-nix-overrides.nix
+++ b/pkgs/development/lisp-modules/quicklisp-to-nix-overrides.nix
@ -64,7 +64,7 @@ in
    propagatedBuildInputs = [pkgs.openssl];
    overrides = y: (x.overrides y) // {
      prePatch = ''
-        sed 's|libssl.so|${pkgs.openssl.out}/lib/libssl.so|' -i src/reload.lisp
+        sed 's|libssl.so|${pkgs.lib.getLib pkgs.openssl}/lib/libssl.so|' -i src/reload.lisp
      '';
    };
  };
--- a/pkgs/development/php-packages/composer/default.nix
+++ b/pkgs/development/php-packages/composer/default.nix
@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, makeWrapper, unzip, lib, php }:
 let
  pname = "composer";
-  version = "2.2.9";
+  version = "2.3.3";
 in
 mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://getcomposer.org/download/${version}/composer.phar";
-    sha256 = "sha256-SPn9ya2TkE/ullULRa4DpR9pcYUC7oVdqJS0rXHS3+A=";
+    sha256 = "sha256-1pMewrOLQb0K1i+dFXkI5miLrAkbvwvWphnBBnuSJAI=";
  };

  dontUnpack = true;
--- a/pkgs/development/php-packages/phpstan/default.nix
+++ b/pkgs/development/php-packages/phpstan/default.nix
@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, makeWrapper, lib, php }:
 let
  pname = "phpstan";
-  version = "1.5.0";
+  version = "1.5.3";
 in
 mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://github.com/phpstan/phpstan/releases/download/${version}/phpstan.phar";
-    sha256 = "sha256-dgsBpFnolIMrSwNHZ9+mSW1zMJ/RbvYIWBUksDiYeqE=";
+    sha256 = "sha256-tIVzXxOyHVz2AE0PjQdkQ+uevdSqsjBRIZQWVDwzuKg=";
  };

  dontUnpack = true;
--- a/pkgs/development/python-modules/asyncsleepiq/default.nix
+++ b/pkgs/development/python-modules/asyncsleepiq/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "asyncsleepiq";
-  version = "1.2.1";
+  version = "1.2.3";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-pIfEdNmtnwA+PE3lXVd7Qd8Igj+/aqZmuDqFs60PxgY=";
+    sha256 = "sha256-X+bJyzQxWJaS1/KNOE/3zQKSbwUpm9XN35HYf6s+BPs=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/atomman/default.nix
+++ b/pkgs/development/python-modules/atomman/default.nix
@ -1,4 +1,5 @@
 { lib
+, ase
 , buildPythonPackage
 , cython
 , datamodeldict
@ -7,17 +8,19 @@
 , numericalunits
 , numpy
 , pandas
+, phonopy
 , potentials
+, pymatgen
 , pytest
 , pythonOlder
+, requests
 , scipy
 , toolz
 , xmltodict
-, python
 }:

 buildPythonPackage rec {
-  version = "1.4.3";
+  version = "1.4.4";
  pname = "atomman";
  format = "setuptools";

@ -27,7 +30,7 @@ buildPythonPackage rec {
    owner = "usnistgov";
    repo = "atomman";
    rev = "v${version}";
-    sha256 = "sha256-is47O59Pjrh9tPC1Y2+DVVcHbxmcjUOFOVGnNHuURoM=";
+    hash = "sha256-iLAB0KMtrTCyGpx+81QfHDPVDhq8OA6CDL/ipVRpyo0=";
  };

  propagatedBuildInputs = [
@ -38,19 +41,24 @@ buildPythonPackage rec {
    numpy
    pandas
    potentials
+    requests
    scipy
    toolz
    xmltodict
  ];

  checkInputs = [
+    ase
+    phonopy
+    pymatgen
    pytest
  ];

  checkPhase = ''
    # pytestCheckHook doesn't work
-    py.test tests -k "not test_rootdir and not test_version \
-      and not test_atomic_mass and not imageflags"
+    pytest tests -k "not test_rootdir and not test_version \
+      and not test_atomic_mass and not imageflags" \
+      --ignore tests/plot/test_interpolate.py
  '';

  pythonImportsCheck = [
--- a/pkgs/development/python-modules/bitcoinlib/default.nix
+++ b/pkgs/development/python-modules/bitcoinlib/default.nix
@ -17,7 +17,7 @@ in buildPythonPackage rec {
  postPatch = ''
    substituteInPlace bitcoin/core/key.py --replace \
      "ctypes.util.find_library('ssl') or 'libeay32'" \
-      "'${openssl.out}/lib/libssl.${ext}'"
+      "'${lib.getLib openssl}/lib/libssl.${ext}'"
  '';

  meta = {
--- a/pkgs/development/python-modules/cloudflare/default.nix
+++ b/pkgs/development/python-modules/cloudflare/default.nix
@ -7,15 +7,19 @@
 , future
 , pyyaml
 , jsonlines
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "cloudflare";
-  version = "2.8.15";
+  version = "2.9.8";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1f47bd324f80e91487dea2c79be934b1dc612bcfa63e784dcf74c6a2f52a41cc";
+    hash = "sha256-rIIzwsGQidTRqE0eba7X/xicsMtWPxZ2PCGr6OUy+7U=";
  };

  propagatedBuildInputs = [
@ -29,12 +33,15 @@ buildPythonPackage rec {

  # no tests associated with package
  doCheck = false;
-  pythonImportsCheck = [ "CloudFlare" ];
+
+  pythonImportsCheck = [
+    "CloudFlare"
+  ];

  meta = with lib; {
    description = "Python wrapper for the Cloudflare v4 API";
    homepage = "https://github.com/cloudflare/python-cloudflare";
    license = licenses.mit;
-    maintainers = [ maintainers.costrouc ];
+    maintainers = with maintainers; [ costrouc ];
  };
 }
--- a/pkgs/development/python-modules/deep-translator/default.nix
+++ b/pkgs/development/python-modules/deep-translator/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "deep-translator";
-  version = "1.8.1";
+  version = "1.8.3";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-Oi5dzrC19PnlExCOgu+bT5n3/XwgJkDirzl8ra8w7Nw=";
+    sha256 = "sha256-9YTDvrm5Q8k5G7qDF05651IxMV1BeTcgIAMSxU/bwM0=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/dotmap/default.nix
+++ b/pkgs/development/python-modules/dotmap/default.nix
@ -2,24 +2,32 @@
 , buildPythonPackage
 , fetchPypi
 , pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "dotmap";
-  version = "1.3.26";
+  version = "1.3.27";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "cc87300f3a61d70f2bd18103ea2747dea846a2381a8321f43ce65cbd7afdfe3d";
+    hash = "sha256-gHCQIN8CIeF8TgHWeQu8GCRxK1aQFJJ/d7jZurxxMik=";
  };

  checkInputs = [
    pytestCheckHook
  ];

-  pytestFlagsArray = [ "dotmap/test.py" ];
+  pytestFlagsArray = [
+    "dotmap/test.py"
+  ];

-  pythonImportsCheck = [ "dotmap" ];
+  pythonImportsCheck = [
+    "dotmap"
+  ];

  meta = with lib; {
    description = "Python for dot-access dictionaries";
--- a/pkgs/development/python-modules/easygui/default.nix
+++ b/pkgs/development/python-modules/easygui/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "easygui";
-  version = "0.98.2";
+  version = "0.98.3";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "073f728ca88a77b74f404446fb8ec3004945427677c5618bd00f70c1b999fef2";
+    sha256 = "sha256-1lP/ee4fQvY7WgkPL5jOAjNdhq2JY7POJmGAXK/pmgQ=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "fastapi";
-  version = "0.75.0";
+  version = "0.75.1";
  format = "flit";

  disabled = pythonOlder "3.6";
@ -28,7 +28,7 @@ buildPythonPackage rec {
    owner = "tiangolo";
    repo = pname;
    rev = version;
-    sha256 = "sha256-LCdScvQUdwOM8Don/5n/49bKrivT+bkhqWcBNku4fso=";
+    sha256 = "sha256-tSZ5isMzDhDsuVNQdoYXG0IYkgCvdVdARtFXELNjTtk=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/glean-parser/default.nix
+++ b/pkgs/development/python-modules/glean-parser/default.nix
@ -15,7 +15,7 @@

 buildPythonPackage rec {
  pname = "glean-parser";
-  version = "5.1.1";
+  version = "5.1.2";
  format = "setuptools";

  disabled = pythonOlder "3.6";
@ -23,7 +23,7 @@ buildPythonPackage rec {
  src = fetchPypi {
    pname = "glean_parser";
    inherit version;
-    hash = "sha256-zUiF0buHBe0BaaeIRJcRoT/g+NhWv6XTuhCZ6WPrris=";
+    hash = "sha256-PjOMNUnrz0kDfYEXv5Ni/9RIHn4Yylle6NJOK1Rb3SY=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/idasen/default.nix
+++ b/pkgs/development/python-modules/idasen/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "idasen";
-  version = "0.8.2";
+  version = "0.8.3";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "newAM";
    repo = "idasen";
    rev = "v${version}";
-    hash = "sha256-s8CnYMUVl2VbGbVxICSaKH5DxTA+NP/zPX1z7vfMqi4=";
+    hash = "sha256-tjA7qgU3JYvwSdDH+aWrmKBX1Q9J5/UT7KjiTBxvKAE=";
  };

  nativeBuildInputs = [
@ -39,11 +39,6 @@ buildPythonPackage rec {
    pytest-asyncio
  ];

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'voluptuous = "^0.12"' 'voluptuous = "*"'
-  '';
-
  pythonImportsCheck = [
    "idasen"
  ];
--- a/pkgs/development/python-modules/kubernetes/default.nix
+++ b/pkgs/development/python-modules/kubernetes/default.nix
@ -55,7 +55,7 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  disabledTests = lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [
+  disabledTests = lib.optionals stdenv.isDarwin [
    # AssertionError: <class 'urllib3.poolmanager.ProxyManager'> != <class 'urllib3.poolmanager.Poolmanager'>
    "test_rest_proxycare"
  ];
--- a/pkgs/development/python-modules/libthumbor/default.nix
+++ b/pkgs/development/python-modules/libthumbor/default.nix
@ -4,26 +4,40 @@
 , django
 , six
 , pycrypto
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "libthumbor";
-  version = "2.0.1";
+  version = "2.0.2";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "ed4fe5f27f8f90e7285b7e6dce99c1b67d43a140bf370e989080b43d80ce25f0";
+    hash = "sha256-1PsiFZrTDVQqy8A3nkaM5LdPiBoriRgHkklTOiczN+g=";
  };

-  buildInputs = [ django ];
-  propagatedBuildInputs = [ six pycrypto ];
+  buildInputs = [
+    django
+  ];
+
+  propagatedBuildInputs = [
+    six
+    pycrypto
+  ];

  doCheck = false;

+  pythonImportsCheck = [
+    "libthumbor"
+  ];
+
  meta = with lib; {
-    description = "libthumbor is the python extension to thumbor";
+    description = "Python extension to thumbor";
    homepage = "https://github.com/heynemann/libthumbor";
    license = licenses.mit;
+    maintainers = with maintainers; [ ];
  };
-
 }
--- a/pkgs/development/python-modules/maestral/default.nix
+++ b/pkgs/development/python-modules/maestral/default.nix
@ -3,9 +3,23 @@
 , fetchFromGitHub
 , pythonOlder
 , python
-, click, desktop-notifier, dropbox, fasteners, keyring, keyrings-alt, packaging, pathspec, Pyro5, requests, setuptools, sdnotify, survey, watchdog
+, click
+, desktop-notifier
+, dropbox
+, fasteners
+, keyring
+, keyrings-alt
+, packaging
+, pathspec
+, Pyro5
+, requests
+, setuptools
+, sdnotify
+, survey
+, watchdog
 , importlib-metadata
 , pytestCheckHook
+, nixosTests
 }:

 buildPythonPackage rec {
@ -66,6 +80,8 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "maestral" ];

+  passthru.tests.maestral = nixosTests.maestral;
+
  meta = with lib; {
    description = "Open-source Dropbox client for macOS and Linux";
    license = licenses.mit;
--- a/pkgs/development/python-modules/pex/default.nix
+++ b/pkgs/development/python-modules/pex/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "pex";
-  version = "2.1.74";
+  version = "2.1.75";
  format = "flit";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-SyKOwESn+0pFtm2GBFcS+kzIuv5cNXcayTtI7OyFpQg=";
+    hash = "sha256-G5JE4/ZWZYo8Fpy3ZhIaWNzGfEkWb9qA9vL3UVTqf0Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/plaid-python/default.nix
+++ b/pkgs/development/python-modules/plaid-python/default.nix
@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "plaid-python";
-  version = "9.1.1";
+  version = "9.2.0";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-vHJ35MvMw3G1k/A2gifaE97GayoVEOQ9lR6yG6ZkzS4=";
+    hash = "sha256-3yFfANMkn8CXCheNHU77WGeYxPV4gs2jvOl/rV+/6vY=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/potentials/default.nix
+++ b/pkgs/development/python-modules/potentials/default.nix
@ -16,10 +16,11 @@
 , scipy
 , unidecode
 , xmltodict
+, yabadaba
 }:

 buildPythonPackage rec {
-  version = "0.3.2";
+  version = "0.3.3";
  pname = "potentials";
  format = "setuptools";

@ -27,7 +28,7 @@ buildPythonPackage rec {

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-u++ClAAc96u7k8w756sFR4oCtIOgERQ7foklxWWPprY=";
+    hash = "sha256-kj2RDls5ziCH+AF982h8TplZccwdcna3BQMoBXAbOHE=";
  };

  propagatedBuildInputs = [
@ -44,6 +45,7 @@ buildPythonPackage rec {
    scipy
    unidecode
    xmltodict
+    yabadaba
  ];

  # Project has no tests
--- a/pkgs/development/python-modules/proton-client/default.nix
+++ b/pkgs/development/python-modules/proton-client/default.nix
@ -34,7 +34,7 @@ buildPythonPackage rec {
  # but it is not working as intended.
  #patchPhase = ''
  #  substituteInPlace proton/srp/_ctsrp.py --replace \
-  #    "ctypes.cdll.LoadLibrary('libssl.so.10')" "'${openssl.out}/lib/libssl.so'"
+  #    "ctypes.cdll.LoadLibrary('libssl.so.10')" "'${lib.getLib openssl}/lib/libssl.so'"
  #'';
  # Regarding the issue above, I'm disabling tests for now
  doCheck = false;
--- a/pkgs/development/python-modules/py3status/default.nix
+++ b/pkgs/development/python-modules/py3status/default.nix
@ -24,11 +24,11 @@

 buildPythonPackage rec {
  pname = "py3status";
-  version = "3.42";
+  version = "3.43";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-2/YT36X4UvmmhiaxyJBtCKA3QuibYtReTS6MQ3YGV+c=";
+    sha256 = "sha256-H37Jcd7wZmDiCn7fk0SmlWYj46D3w/B9BdsEwqgEBjw=";
  };

  doCheck = false;
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@ -27,7 +27,7 @@ buildPythonPackage rec {

  buildInputs = [
    curl
-    openssl.out
+    openssl
  ];

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pymatgen/default.nix
+++ b/pkgs/development/python-modules/pymatgen/default.nix
@ -1,6 +1,7 @@
-{ lib, buildPythonPackage, fetchFromGitHub
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
 , cython
-, enum34
 , glibcLocales
 , matplotlib
 , monty
@ -11,10 +12,10 @@
 , plotly
 , pybtex
 , pydispatcher
+, pythonOlder
 , requests
 , ruamel-yaml
 , scipy
-, six
 , spglib
 , sympy
 , tabulate
@ -23,14 +24,16 @@

 buildPythonPackage rec {
  pname = "pymatgen";
-  version = "2022.2.7";
+  version = "2022.3.29";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.8";

-  # sdist doesn't include c files
  src = fetchFromGitHub {
    owner = "materialsproject";
    repo = "pymatgen";
    rev= "v${version}";
-    sha256 = "sha256-92Dxmo1Z9LR2caSOftIf1I6jeZmqDe3SqhhoCofWraw=";
+    hash = "sha256-B2piRWx9TfKlGTPOAAGsq2GxyfHIRBVFpk6dxES0WF0=";
  };

  nativeBuildInputs = [
@ -39,7 +42,6 @@ buildPythonPackage rec {
  ];

  propagatedBuildInputs = [
-    enum34
    matplotlib
    monty
    networkx
@ -52,16 +54,18 @@ buildPythonPackage rec {
    requests
    ruamel-yaml
    scipy
-    six
    spglib
    sympy
    tabulate
    uncertainties
  ];

-  # No tests in pypi tarball.
+  # Tests are not detected by pytest
  doCheck = false;
-  pythonImportsCheck = [ "pymatgen" ];
+
+  pythonImportsCheck = [
+    "pymatgen"
+  ];

  meta = with lib; {
    description = "A robust materials analysis code that defines core object representations for structures and molecules";
--- a/pkgs/development/python-modules/spacy-loggers/default.nix
+++ b/pkgs/development/python-modules/spacy-loggers/default.nix
@ -8,11 +8,11 @@

 buildPythonPackage rec {
  pname = "spacy-loggers";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-F9DiSbLmxlRsSfxlYaCmhfkajtvySlsrd1nq1EPHRlQ=";
+    sha256 = "sha256-511E9M+Z5nY9cTLKfIxCDgqSeQIioIvI654k6iwTU24=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/stripe/default.nix
+++ b/pkgs/development/python-modules/stripe/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "stripe";
-  version = "2.69.0";
+  version = "2.70.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-iDB4/FvTc34dBYDDAIMjxYbaNreuhHmle40WE0DTy58=";
+    hash = "sha256-7YiX9o5rrDOYzJmOtWNFUYQGMNZQTAAm/P0K2RyadKQ=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/telethon/default.nix
+++ b/pkgs/development/python-modules/telethon/default.nix
@ -12,7 +12,7 @@ buildPythonPackage rec {

  patchPhase = ''
    substituteInPlace telethon/crypto/libssl.py --replace \
-      "ctypes.util.find_library('ssl')" "'${openssl.out}/lib/libssl.so'"
+      "ctypes.util.find_library('ssl')" "'${lib.getLib openssl}/lib/libssl.so'"
  '';

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/thrift/default.nix
+++ b/pkgs/development/python-modules/thrift/default.nix
@ -6,11 +6,11 @@

 buildPythonPackage rec {
  pname = "thrift";
-  version = "0.15.0";
+  version = "0.16.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "87c8205a71cf8bbb111cb99b1f7495070fbc9cabb671669568854210da5b3e29";
+    sha256 = "sha256-K1tkiPze0h+dMSqiPJ/2oBldD2ribdvVrZ4+Jd/BRAg=";
  };

  propagatedBuildInputs = [ six ];
--- a/Show More
+++ b/Show More