Merge branch 'staging-next' into staging

- boost 171 removed on staging-next - re-generated node-packages.nix ; Conflicts: ; pkgs/development/java-modules/m2install.nix ; pkgs/development/node-packages/node-packages.nix ; pkgs/top-level/all-packages.nix
2021-08-22 01:13:41 +02:00 · 2021-08-22 01:13:41 +02:00 · 7a04c2ad68
commit 7a04c2ad68
parent 7b54aee7d5 1c99cc57ba
403 changed files with 16117 additions and 3892 deletions
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@ -15,11 +15,12 @@ Reviewing guidelines: https://nixos.org/manual/nixpkgs/unstable/#chap-reviewing-

 <!-- Please check what applies. Note that these are not hard requirements but merely serve as information for reviewers. -->

- [ ] Tested using sandboxing ([nix.useSandbox](https://nixos.org/nixos/manual/options.html#opt-nix.useSandbox) on NixOS, or option `sandbox` in [`nix.conf`](https://nixos.org/nix/manual/#sec-conf-file) on non-NixOS linux)
 - Built on platform(s)
-   - [ ] NixOS
-   - [ ] macOS
-   - [ ] other Linux distributions
+  - [ ] x86_64-linux
+  - [ ] aarch64-linux
+  - [ ] x86_64-darwin
+  - [ ] aarch64-darwin
+- [ ] For non-Linux: Is `sandbox = true` set in `nix.conf`? (See [Nix manual](https://nixos.org/manual/nix/stable/#sec-conf-file))
 - [ ] Tested via one or more NixOS test(s) if existing and applicable for the change (look inside [nixos/tests](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests))
 - [ ] Tested compilation of all packages that depend on this change using `nix-shell -p nixpkgs-review --run "nixpkgs-review wip"`
 - [ ] Tested execution of all binary files (usually in `./result/bin/`)
--- a/doc/languages-frameworks/index.xml
+++ b/doc/languages-frameworks/index.xml
@ -20,9 +20,9 @@
 <xi:include href="idris.section.xml" />
 <xi:include href="ios.section.xml" />
 <xi:include href="java.section.xml" />
+ <xi:include href="javascript.section.xml" />
 <xi:include href="lua.section.xml" />
 <xi:include href="maven.section.xml" />
- <xi:include href="node.section.xml" />
 <xi:include href="ocaml.section.xml" />
 <xi:include href="perl.section.xml" />
 <xi:include href="php.section.xml" />
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@ -0,0 +1,203 @@
+# Javascript {#language-javascript}
+
+## Introduction {#javascript-introduction}
+
+This contains instructions on how to package javascript applications. For instructions on how to add a cli package from npm please consult the #node.js section
+
+The various tools available will be listed in the [tools-overview](#javascript-tools-overview). Some general principles for packaging will follow. Finally some tool specific instructions will be given.
+
+## Tools overview {#javascript-tools-overview}
+
+## General principles {#javascript-general-principles}
+
+The following principles are given in order of importance with potential exceptions.
+
+### Try to use the same node version used upstream {#javascript-upstream-node-version}
+
+It is often not documented which node version is used upstream, but if it is, try to use the same version when packaging.
+
+This can be a problem if upstream is using the latest and greatest and you are trying to use an earlier version of node. Some cryptic errors regarding V8 may appear.
+
+An exception to this:
+
+### Try to respect the package manager originally used by upstream (and use the upstream lock file) {#javascript-upstream-package-manager}
+
+A lock file (package-lock.json, yarn.lock...) is supposed to make reproducible installations of node_modules for each tool.
+
+Guidelines of package managers, recommend to commit those lock files to the repos. If a particular lock file is present, it is a strong indication of which package manager is used upstream.
+
+It's better to try to use a nix tool that understand the lock file. Using a different tool might give you hard to understand error because different packages have been installed. An example of problems that could arise can be found [here](https://github.com/NixOS/nixpkgs/pull/126629). Upstream uses npm, but this is an attempt to package it with yarn2nix (that uses yarn.lock)
+
+Using a different tool forces to commit a lock file to the repository. Those files are fairly large, so when packaging for nixpkgs, this approach does not scale well.
+
+Exceptions to this rule are:
+
+- when you encounter one of the bugs from a nix tool. In each of the tool specific instructions, known problems will be detailed. If you have a problem with a particular tool, then it's best to try another tool, even if this means you will have to recreate a lock file and commit it to nixpkgs. In general yarn2nix has less known problems and so a simple search in nixpkgs will reveal many yarn.lock files commited
+- Some lock files contain particular version of a package that has been pulled off npm for some reason. In that case, you can recreate upstream lock (by removing the original and `npm install`, `yarn`, ...) and commit this to nixpkgs.
+- The only tool that supports workspaces (a feature of npm that helps manage sub-directories with different package.json from a single top level package.json) is yarn2nix. If upstream has workspaces you should try yarn2nix.
+
+### Try to use upstream package.json {#javascript-upstream-package-json}
+
+Exceptions to this rule are
+
+- Sometimes the upstream repo assumes some dependencies be installed globally. In that case you can add them manually to the upstream package.json (`yarn add xxx` or `npm install xxx`, ...). Dependencies that are installed locally can be executed with `npx` for cli tools. (e.g. `npx postcss ...`, this is how you can call those dependencies in the phases).
+- Sometimes there is a version conflict between some dependency requirements. In that case you can fix a version (by removing the `^`).
+- Sometimes the script defined in the package.json does not work as is. Some scripts for example use cli tools that might not be available, or cd in directory with a different package.json (for workspaces notably). In that case, it's perfectly fine to look at what the particular script is doing and break this down in the phases. In the build script you can see `build:*` calling in turns several other build scripts like `build:ui` or `build:server`. If one of those fails, you can try to separate those into:
+
+```Shell
+yarn build:ui
+yarn build:server
+# OR
+npm run build:ui
+npm run build:server
+```
+
+when you need to override a package.json. It's nice to use the one from the upstream src and do some explicit override. Here is an example.
+
+```nix
+patchedPackageJSON = final.runCommand "package.json" { } ''
+  ${jq}/bin/jq '.version = "0.4.0" |
+    .devDependencies."@jsdoc/cli" = "^0.2.5"
+    ${sonar-src}/package.json > $out
+'';
+```
+
+you will still need to commit the modified version of the lock files, but at least the overrides are explicit for everyone to see.
+
+### Using node_modules directly {#javascript-using-node_modules}
+
+each tool has an abstraction to just build the node_modules (dependencies) directory. you can always use the stdenv.mkDerivation with the node_modules to build the package (symlink the node_modules directory and then use the package build command). the node_modules abstraction can be also used to build some web framework frontends. For an example of this see how [plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/web-apps/plausible/default.nix) is built. mkYarnModules to make the derivation containing node_modules. Then when building the frontend you can just symlink the node_modules directory
+
+## javascript packages inside nixpkgs {#javascript-packages-nixpkgs}
+
+The `pkgs/development/node-packages` folder contains a generated collection of
+[NPM packages](https://npmjs.com/) that can be installed with the Nix package
+manager.
+
+As a rule of thumb, the package set should only provide _end user_ software
+packages, such as command-line utilities. Libraries should only be added to the
+package set if there is a non-NPM package that requires it.
+
+When it is desired to use NPM libraries in a development project, use the
+`node2nix` generator directly on the `package.json` configuration file of the
+project.
+
+The package set provides support for the official stable Node.js versions.
+The latest stable LTS release in `nodePackages`, as well as the latest stable
+Current release in `nodePackages_latest`.
+
+If your package uses native addons, you need to examine what kind of native
+build system it uses. Here are some examples:
+
+- `node-gyp`
+- `node-gyp-builder`
+- `node-pre-gyp`
+
+After you have identified the correct system, you need to override your package
+expression while adding in build system as a build input. For example, `dat`
+requires `node-gyp-build`, so [we override](https://github.com/NixOS/nixpkgs/blob/32f5e5da4a1b3f0595527f5195ac3a91451e9b56/pkgs/development/node-packages/default.nix#L37-L40) its expression in [`default.nix`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/node-packages/default.nix):
+
+```nix
+    dat = super.dat.override {
+      buildInputs = [ self.node-gyp-build pkgs.libtool pkgs.autoconf pkgs.automake ];
+      meta.broken = since "12";
+    };
+```
+
+To add a package from NPM to nixpkgs:
+
+1.  Modify `pkgs/development/node-packages/node-packages.json` to add, update
+    or remove package entries to have it included in `nodePackages` and
+    `nodePackages_latest`.
+2.  Run the script: `cd pkgs/development/node-packages && ./generate.sh`.
+3.  Build your new package to test your changes:
+    `cd /path/to/nixpkgs && nix-build -A nodePackages.<new-or-updated-package>`.
+    To build against the latest stable Current Node.js version (e.g. 14.x):
+    `nix-build -A nodePackages_latest.<new-or-updated-package>`
+4.  Add and commit all modified and generated files.
+
+For more information about the generation process, consult the
+[README.md](https://github.com/svanderburg/node2nix) file of the `node2nix`
+tool.
+
+## Tool specific instructions {#javascript-tool-specific}
+
+### node2nix {#javascript-node2nix}
+
+#### Preparation {#javascript-node2nix-preparation}
+
+you will need to generate a nix expression for the dependencies
+
+- don't forget the `-l package-lock.json` if there is a lock file
+- Most probably you will need the `--development` to include the `devDependencies`
+
+so the command will most likely be
+`node2nix --developmennt -l package-lock.json`
+
+[link to the doc in the repo](https://github.com/svanderburg/node2nix)
+
+#### Pitfalls {#javascript-node2nix-pitfalls}
+
+- if upstream package.json does not have a "version" attribute, node2nix will crash. You will need to add it like shown in [the package.json section](#javascript-upstream-package-json)
+- node2nix has some [bugs](https://github.com/svanderburg/node2nix/issues/238). related to working with lock files from npm distributed with nodejs-16_x
+- node2nix does not like missing packages from npm. If you see something like `Cannot resolve version: vue-loader-v16@undefined` then you might want to try another tool. The package might have been pulled off of npm.
+
+### yarn2nix {#javascript-yarn2nix}
+
+#### Preparation {#javascript-yarn2nix-preparation}
+
+you will need at least a yarn.lock and yarn.nix file
+
+- generate a yarn.lock in upstream if it is not already there
+- `yarn2nix > yarn.nix` will generate the dependencies in a nix format
+
+#### mkYarnPackage {#javascript-yarn2nix-mkYarnPackage}
+
+this will by default try to generate a binary. For package only generating static assets (Svelte, Vue, React...), you will need to explicitely override the build step with your instructions. It's important to use the `--offline` flag. For example if you script is `"build": "something"` in package.json use
+
+```nix
+buildPhase = ''
+  yarn build --offline
+'';
+```
+
+The dist phase is also trying to build a binary, the only way to override it is with
+
+```nix
+distPhase = "true";
+```
+
+the configure phase can sometimes fail because it tries to be too clever.
+One common override is
+
+```nix
+configurePhase = "ln -s $node_modules node_modules";
+```
+
+#### mkYarnModules {#javascript-yarn2nix-mkYarnModules}
+
+this will generate a derivation including the node_modules. If you have to build a derivation for an integrated web framework (rails, phoenix..), this is probably the easiest way. [Plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/web-apps/plausible/default.nix#L39) offers a good example of how to do this.
+
+#### Pitfalls {#javascript-yarn2nix-pitfalls}
+
+- if version is missing from upstream package.json, yarn will silently install nothing. In that case, you will need to override package.json as shown in the [package.json section](#javascript-upstream-package-json)
+
+## Outside of nixpkgs {#javascript-outside-nixpkgs}
+
+There are some other options available that can't be used inside nixpkgs. Those other options are written in nix. Importing them in nixpkgs will require moving the source code into nixpkgs. Using [Import From Derivation](https://nixos.wiki/wiki/Import_From_Derivation) is not allowed in hydra at present. If you are packaging something outside nixpkgs, those can be considered
+
+### npmlock2nix {#javascript-npmlock2nix}
+
+[npmlock2nix](https://github.com/nix-community/npmlock2nix) aims at building node_modules without code generation. It hasn't reached v1 yet, the api might be suject to change.
+
+#### Pitfalls {#javascript-npmlock2nix-pitfalls}
+
+- there are some [problems with npm v7](https://github.com/tweag/npmlock2nix/issues/45).
+
+### nix-npm-buildpackage {#javascript-nix-npm-buildpackage}
+
+[nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage) aims at building node_modules without code generation. It hasn't reached v1 yet, the api might change. It supports both package-lock.json and yarn.lock.
+
+#### Pitfalls {#javascript-nix-npm-buildpackage-pitfalls}
+
+- there are some [problems with npm v7](https://github.com/serokell/nix-npm-buildpackage/issues/33).
--- a/doc/languages-frameworks/node.section.md
+++ b/doc/languages-frameworks/node.section.md
@ -1,51 +0,0 @@
-# Node.js {#node.js}
-
-The `pkgs/development/node-packages` folder contains a generated collection of
-[NPM packages](https://npmjs.com/) that can be installed with the Nix package
-manager.
-
-As a rule of thumb, the package set should only provide *end user* software
-packages, such as command-line utilities. Libraries should only be added to the
-package set if there is a non-NPM package that requires it.
-
-When it is desired to use NPM libraries in a development project, use the
-`node2nix` generator directly on the `package.json` configuration file of the
-project.
-
-The package set provides support for the official stable Node.js versions.
-The latest stable LTS release in `nodePackages`, as well as the latest stable
-Current release in `nodePackages_latest`.
-
-If your package uses native addons, you need to examine what kind of native
-build system it uses. Here are some examples:
-
-* `node-gyp`
-* `node-gyp-builder`
-* `node-pre-gyp`
-
-After you have identified the correct system, you need to override your package
-expression while adding in build system as a build input. For example, `dat`
-requires `node-gyp-build`, so [we override](https://github.com/NixOS/nixpkgs/blob/32f5e5da4a1b3f0595527f5195ac3a91451e9b56/pkgs/development/node-packages/default.nix#L37-L40) its expression in [`default.nix`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/node-packages/default.nix):
-
-```nix
-    dat = super.dat.override {
-      buildInputs = [ self.node-gyp-build pkgs.libtool pkgs.autoconf pkgs.automake ];
-      meta.broken = since "12";
-    };
-```
-
-To add a package from NPM to nixpkgs:
-
- 1. Modify `pkgs/development/node-packages/node-packages.json` to add, update
-    or remove package entries to have it included in `nodePackages` and
-    `nodePackages_latest`.
- 2. Run the script: `cd pkgs/development/node-packages && ./generate.sh`.
- 3. Build your new package to test your changes:
-    `cd /path/to/nixpkgs && nix-build -A nodePackages.<new-or-updated-package>`.
-    To build against the latest stable Current Node.js version (e.g. 14.x):
-    `nix-build -A nodePackages_latest.<new-or-updated-package>`
- 4. Add and commit all modified and generated files.
-
-For more information about the generation process, consult the
-[README.md](https://github.com/svanderburg/node2nix) file of the `node2nix`
-tool.
--- a/doc/languages-frameworks/perl.section.md
+++ b/doc/languages-frameworks/perl.section.md
@ -122,7 +122,7 @@ ImageExifTool = buildPerlPackage {
  };

  buildInputs = lib.optional stdenv.isDarwin shortenPerlShebang;
-  postInstall = lib.optional stdenv.isDarwin ''
+  postInstall = lib.optionalString stdenv.isDarwin ''
    shortenPerlShebang $out/bin/exiftool
  '';
 };
--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@ -114,6 +114,10 @@ For details, see [Licenses](#sec-meta-license).

 A list of the maintainers of this Nix expression. Maintainers are defined in [`nixpkgs/maintainers/maintainer-list.nix`](https://github.com/NixOS/nixpkgs/blob/master/maintainers/maintainer-list.nix). There is no restriction to becoming a maintainer, just add yourself to that list in a separate commit titled “maintainers: add alice”, and reference maintainers with `maintainers = with lib.maintainers; [ alice bob ]`.

+### `mainProgram` {#var-meta-mainProgram}
+
+The name of the main binary for the package. This effects the binary `nix run` executes and falls back to the name of the package. Example: `"rg"`
+
 ### `priority` {#var-meta-priority}

 The *priority* of the package, used by `nix-env` to resolve file name conflicts between packages. See the Nix manual page for `nix-env` for details. Example: `"10"` (a low-priority package).
--- a/lib/systems/inspect.nix
+++ b/lib/systems/inspect.nix
@ -56,6 +56,7 @@ rec {
    isNone         = { kernel = kernels.none; };

    isAndroid      = [ { abi = abis.android; } { abi = abis.androideabi; } ];
+    isGnu          = with abis; map (a: { abi = a; }) [ gnuabi64 gnu gnueabi gnueabihf ];
    isMusl         = with abis; map (a: { abi = a; }) [ musl musleabi musleabihf ];
    isUClibc       = with abis; map (a: { abi = a; }) [ uclibc uclibceabi uclibceabihf ];

--- a/lib/systems/platforms.nix
+++ b/lib/systems/platforms.nix
@ -233,7 +233,7 @@ rec {
    };
  };

-  scaleway-c1 = lib.recursiveUpdate armv7l-hf-multiplatform {
+  scaleway-c1 = armv7l-hf-multiplatform // {
    gcc = {
      cpu = "cortex-a9";
      fpu = "vfpv3";
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3477,6 +3477,12 @@
      fingerprint = "2F6C 930F D3C4 7E38 6AFA  4EB4 E23C D2DD 36A4 397F";
    }];
  };
+  fabiangd = {
+    email = "fabian.g.droege@gmail.com";
+    name = "Fabian G. Dröge";
+    github = "FabianGD";
+    githubId = 40316600;
+  };
  fabianhauser = {
    email = "fabian.nixos@fh2.ch";
    github = "fabianhauser";
@ -4241,6 +4247,16 @@
    githubId = 147689;
    name = "Hans-Christian Esperer";
  };
+  hdhog = {
+    name = "Serg Larchenko";
+    email = "hdhog@hdhog.ru";
+    github = "hdhog";
+    githubId = 386666;
+    keys = [{
+      longkeyid = "rsa496/952EACB76703BA63";
+      fingerprint = "A25F 6321 AAB4 4151 4085  9924 952E ACB7 6703 BA63";
+    }];
+  };
  hectorj = {
    email = "hector.jusforgues+nixos@gmail.com";
    github = "hectorj";
@ -5352,7 +5368,7 @@
  };
  juaningan = {
    email = "juaningan@gmail.com";
-    github = "juaningan";
+    github = "uningan";
    githubId = 810075;
    name = "Juan Rodal";
  };
@ -5662,6 +5678,16 @@
    githubId = 148352;
    name = "Jim Fowler";
  };
+  kittywitch = {
+    email = "kat@kittywit.ch";
+    github = "kittywitch";
+    githubId = 67870215;
+    name = "kat witch";
+    keys = [{
+      longkeyid = "rsa4096/0x7248991EFA8EFBEE";
+      fingerprint = "01F5 0A29 D4AA 9117 5A11  BDB1 7248 991E FA8E FBEE";
+     }];
+  };
  kiwi = {
    email = "envy1988@gmail.com";
    github = "Kiwi";
@ -6650,6 +6676,16 @@
    githubId = 775189;
    name = "Jordi Masip";
  };
+  matdsoupe = {
+    github = "matdsoupe";
+    githubId = 44469426;
+    name = "Matheus de Souza Pessanha";
+    email = "matheus_pessanha2001@outlook.com";
+    keys = [{
+      longkeyid = "rsa4096/0x2671964AB1E06A08";
+      fingerprint = "2F32 CFEF E11A D73B A740  FA47 2671 964A B1E0 6A08";
+    }];
+  };
  matejc = {
    email = "cotman.matej@gmail.com";
    github = "matejc";
@ -6856,16 +6892,6 @@
      fingerprint = "D709 03C8 0BE9 ACDC 14F0  3BFB 77BF E531 397E DE94";
    }];
  };
-  mdsp = {
-    github = "Mdsp9070";
-    githubId = 44469426;
-    name = "Matheus de Souza Pessanha";
-    email = "matheus_pessanha2001@outlook.com";
-    keys = [{
-      longkeyid = "rsa4096/6DFD656220A3B849";
-      fingerprint = "2D4D 488F 17FB FF75 664E  C016 6DFD 6562 20A3 B849";
-    }];
-  };
  meatcar = {
    email = "nixpkgs@denys.me";
    github = "meatcar";
@ -11806,6 +11832,12 @@
    githubId = 26011724;
    name = "Burim Augustin Berisa";
  };
+  yl3dy = {
+    email = "aleksandr.kiselyov@gmail.com";
+    github = "yl3dy";
+    githubId = 1311192;
+    name = "Alexander Kiselyov";
+  };
  yochai = {
    email = "yochai@titat.info";
    github = "yochai";
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@ -779,6 +779,16 @@ Superuser created successfully.
          group.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The fontconfig service’s dpi option has been removed.
+          Fontconfig should use Xft settings by default so there’s no
+          need to override one value in multiple places. The user can
+          set DPI via ~/.Xresources properly, or at the system level per
+          monitor, or as a last resort at the system level with
+          <literal>services.xserver.dpi</literal>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The <literal>yambar</literal> package has been split into
@ -884,6 +894,14 @@ Superuser created successfully.
          New In Python 3.9 post</link> for more information.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>qtile</literal> hase been updated from
+          <quote>0.16.0</quote> to <quote>0.18.0</quote>, please check
+          <link xlink:href="https://github.com/qtile/qtile/blob/master/CHANGELOG">qtile
+          changelog</link> for changes.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The <literal>claws-mail</literal> package now references the
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@ -223,6 +223,10 @@ subsonic-compatible api. Available as [navidrome](#opt-services.navidrome.enable

 - The `openrazer` and `openrazer-daemon` packages as well as the `hardware.openrazer` module now require users to be members of the `openrazer` group instead of `plugdev`. With this change, users no longer need be granted the entire set of `plugdev` group permissions, which can include permissions other than those required by `openrazer`. This is desirable from a security point of view. The setting [`harware.openrazer.users`](options.html#opt-services.hardware.openrazer.users) can be used to add users to the `openrazer` group.

+- The fontconfig service's dpi option has been removed.
+  Fontconfig should use Xft settings by default so there's no need to override one value in multiple places.
+  The user can set DPI via ~/.Xresources properly, or at the system level per monitor, or as a last resort at the system level with `services.xserver.dpi`.
+
 - The `yambar` package has been split into `yambar` and `yambar-wayland`, corresponding to the xorg and wayland backend respectively. Please switch to `yambar-wayland` if you are on wayland.

 - The `services.minio` module gained an additional option `consoleAddress`, that
@ -253,6 +257,8 @@ To be able to access the web UI this port needs to be opened in the firewall.

 - `python3` now defaults to Python 3.9. Python 3.9 introduces many deprecation warnings, please look at the [What's New In Python 3.9 post](https://docs.python.org/3/whatsnew/3.9.html) for more information.

+- `qtile` hase been updated from '0.16.0' to '0.18.0', please check [qtile changelog](https://github.com/qtile/qtile/blob/master/CHANGELOG) for changes.
+
 - The `claws-mail` package now references the new GTK+ 3 release branch, major version 4. To use the GTK+ 2 releases, one can install the `claws-mail-gtk2` package.

 - The wordpress module provides a new interface which allows to use different webservers with the new option [`services.wordpress.webserver`](options.html#opt-services.wordpress.webserver).  Currently `httpd` and `nginx` are supported. The definitions of wordpress sites should now be set in [`services.wordpress.sites`](options.html#opt-services.wordpress.sites).
--- a/nixos/lib/test-driver/test-driver.py
+++ b/nixos/lib/test-driver/test-driver.py
@ -89,9 +89,7 @@ CHAR_TO_KEY = {
    ")": "shift-0x0B",
 }

-# Forward references
-log: "Logger"
-machines: "List[Machine]"
+global log, machines, test_script


 def eprint(*args: object, **kwargs: Any) -> None:
@ -103,7 +101,6 @@ def make_command(args: list) -> str:


 def create_vlan(vlan_nr: str) -> Tuple[str, str, "subprocess.Popen[bytes]", Any]:
-    global log
    log.log("starting VDE switch for network {}".format(vlan_nr))
    vde_socket = tempfile.mkdtemp(
        prefix="nixos-test-vde-", suffix="-vde{}.ctl".format(vlan_nr)
@ -246,6 +243,9 @@ def _perform_ocr_on_screenshot(


 class Machine:
+    def __repr__(self) -> str:
+        return f"<Machine '{self.name}'>"
+
    def __init__(self, args: Dict[str, Any]) -> None:
        if "name" in args:
            self.name = args["name"]
@ -910,29 +910,25 @@ class Machine:


 def create_machine(args: Dict[str, Any]) -> Machine:
-    global log
    args["log"] = log
    return Machine(args)


 def start_all() -> None:
-    global machines
    with log.nested("starting all VMs"):
        for machine in machines:
            machine.start()


 def join_all() -> None:
-    global machines
    with log.nested("waiting for all VMs to finish"):
        for machine in machines:
            machine.wait_for_shutdown()


 def run_tests(interactive: bool = False) -> None:
-    global machines
    if interactive:
-        ptpython.repl.embed(globals(), locals())
+        ptpython.repl.embed(test_symbols(), {})
    else:
        test_script()
        # TODO: Collect coverage data
@ -942,12 +938,10 @@ def run_tests(interactive: bool = False) -> None:


 def serial_stdout_on() -> None:
-    global log
    log._print_serial_logs = True


 def serial_stdout_off() -> None:
-    global log
    log._print_serial_logs = False


@ -989,6 +983,39 @@ def subtest(name: str) -> Iterator[None]:
    return False


+def _test_symbols() -> Dict[str, Any]:
+    general_symbols = dict(
+        start_all=start_all,
+        test_script=globals().get("test_script"),  # same
+        machines=globals().get("machines"),  # without being initialized
+        log=globals().get("log"),  # extracting those symbol keys
+        os=os,
+        create_machine=create_machine,
+        subtest=subtest,
+        run_tests=run_tests,
+        join_all=join_all,
+        retry=retry,
+        serial_stdout_off=serial_stdout_off,
+        serial_stdout_on=serial_stdout_on,
+        Machine=Machine,  # for typing
+    )
+    return general_symbols
+
+
+def test_symbols() -> Dict[str, Any]:
+
+    general_symbols = _test_symbols()
+
+    machine_symbols = {m.name: machines[idx] for idx, m in enumerate(machines)}
+    print(
+        "additionally exposed symbols:\n    "
+        + ", ".join(map(lambda m: m.name, machines))
+        + ",\n    "
+        + ", ".join(list(general_symbols.keys()))
+    )
+    return {**general_symbols, **machine_symbols}
+
+
 if __name__ == "__main__":
    arg_parser = argparse.ArgumentParser(prog="nixos-test-driver")
    arg_parser.add_argument(
@ -1028,12 +1055,9 @@ if __name__ == "__main__":
    )

    args = arg_parser.parse_args()
-    global test_script
    testscript = pathlib.Path(args.testscript).read_text()

-    def test_script() -> None:
-        with log.nested("running the VM test script"):
-            exec(testscript, globals())
+    global log, machines, test_script

    log = Logger()

@ -1062,6 +1086,11 @@ if __name__ == "__main__":
                process.terminate()
        log.close()

+    def test_script() -> None:
+        with log.nested("running the VM test script"):
+            symbols = test_symbols()  # call eagerly
+            exec(testscript, symbols, None)
+
    interactive = args.interactive or (not bool(testscript))
    tic = time.time()
    run_tests(interactive)
--- a/nixos/lib/testing-python.nix
+++ b/nixos/lib/testing-python.nix
@ -42,7 +42,9 @@ rec {
        python <<EOF
        from pydoc import importfile
        with open('driver-symbols', 'w') as fp:
-          fp.write(','.join(dir(importfile('${testDriverScript}'))))
+          t = importfile('${testDriverScript}')
+          test_symbols = t._test_symbols()
+          fp.write(','.join(test_symbols.keys()))
        EOF
      '';

--- a/nixos/modules/config/fonts/fontconfig.nix
+++ b/nixos/modules/config/fonts/fontconfig.nix
@ -78,14 +78,6 @@ let
        </edit>
      </match>

-      ${optionalString (cfg.dpi != 0) ''
-      <match target="pattern">
-        <edit name="dpi" mode="assign">
-          <double>${toString cfg.dpi}</double>
-        </edit>
-      </match>
-      ''}
-
    </fontconfig>
  '';

@ -237,6 +229,7 @@ in
    (mkRemovedOptionModule [ "fonts" "fontconfig" "hinting" "style" ] "")
    (mkRemovedOptionModule [ "fonts" "fontconfig" "forceAutohint" ] "")
    (mkRemovedOptionModule [ "fonts" "fontconfig" "renderMonoTTFAsBitmap" ] "")
+    (mkRemovedOptionModule [ "fonts" "fontconfig" "dpi" ] "Use display server-specific options")
  ] ++ lib.forEach [ "enable" "substitutions" "preset" ]
     (opt: lib.mkRemovedOptionModule [ "fonts" "fontconfig" "ultimate" "${opt}" ] ''
       The fonts.fontconfig.ultimate module and configuration is obsolete.
@ -282,15 +275,6 @@ in
          '';
        };

-        dpi = mkOption {
-          type = types.int;
-          default = 0;
-          description = ''
-            Force DPI setting. Setting to <literal>0</literal> disables DPI
-            forcing; the DPI detected for the display will be used.
-          '';
-        };
-
        localConf = mkOption {
          type = types.lines;
          default = "";
--- a/nixos/modules/config/system-environment.nix
+++ b/nixos/modules/config/system-environment.nix
@ -65,42 +65,40 @@ in
  };

  config = {
+    environment.etc."pam/environment".text = let
+      suffixedVariables =
+        flip mapAttrs cfg.profileRelativeSessionVariables (envVar: suffixes:
+          flip concatMap cfg.profiles (profile:
+            map (suffix: "${profile}${suffix}") suffixes
+          )
+        );

-    system.build.pamEnvironment =
-      let
-        suffixedVariables =
-          flip mapAttrs cfg.profileRelativeSessionVariables (envVar: suffixes:
-            flip concatMap cfg.profiles (profile:
-              map (suffix: "${profile}${suffix}") suffixes
-            )
-          );
+      # We're trying to use the same syntax for PAM variables and env variables.
+      # That means we need to map the env variables that people might use to their
+      # equivalent PAM variable.
+      replaceEnvVars = replaceStrings ["$HOME" "$USER"] ["@{HOME}" "@{PAM_USER}"];

-        # We're trying to use the same syntax for PAM variables and env variables.
-        # That means we need to map the env variables that people might use to their
-        # equivalent PAM variable.
-        replaceEnvVars = replaceStrings ["$HOME" "$USER"] ["@{HOME}" "@{PAM_USER}"];
+      pamVariable = n: v:
+        ''${n}   DEFAULT="${concatStringsSep ":" (map replaceEnvVars (toList v))}"'';

-        pamVariable = n: v:
-          ''${n}   DEFAULT="${concatStringsSep ":" (map replaceEnvVars (toList v))}"'';
-
-        pamVariables =
-          concatStringsSep "\n"
-          (mapAttrsToList pamVariable
-          (zipAttrsWith (n: concatLists)
-            [
-              # Make sure security wrappers are prioritized without polluting
-              # shell environments with an extra entry. Sessions which depend on
-              # pam for its environment will otherwise have eg. broken sudo. In
-              # particular Gnome Shell sometimes fails to source a proper
-              # environment from a shell.
-              { PATH = [ config.security.wrapperDir ]; }
-
-              (mapAttrs (n: toList) cfg.sessionVariables)
-              suffixedVariables
-            ]));
-      in
-        pkgs.writeText "pam-environment" "${pamVariables}\n";
+      pamVariables =
+        concatStringsSep "\n"
+        (mapAttrsToList pamVariable
+        (zipAttrsWith (n: concatLists)
+          [
+            # Make sure security wrappers are prioritized without polluting
+            # shell environments with an extra entry. Sessions which depend on
+            # pam for its environment will otherwise have eg. broken sudo. In
+            # particular Gnome Shell sometimes fails to source a proper
+            # environment from a shell.
+            { PATH = [ config.security.wrapperDir ]; }

+            (mapAttrs (n: toList) cfg.sessionVariables)
+            suffixedVariables
+          ]));
+    in ''
+      ${pamVariables}
+    '';
  };

 }
--- a/nixos/modules/hardware/all-firmware.nix
+++ b/nixos/modules/hardware/all-firmware.nix
@ -62,7 +62,7 @@ in {
        zd1211fw
        alsa-firmware
        sof-firmware
-        openelec-dvb-firmware
+        libreelec-dvb-firmware
      ] ++ optional (pkgs.stdenv.hostPlatform.isAarch32 || pkgs.stdenv.hostPlatform.isAarch64) raspberrypiWirelessFirmware
        ++ optionals (versionOlder config.boot.kernelPackages.kernel.version "4.13") [
        rtl8723bs-firmware
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -767,6 +767,7 @@
  ./services/networking/namecoind.nix
  ./services/networking/nar-serve.nix
  ./services/networking/nat.nix
+  ./services/networking/nats.nix
  ./services/networking/ndppd.nix
  ./services/networking/nebula.nix
  ./services/networking/networkmanager.nix
@ -995,7 +996,7 @@
  ./services/web-apps/youtrack.nix
  ./services/web-apps/zabbix.nix
  ./services/web-servers/apache-httpd/default.nix
-  ./services/web-servers/caddy.nix
+  ./services/web-servers/caddy/default.nix
  ./services/web-servers/darkhttpd.nix
  ./services/web-servers/fcgiwrap.nix
  ./services/web-servers/hitch/default.nix
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@ -475,7 +475,7 @@ let

          # Session management.
          ${optionalString cfg.setEnvironment ''
-            session required pam_env.so conffile=${config.system.build.pamEnvironment} readenv=0
+            session required pam_env.so conffile=/etc/pam/environment readenv=0
          ''}
          session required pam_unix.so
          ${optionalString cfg.setLoginUid
--- a/nixos/modules/services/mail/dovecot.nix
+++ b/nixos/modules/services/mail/dovecot.nix
@ -467,10 +467,6 @@ in
    ];

    assertions = [
-      {
-        assertion = intersectLists cfg.protocols [ "pop3" "imap" ] != [];
-        message = "dovecot needs at least one of the IMAP or POP3 listeners enabled";
-      }
      {
        assertion = (cfg.sslServerCert == null) == (cfg.sslServerKey == null)
        && (cfg.sslCACert != null -> !(cfg.sslServerCert == null || cfg.sslServerKey == null));
--- a/nixos/modules/services/networking/nats.nix
+++ b/nixos/modules/services/networking/nats.nix
@ -0,0 +1,159 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.nats;
+
+  format = pkgs.formats.json { };
+
+  configFile = format.generate "nats.conf" cfg.settings;
+
+in {
+
+  ### Interface
+
+  options = {
+    services.nats = {
+      enable = mkEnableOption "NATS messaging system";
+
+      user = mkOption {
+        type = types.str;
+        default = "nats";
+        description = "User account under which NATS runs.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "nats";
+        description = "Group under which NATS runs.";
+      };
+
+      serverName = mkOption {
+        default = "nats";
+        example = "n1-c3";
+        type = types.str;
+        description = ''
+          Name of the NATS server, must be unique if clustered.
+        '';
+      };
+
+      jetstream = mkEnableOption "JetStream";
+
+      port = mkOption {
+        default = 4222;
+        example = 4222;
+        type = types.port;
+        description = ''
+          Port on which to listen.
+        '';
+      };
+
+      dataDir = mkOption {
+        default = "/var/lib/nats";
+        type = types.path;
+        description = ''
+          The NATS data directory. Only used if JetStream is enabled, for
+          storing stream metadata and messages.
+
+          If left as the default value this directory will automatically be
+          created before the NATS server starts, otherwise the sysadmin is
+          responsible for ensuring the directory exists with appropriate
+          ownership and permissions.
+        '';
+      };
+
+      settings = mkOption {
+        default = { };
+        type = format.type;
+        example = literalExample ''
+          {
+            jetstream = {
+              max_mem = "1G";
+              max_file = "10G";
+            };
+          };
+        '';
+        description = ''
+          Declarative NATS configuration. See the
+          <link xlink:href="https://docs.nats.io/nats-server/configuration">
+          NATS documentation</link> for a list of options.
+        '';
+      };
+    };
+  };
+
+  ### Implementation
+
+  config = mkIf cfg.enable {
+    services.nats.settings = {
+      server_name = cfg.serverName;
+      port = cfg.port;
+      jetstream = optionalAttrs cfg.jetstream { store_dir = cfg.dataDir; };
+    };
+
+    systemd.services.nats = {
+      description = "NATS messaging system";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = mkMerge [
+        (mkIf (cfg.dataDir == "/var/lib/nats") {
+          StateDirectory = "nats";
+          StateDirectoryMode = "0750";
+        })
+        {
+          Type = "simple";
+          ExecStart = "${pkgs.nats-server}/bin/nats-server -c ${configFile}";
+          ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
+          ExecStop = "${pkgs.coreutils}/bin/kill -SIGINT $MAINPID";
+          Restart = "on-failure";
+
+          User = cfg.user;
+          Group = cfg.group;
+
+          # Hardening
+          CapabilityBoundingSet = "";
+          LimitNOFILE = 800000; # JetStream requires 2 FDs open per stream.
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateTmp = true;
+          PrivateUsers = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          ReadOnlyPaths = [ ];
+          ReadWritePaths = [ cfg.dataDir ];
+          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
+          UMask = "0077";
+        }
+      ];
+    };
+
+    users.users = mkIf (cfg.user == "nats") {
+      nats = {
+        description = "NATS daemon user";
+        isSystemUser = true;
+        group = cfg.group;
+        home = cfg.dataDir;
+      };
+    };
+
+    users.groups = mkIf (cfg.group == "nats") { nats = { }; };
+  };
+
+}
--- a/nixos/modules/services/networking/v2ray.nix
+++ b/nixos/modules/services/networking/v2ray.nix
@ -25,7 +25,7 @@ with lib;

          Either <literal>configFile</literal> or <literal>config</literal> must be specified.

-          See <link xlink:href="https://v2ray.com/en/configuration/overview.html"/>.
+          See <link xlink:href="https://www.v2fly.org/en_US/config/overview.html"/>.
        '';
      };

@ -47,7 +47,7 @@ with lib;

          Either `configFile` or `config` must be specified.

-          See <link xlink:href="https://v2ray.com/en/configuration/overview.html"/>.
+          See <link xlink:href="https://www.v2fly.org/en_US/config/overview.html"/>.
        '';
      };
    };
--- a/nixos/modules/services/wayland/cage.nix
+++ b/nixos/modules/services/wayland/cage.nix
@ -82,7 +82,7 @@ in {
      auth    required pam_unix.so nullok
      account required pam_unix.so
      session required pam_unix.so
-      session required pam_env.so conffile=${config.system.build.pamEnvironment} readenv=0
+      session required pam_env.so conffile=/etc/pam/environment readenv=0
      session required ${pkgs.systemd}/lib/security/pam_systemd.so
    '';

--- a/nixos/modules/services/web-servers/apache-httpd/default.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/default.nix
@ -36,11 +36,12 @@ let
  dependentCertNames = unique (map (hostOpts: hostOpts.certName) acmeEnabledVhosts);

  mkListenInfo = hostOpts:
-    if hostOpts.listen != [] then hostOpts.listen
-    else (
-      optional (hostOpts.onlySSL || hostOpts.addSSL || hostOpts.forceSSL) { ip = "*"; port = 443; ssl = true; } ++
-      optional (!hostOpts.onlySSL) { ip = "*"; port = 80; ssl = false; }
-    );
+    if hostOpts.listen != [] then
+      hostOpts.listen
+    else
+      optionals (hostOpts.onlySSL || hostOpts.addSSL || hostOpts.forceSSL) (map (addr: { ip = addr; port = 443; ssl = true; }) hostOpts.listenAddresses) ++
+      optionals (!hostOpts.onlySSL) (map (addr: { ip = addr; port = 80; ssl = false; }) hostOpts.listenAddresses)
+    ;

  listenInfo = unique (concatMap mkListenInfo vhosts);

--- a/nixos/modules/services/web-servers/apache-httpd/vhost-options.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/vhost-options.nix
@ -47,12 +47,29 @@ in
      ];
      description = ''
        Listen addresses and ports for this virtual host.
-        <note><para>
+        <note>
+        <para>
          This option overrides <literal>addSSL</literal>, <literal>forceSSL</literal> and <literal>onlySSL</literal>.
-        </para></note>
+        </para>
+        <para>
+          If you only want to set the addresses manually and not the ports, take a look at <literal>listenAddresses</literal>.
+        </para>
+        </note>
      '';
    };

+    listenAddresses = mkOption {
+      type = with types; nonEmptyListOf str;
+
+      description = ''
+        Listen addresses for this virtual host.
+        Compared to <literal>listen</literal> this only sets the addreses
+        and the ports are chosen automatically.
+      '';
+      default = [ "*" ];
+      example = [ "127.0.0.1" ];
+    };
+
    enableSSL = mkOption {
      type = types.bool;
      visible = false;
--- a/nixos/modules/services/web-servers/caddy/default.nix
+++ b/nixos/modules/services/web-servers/caddy/default.nix
@ -4,7 +4,17 @@ with lib;

 let
  cfg = config.services.caddy;
-  configFile = pkgs.writeText "Caddyfile" cfg.config;
+  vhostToConfig = vhostName: vhostAttrs: ''
+    ${vhostName} ${builtins.concatStringsSep " " vhostAttrs.serverAliases} {
+      ${vhostAttrs.extraConfig}
+    }
+  '';
+  configFile = pkgs.writeText "Caddyfile" (builtins.concatStringsSep "\n"
+    ([ cfg.config ] ++ (mapAttrsToList vhostToConfig cfg.virtualHosts)));
+
+  formattedConfig = pkgs.runCommand "formattedCaddyFile" { } ''
+    ${cfg.package}/bin/caddy fmt ${configFile} > $out
+  '';

  tlsConfig = {
    apps.tls.automation.policies = [{
@ -17,7 +27,7 @@ let

  adaptedConfig = pkgs.runCommand "caddy-config-adapted.json" { } ''
    ${cfg.package}/bin/caddy adapt \
-      --config ${configFile} --adapter ${cfg.adapter} > $out
+      --config ${formattedConfig} --adapter ${cfg.adapter} > $out
  '';
  tlsJSON = pkgs.writeText "tls.json" (builtins.toJSON tlsConfig);

@ -68,6 +78,27 @@ in
      '';
    };

+    virtualHosts = mkOption {
+      type = types.attrsOf (types.submodule (import ./vhost-options.nix {
+        inherit config lib;
+      }));
+      default = { };
+      example = literalExample ''
+        {
+          "hydra.example.com" = {
+            serverAliases = [ "www.hydra.example.com" ];
+            extraConfig = ''''''
+              encode gzip
+              log
+              root /srv/http
+            '''''';
+          };
+        };
+      '';
+      description = "Declarative vhost config";
+    };
+
+
    user = mkOption {
      default = "caddy";
      type = types.str;
--- a/nixos/modules/services/web-servers/caddy/vhost-options.nix
+++ b/nixos/modules/services/web-servers/caddy/vhost-options.nix
@ -0,0 +1,28 @@
+# This file defines the options that can be used both for the Nginx
+# main server configuration, and for the virtual hosts.  (The latter
+# has additional options that affect the web server as a whole, like
+# the user/group to run under.)
+
+{ lib, ... }:
+
+with lib;
+{
+  options = {
+    serverAliases = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "www.example.org" "example.org" ];
+      description = ''
+        Additional names of virtual hosts served by this virtual host configuration.
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = types.lines;
+      default = "";
+      description = ''
+        These lines go into the vhost verbatim
+      '';
+    };
+  };
+}
--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@ -18,7 +18,6 @@ let

  fontconfig = config.fonts.fontconfig;
  xresourcesXft = pkgs.writeText "Xresources-Xft" ''
-    ${optionalString (fontconfig.dpi != 0) ''Xft.dpi: ${toString fontconfig.dpi}''}
    Xft.antialias: ${if fontconfig.antialias then "1" else "0"}
    Xft.rgba: ${fontconfig.subpixel.rgba}
    Xft.lcdfilter: lcd${fontconfig.subpixel.lcdfilter}
--- a/nixos/modules/services/x11/display-managers/gdm.nix
+++ b/nixos/modules/services/x11/display-managers/gdm.nix
@ -314,7 +314,7 @@ in
        password required       pam_deny.so

        session  required       pam_succeed_if.so audit quiet_success user = gdm
-        session  required       pam_env.so conffile=${config.system.build.pamEnvironment} readenv=0
+        session  required       pam_env.so conffile=/etc/pam/environment readenv=0
        session  optional       ${pkgs.systemd}/lib/security/pam_systemd.so
        session  optional       pam_keyinit.so force revoke
        session  optional       pam_permit.so
--- a/nixos/modules/services/x11/display-managers/lightdm.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm.nix
@ -284,7 +284,7 @@ in
        password required       pam_deny.so

        session  required       pam_succeed_if.so audit quiet_success user = lightdm
-        session  required       pam_env.so conffile=${config.system.build.pamEnvironment} readenv=0
+        session  required       pam_env.so conffile=/etc/pam/environment readenv=0
        session  optional       ${pkgs.systemd}/lib/security/pam_systemd.so
        session  optional       pam_keyinit.so force revoke
        session  optional       pam_permit.so
--- a/nixos/modules/services/x11/display-managers/sddm.nix
+++ b/nixos/modules/services/x11/display-managers/sddm.nix
@ -229,7 +229,7 @@ in
        password required       pam_deny.so

        session  required       pam_succeed_if.so audit quiet_success user = sddm
-        session  required       pam_env.so conffile=${config.system.build.pamEnvironment} readenv=0
+        session  required       pam_env.so conffile=/etc/pam/environment readenv=0
        session  optional       ${pkgs.systemd}/lib/security/pam_systemd.so
        session  optional       pam_keyinit.so force revoke
        session  optional       pam_permit.so
--- a/nixos/modules/services/x11/window-managers/qtile.nix
+++ b/nixos/modules/services/x11/window-managers/qtile.nix
@ -15,7 +15,7 @@ in
    services.xserver.windowManager.session = [{
      name = "qtile";
      start = ''
-        ${pkgs.qtile}/bin/qtile &
+        ${pkgs.qtile}/bin/qtile start &
        waitPID=$!
      '';
    }];
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -297,7 +297,11 @@ in
      dpi = mkOption {
        type = types.nullOr types.int;
        default = null;
-        description = "DPI resolution to use for X server.";
+        description = ''
+          Force global DPI resolution to use for X server. It's recommended to
+          use this only when DPI is detected incorrectly; also consider using
+          <literal>Monitor</literal> section in configuration file instead.
+        '';
      };

      updateDbusEnvironment = mkOption {
--- a/nixos/modules/system/activation/switch-to-configuration.pl
+++ b/nixos/modules/system/activation/switch-to-configuration.pl
@ -243,9 +243,13 @@ while (my ($unit, $state) = each %{$activePrev}) {
                            foreach my $socket (@sockets) {
                                if (defined $activePrev->{$socket}) {
                                    $unitsToStop{$socket} = 1;
-                                    $unitsToStart{$socket} = 1;
-                                    recordUnit($startListFile, $socket);
-                                    $socketActivated = 1;
+                                    # Only restart sockets that actually
+                                    # exist in new configuration:
+                                    if (-e "$out/etc/systemd/system/$socket") {
+                                        $unitsToStart{$socket} = 1;
+                                        recordUnit($startListFile, $socket);
+                                        $socketActivated = 1;
+                                    }
                                }
                            }
                        }
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -70,7 +70,10 @@ let

      # Journal.
      "systemd-journald.socket"
+      "systemd-journald@.socket"
+      "systemd-journald-varlink@.socket"
      "systemd-journald.service"
+      "systemd-journald@.service"
      "systemd-journal-flush.service"
      "systemd-journal-catalog-update.service"
      ] ++ (optional (!config.boot.isContainer) "systemd-journald-audit.socket") ++ [
@ -1181,6 +1184,8 @@ in
    systemd.services."user-runtime-dir@".restartIfChanged = false;
    systemd.services.systemd-journald.restartTriggers = [ config.environment.etc."systemd/journald.conf".source ];
    systemd.services.systemd-journald.stopIfChanged = false;
+    systemd.services."systemd-journald@".restartTriggers = [ config.environment.etc."systemd/journald.conf".source ];
+    systemd.services."systemd-journald@".stopIfChanged = false;
    systemd.targets.local-fs.unitConfig.X-StopOnReconfiguration = true;
    systemd.targets.remote-fs.unitConfig.X-StopOnReconfiguration = true;
    systemd.targets.network-online.wantedBy = [ "multi-user.target" ];
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -283,6 +283,7 @@ in
  nat.firewall = handleTest ./nat.nix { withFirewall = true; };
  nat.firewall-conntrack = handleTest ./nat.nix { withFirewall = true; withConntrackHelpers = true; };
  nat.standalone = handleTest ./nat.nix { withFirewall = false; };
+  nats = handleTest ./nats.nix {};
  navidrome = handleTest ./navidrome.nix {};
  ncdns = handleTest ./ncdns.nix {};
  ndppd = handleTest ./ndppd.nix {};
--- a/nixos/tests/caddy.nix
+++ b/nixos/tests/caddy.nix
@ -43,49 +43,64 @@ import ./make-test-python.nix ({ pkgs, ... }: {
          }
        '';
      };
+      specialisation.multiple-configs.configuration = {
+        services.caddy.virtualHosts = {
+          "http://localhost:8080" = { };
+          "http://localhost:8081" = { };
+        };
+      };
    };
-  };

-  testScript = { nodes, ... }: let
-    etagSystem = "${nodes.webserver.config.system.build.toplevel}/specialisation/etag";
-    justReloadSystem = "${nodes.webserver.config.system.build.toplevel}/specialisation/config-reload";
-  in ''
-    url = "http://localhost/example.html"
-    webserver.wait_for_unit("caddy")
-    webserver.wait_for_open_port("80")
+    testScript = { nodes, ... }:
+      let
+        etagSystem = "${nodes.webserver.config.system.build.toplevel}/specialisation/etag";
+        justReloadSystem = "${nodes.webserver.config.system.build.toplevel}/specialisation/config-reload";
+        multipleConfigs = "${nodes.webserver.config.system.build.toplevel}/specialisation/multiple-configs";
+      in
+      ''
+        url = "http://localhost/example.html"
+        webserver.wait_for_unit("caddy")
+        webserver.wait_for_open_port("80")


-    def check_etag(url):
-        etag = webserver.succeed(
-            "curl --fail -v '{}' 2>&1 | sed -n -e \"s/^< [Ee][Tt][Aa][Gg]: *//p\"".format(
-                url
+        def check_etag(url):
+            etag = webserver.succeed(
+                "curl --fail -v '{}' 2>&1 | sed -n -e \"s/^< [Ee][Tt][Aa][Gg]: *//p\"".format(
+                    url
+                )
            )
-        )
-        etag = etag.replace("\r\n", " ")
-        http_code = webserver.succeed(
-            "curl --fail --silent --show-error -o /dev/null -w \"%{{http_code}}\" --head -H 'If-None-Match: {}' {}".format(
-                etag, url
+            etag = etag.replace("\r\n", " ")
+            http_code = webserver.succeed(
+                "curl --fail --silent --show-error -o /dev/null -w \"%{{http_code}}\" --head -H 'If-None-Match: {}' {}".format(
+                    etag, url
+                )
            )
-        )
-        assert int(http_code) == 304, "HTTP code is {}, expected 304".format(http_code)
-        return etag
+            assert int(http_code) == 304, "HTTP code is {}, expected 304".format(http_code)
+            return etag


-    with subtest("check ETag if serving Nix store paths"):
-        old_etag = check_etag(url)
-        webserver.succeed(
-            "${etagSystem}/bin/switch-to-configuration test >&2"
-        )
-        webserver.sleep(1)
-        new_etag = check_etag(url)
-        assert old_etag != new_etag, "Old ETag {} is the same as {}".format(
-            old_etag, new_etag
-        )
+        with subtest("check ETag if serving Nix store paths"):
+            old_etag = check_etag(url)
+            webserver.succeed(
+                "${etagSystem}/bin/switch-to-configuration test >&2"
+            )
+            webserver.sleep(1)
+            new_etag = check_etag(url)
+            assert old_etag != new_etag, "Old ETag {} is the same as {}".format(
+                old_etag, new_etag
+            )

-    with subtest("config is reloaded on nixos-rebuild switch"):
-        webserver.succeed(
-            "${justReloadSystem}/bin/switch-to-configuration test >&2"
-        )
-        webserver.wait_for_open_port("8080")
-  '';
-})
+        with subtest("config is reloaded on nixos-rebuild switch"):
+            webserver.succeed(
+                "${justReloadSystem}/bin/switch-to-configuration test >&2"
+            )
+            webserver.wait_for_open_port("8080")
+
+        with subtest("multiple configs are correctly merged"):
+            webserver.succeed(
+                "${multipleConfigs}/bin/switch-to-configuration test >&2"
+            )
+            webserver.wait_for_open_port("8080")
+            webserver.wait_for_open_port("8081")
+      '';
+  })
--- a/nixos/tests/common/ec2.nix
+++ b/nixos/tests/common/ec2.nix
@ -23,6 +23,7 @@ with pkgs.lib;
      testScript = ''
        import os
        import subprocess
+        import tempfile

        image_dir = os.path.join(
            os.environ.get("TMPDIR", tempfile.gettempdir()), "tmp", "vm-state-machine"
--- a/nixos/tests/nats.nix
+++ b/nixos/tests/nats.nix
@ -0,0 +1,65 @@
+let
+
+  port = 4222;
+  username = "client";
+  password = "password";
+  topic = "foo.bar";
+
+in import ./make-test-python.nix ({ pkgs, lib, ... }: {
+  name = "nats";
+  meta = with pkgs.lib; { maintainers = with maintainers; [ c0deaddict ]; };
+
+  nodes = let
+    client = { pkgs, ... }: {
+      environment.systemPackages = with pkgs; [ natscli ];
+    };
+  in {
+    server = { pkgs, ... }: {
+      networking.firewall.allowedTCPPorts = [ port ];
+      services.nats = {
+        inherit port;
+        enable = true;
+        settings = {
+          authorization = {
+            users = [{
+              user = username;
+              inherit password;
+            }];
+          };
+        };
+      };
+    };
+
+    client1 = client;
+    client2 = client;
+  };
+
+  testScript = let file = "/tmp/msg";
+  in ''
+    def nats_cmd(*args):
+        return (
+            "nats "
+            "--server=nats://server:${toString port} "
+            "--user=${username} "
+            "--password=${password} "
+            "{}"
+        ).format(" ".join(args))
+
+    start_all()
+    server.wait_for_unit("nats.service")
+
+    client1.fail("test -f ${file}")
+
+    # Subscribe on topic on client1 and echo messages to file.
+    client1.execute("({} | tee ${file} &)".format(nats_cmd("sub", "--raw", "${topic}")))
+
+    # Give client1 some time to subscribe.
+    client1.execute("sleep 2")
+
+    # Publish message on client2.
+    client2.execute(nats_cmd("pub", "${topic}", "hello"))
+
+    # Check if message has been received.
+    client1.succeed("grep -q hello ${file}")
+  '';
+})
--- a/nixos/tests/nsd.nix
+++ b/nixos/tests/nsd.nix
@ -85,6 +85,7 @@ in import ./make-test-python.nix ({ pkgs, ...} : {
        self = clientv4 if type == 4 else clientv6
        out = self.succeed(f"host -{type} -t {rr} {query}").rstrip()
        self.log(f"output: {out}")
+        import re
        assert re.search(
            expected, out
        ), f"DNS IPv{type} query on {query} gave '{out}' instead of '{expected}'"
--- a/nixos/tests/postgresql.nix
+++ b/nixos/tests/postgresql.nix
@ -61,6 +61,7 @@ let

      with subtest("Postgresql survives restart (bug #1735)"):
          machine.shutdown()
+          import time
          time.sleep(2)
          machine.start()
          machine.wait_for_unit("postgresql")
--- a/nixos/tests/shattered-pixel-dungeon.nix
+++ b/nixos/tests/shattered-pixel-dungeon.nix
@ -10,6 +10,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
    ];

    services.xserver.enable = true;
+    sound.enable = true;
    environment.systemPackages = [ pkgs.shattered-pixel-dungeon ];
  };

--- a/nixos/tests/turbovnc-headless-server.nix
+++ b/nixos/tests/turbovnc-headless-server.nix
@ -57,6 +57,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
            else:
                if check_success():
                    return
+            import time
            time.sleep(retry_sleep)

        if not check_success():
--- a/pkgs/applications/audio/sidplayfp/default.nix
+++ b/pkgs/applications/audio/sidplayfp/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "sidplayfp";
-  version = "2.2.0";
+  version = "2.2.1";

  src = fetchFromGitHub {
    owner = "libsidplayfp";
    repo = "sidplayfp";
    rev = "v${version}";
-    sha256 = "sha256-hN7225lhuYyo4wPDiiEc9FaPg90pZ13mLw93V8tb/P0=";
+    sha256 = "sha256-IlPZmZpWxMaArkRnqu6JCGxiHU7JczRxiySqzAopfxc=";
  };

  nativeBuildInputs = [ autoreconfHook perl pkg-config ];
--- a/pkgs/applications/audio/zynaddsubfx/default.nix
+++ b/pkgs/applications/audio/zynaddsubfx/default.nix
@ -91,7 +91,7 @@ in stdenv.mkDerivation rec {

  # When building with zest GUI, patch plugins
  # and standalone executable to properly locate zest
-  postFixup = lib.optional (guiModule == "zest") ''
+  postFixup = lib.optionalString (guiModule == "zest") ''
    patchelf --set-rpath "${mruby-zest}:$(patchelf --print-rpath "$out/lib/lv2/ZynAddSubFX.lv2/ZynAddSubFX_ui.so")" \
      "$out/lib/lv2/ZynAddSubFX.lv2/ZynAddSubFX_ui.so"

--- a/pkgs/applications/blockchains/bisq-desktop/default.nix
+++ b/pkgs/applications/blockchains/bisq-desktop/default.nix
@ -8,63 +8,50 @@
 , openjdk11
 , dpkg
 , writeScript
-, coreutils
 , bash
 , tor
-, psmisc
+, gnutar
+, zip
+, xz
 }:

 let
  bisq-launcher = writeScript "bisq-launcher" ''
    #! ${bash}/bin/bash

-    # Setup a temporary Tor instance
-    TMPDIR=$(${coreutils}/bin/mktemp -d)
-    CONTROLPORT=$(${coreutils}/bin/shuf -i 9100-9499 -n 1)
-    SOCKSPORT=$(${coreutils}/bin/shuf -i 9500-9999 -n 1)
-    ${coreutils}/bin/head -c 1024 < /dev/urandom > $TMPDIR/cookie
+    # This is just a comment to convince Nix that Tor is a
+    # runtime dependency; The Tor binary is in a *.jar file,
+    # whereas Nix only scans for hashes in uncompressed text.
+    # ${bisq-tor}

-    ${tor}/bin/tor --SocksPort $SOCKSPORT --ControlPort $CONTROLPORT \
-      --ControlPortWriteToFile $TMPDIR/port --CookieAuthFile $TMPDIR/cookie \
-      --CookieAuthentication 1 >$TMPDIR/tor.log --RunAsDaemon 1
+    JAVA_TOOL_OPTIONS="-XX:+UseG1GC -XX:MaxHeapFreeRatio=10 -XX:MinHeapFreeRatio=5 -XX:+UseStringDeduplication" bisq-desktop-wrapped "$@"
+  '';

-    torpid=$(${psmisc}/bin/fuser $CONTROLPORT/tcp)
+  bisq-tor = writeScript "bisq-tor" ''
+    #! ${bash}/bin/bash

-    echo Temp directory: $TMPDIR
-    echo Tor PID: $torpid
-    echo Tor control port: $CONTROLPORT
-    echo Tor SOCKS port: $SOCKSPORT
-    echo Tor log: $TMPDIR/tor.log
-    echo Bisq log file: $TMPDIR/bisq.log
-
-    JAVA_TOOL_OPTIONS="-XX:MaxRAM=4g" bisq-desktop-wrapped \
-      --torControlCookieFile=$TMPDIR/cookie \
-      --torControlUseSafeCookieAuth \
-      --torControlPort $CONTROLPORT "$@" > $TMPDIR/bisq.log
-
-    echo Bisq exited. Killing Tor...
-    kill $torpid
+    exec ${tor}/bin/tor "$@"
  '';
 in
 stdenv.mkDerivation rec {
  pname = "bisq-desktop";
-  version = "1.7.0";
+  version = "1.7.2";

  src = fetchurl {
    url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb";
-    sha256 = "0crry5k7crmrqn14wxiyrnhk09ac8a9ksqrwwky7jsnyah0bx5k4";
+    sha256 = "0b2rh9sphc9wffkawprrl20frgv0rah7y2k5sfxpjc3shgkqsw80";
  };

-  nativeBuildInputs = [ makeWrapper copyDesktopItems dpkg ];
+  nativeBuildInputs = [ makeWrapper copyDesktopItems imagemagick dpkg gnutar zip xz ];

  desktopItems = [
    (makeDesktopItem {
      name = "Bisq";
      exec = "bisq-desktop";
      icon = "bisq";
-      desktopName = "Bisq";
+      desktopName = "Bisq ${version}";
      genericName = "Decentralized bitcoin exchange";
-      categories = "Network;Utility;";
+      categories = "Network;P2P;";
    })
  ];

@ -72,6 +59,16 @@ stdenv.mkDerivation rec {
    dpkg -x $src .
  '';

+  buildPhase = ''
+    # Replace the embedded Tor binary (which is in a Tar archive)
+    # with one from Nixpkgs.
+
+    mkdir -p native/linux/x64/
+    cp ${bisq-tor} ./tor
+    tar -cJf native/linux/x64/tor.tar.xz tor
+    zip -r opt/bisq/lib/app/desktop-${version}-all.jar native
+  '';
+
  installPhase = ''
    runHook preInstall

@ -86,13 +83,15 @@ stdenv.mkDerivation rec {

    for n in 16 24 32 48 64 96 128 256; do
      size=$n"x"$n
-      ${imagemagick}/bin/convert opt/bisq/lib/Bisq.png -resize $size bisq.png
+      convert opt/bisq/lib/Bisq.png -resize $size bisq.png
      install -Dm644 -t $out/share/icons/hicolor/$size/apps bisq.png
    done;

    runHook postInstall
  '';

+  passthru.updateScript = ./update.sh;
+
  meta = with lib; {
    description = "A decentralized bitcoin exchange network";
    homepage = "https://bisq.network";
--- a/pkgs/applications/blockchains/bisq-desktop/update.sh
+++ b/pkgs/applications/blockchains/bisq-desktop/update.sh
@ -0,0 +1,22 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq gnused gnupg common-updater-scripts
+
+set -eu -o pipefail
+
+version="$(curl -s https://api.github.com/repos/bisq-network/bisq/releases| jq '.[] | {name,prerelease} | select(.prerelease==false) | limit(1;.[])' | sed 's/[\"v]//g' | head -n 1)"
+depname="Bisq-64bit-$version.deb"
+src="https://github.com/bisq-network/bisq/releases/download/v$version/$depname"
+signature="$src.asc"
+key="CB36 D7D2 EBB2 E35D 9B75 500B CD5D C1C5 29CD FD3B"
+
+pushd $(mktemp -d --suffix=-bisq-updater)
+export GNUPGHOME=$PWD/gnupg
+mkdir -m 700 -p "$GNUPGHOME"
+curl -L -o "$depname" -- "$src"
+curl -L -o signature.asc -- "$signature"
+gpg --batch --recv-keys "$key"
+gpg --batch --verify signature.asc "$depname"
+sha256=$(nix-prefetch-url --type sha256 "file://$PWD/$depname")
+popd
+
+update-source-version bisq-desktop "$version" "$sha256"
--- a/pkgs/applications/blockchains/bitcoin/default.nix
+++ b/pkgs/applications/blockchains/bitcoin/default.nix
@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
    ++ optionals withWallet [ db48 sqlite ]
    ++ optionals withGui [ qrencode qtbase qttools ];

-  postInstall = optional withGui ''
+  postInstall = optionalString withGui ''
    install -Dm644 ${desktop} $out/share/applications/bitcoin-qt.desktop
    substituteInPlace $out/share/applications/bitcoin-qt.desktop --replace "Icon=bitcoin128" "Icon=bitcoin"
    install -Dm644 share/pixmaps/bitcoin256.png $out/share/pixmaps/bitcoin.png
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "polkadot";
-  version = "0.9.8";
+  version = "0.9.9";

  src = fetchFromGitHub {
    owner = "paritytech";
    repo = "polkadot";
    rev = "v${version}";
-    sha256 = "sha256-5PNogoahAZUjIlQsVXwm7j5OmP3/uEEdV0vrIDXXBx8=";
+    sha256 = "sha256-GsGa2y718qWQlP0pLy8X3mVsFpNNnOTVQZpp4+e1RhA=";
  };

-  cargoSha256 = "0iikys90flzmnnb6l2wzag8mp91p6z9y7rjzym2sd6m7xhgbc1x6";
+  cargoSha256 = "03lnw61pgp88iwz2gbcp8y3jvz6v94cn0ynjz6snb9jq88gf25dz";

  nativeBuildInputs = [ clang ];

--- a/pkgs/applications/editors/bluej/default.nix
+++ b/pkgs/applications/editors/bluej/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "bluej";
-  version = "5.0.1";
+  version = "5.0.2";
  src = fetchurl {
    # We use the deb here. First instinct might be to go for the "generic" JAR
    # download, but that is actually a graphical installer that is much harder
    # to unpack than the deb.
    url = "https://www.bluej.org/download/files/BlueJ-linux-${builtins.replaceStrings ["."] [""] version}.deb";
-    sha256 = "sha256-KhNhJ2xsw1g2yemwP6NQmJvk4cxZAQQNPEUBuLso5qM=";
+    sha256 = "sha256-9sWfVQF/wCiVDKBmesMpM+5BHjFUPszm6U1SgJNQ8lE=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/editors/jetbrains/common.nix
+++ b/pkgs/applications/editors/jetbrains/common.nix
@ -1,5 +1,5 @@
 { stdenv, lib, makeDesktopItem, makeWrapper, patchelf, writeText
-, coreutils, gnugrep, which, git, unzip, libsecret, libnotify
+, coreutils, gnugrep, which, git, unzip, libsecret, libnotify, e2fsprogs
 , vmopts ? null
 }:

@ -78,7 +78,7 @@ with stdenv; lib.makeOverridable mkDerivation rec {
      --prefix PATH : "$out/libexec/${name}:${lib.optionalString (stdenv.isDarwin) "${jdk}/jdk/Contents/Home/bin:"}${lib.makeBinPath [ jdk coreutils gnugrep which git ]}" \
      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath ([
        # Some internals want libstdc++.so.6
-        stdenv.cc.cc.lib libsecret
+        stdenv.cc.cc.lib libsecret e2fsprogs
        libnotify
      ] ++ extraLdPath)}" \
      --set JDK_HOME "$jdk" \
--- a/pkgs/applications/editors/jupyter-kernels/clojupyter/default.nix
+++ b/pkgs/applications/editors/jupyter-kernels/clojupyter/default.nix
@ -0,0 +1,73 @@
+{ pkgs
+, stdenv
+, lib
+, jre
+, fetchFromGitHub
+, writeShellScript
+, runCommand
+, imagemagick
+}:
+
+# To test:
+# $(nix-build --no-out-link -E 'with import <nixpkgs> {}; jupyter.override { definitions = { clojure = clojupyter.definition; }; }')/bin/jupyter-notebook
+
+let
+  cljdeps = import ./deps.nix { inherit pkgs; };
+  classp  = cljdeps.makeClasspaths {};
+
+  shellScript = writeShellScript "clojupyter" ''
+    ${jre}/bin/java -cp ${classp} clojupyter.kernel.core "$@"
+  '';
+
+  pname = "clojupyter";
+  version = "0.3.2";
+
+  meta = with lib; {
+    description = "A Jupyter kernel for Clojure";
+    homepage = "https://github.com/clojupyter/clojupyter";
+    license = licenses.mit;
+    maintainers = with maintainers; [ thomasjm ];
+    platforms = jre.meta.platforms;
+  };
+
+  sizedLogo = size: stdenv.mkDerivation {
+    name = "clojupyter-logo-${size}x${size}.png";
+
+    src = fetchFromGitHub {
+      owner = "clojupyter";
+      repo = "clojupyter";
+      rev = "0.3.2";
+      sha256 = "1wphc7h74qlm9bcv5f95qhq1rq9gmcm5hvjblb01vffx996vr6jz";
+    };
+
+    buildInputs = [ imagemagick ];
+
+    dontConfigure = true;
+    dontInstall = true;
+
+    buildPhase = ''
+      convert ./resources/clojupyter/assets/logo-64x64.png -resize ${size}x${size} $out
+    '';
+
+    inherit meta;
+  };
+
+in
+
+rec {
+  launcher = runCommand "clojupyter" { inherit pname version meta shellScript; } ''
+    mkdir -p $out/bin
+    ln -s $shellScript $out/bin/clojupyter
+  '';
+
+  definition = {
+    displayName = "Clojure";
+    argv = [
+      "${launcher}/bin/clojupyter"
+      "{connection_file}"
+    ];
+    language = "clojure";
+    logo32 = sizedLogo "32";
+    logo64 = sizedLogo "64";
+  };
+}
--- a/pkgs/applications/editors/jupyter-kernels/clojupyter/deps.edn
+++ b/pkgs/applications/editors/jupyter-kernels/clojupyter/deps.edn
@ -0,0 +1 @@
+{:deps {clojupyter/clojupyter {:mvn/version "0.3.2"}}}
--- a/pkgs/applications/editors/jupyter-kernels/clojupyter/deps.nix
+++ b/pkgs/applications/editors/jupyter-kernels/clojupyter/deps.nix
--- a/pkgs/applications/editors/jupyter-kernels/clojupyter/update.sh
+++ b/pkgs/applications/editors/jupyter-kernels/clojupyter/update.sh
@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+### To update clj2nix
+# $ nix-prefetch-github hlolli clj2nix
+
+nix-shell --run "clj2nix deps.edn deps.nix" -E '
+with import ../../../../.. { };
+mkShell {
+  buildInputs = [(callPackage (fetchFromGitHub {
+    owner = "hlolli";
+    repo = "clj2nix";
+    rev = "b9a28d4a920d5d680439b1b0d18a1b2c56d52b04";
+    sha256 = "0d8xlja62igwg757lab9ablz1nji8cp9p9x3j0ihqvp1y48w2as3";
+  }) {})];
+}
+'
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@ -14,17 +14,17 @@ let
  archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "14j1bss4bqw39ijmyh0kyr5xgzq61bc0if7g94jkvdbngz6fa25f";
-    x86_64-darwin = "0922r49475j1i8jrx5935bly7cv26hniz9iqf30qj6qs6d8kibci";
-    aarch64-linux = "11kkys3fsf4a4hvqv524fkdl686addd3ygzz0mav09xh8wjqbisw";
-    aarch64-darwin = "1xk56ww2ndksi6sqnr42zcqx2fl52aip3jb4fmdmqg1cvllfx0sd";
-    armv7l-linux = "1jiyjknl2xxivifixcwvyi6qsq7kr71gbalzdj6xca2i6pc1gbvp";
+    x86_64-linux = "0i2pngrp2pcas99wkay7ahrcn3gl47gdjjaq7ladr879ypldh24v";
+    x86_64-darwin = "1pni2cd5s6m9jxwpja4ma9xlr1q3xl46w8pim3971dw3xi5r29pg";
+    aarch64-linux = "0j71ha2df99583w8r2l1hppn6wx8ll80flwcj5xzj7icv3mq8x7v";
+    aarch64-darwin = "0vhp1z890mvs8hnwf43bfv74a7y0pv5crjn53rbiy0il1ihs1498";
+    armv7l-linux = "07yb0ia1rnbav3gza2y53yd3bcxqmngddd4jz6p4y0m539znl817";
  }.${system};
 in
  callPackage ./generic.nix rec {
    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.59.0";
+    version = "1.59.1";
    pname = "vscode";

    executableName = "code" + lib.optionalString isInsiders "-insiders";
@ -39,7 +39,7 @@ in

    sourceRoot = "";

-    updateScript = ./update-vscodium.sh;
+    updateScript = ./update-vscode.sh;

    meta = with lib; {
      description = ''
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -13,10 +13,10 @@ let
  archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "0yx0h7rd8v9j3yq863dj78bm587s8lpisbn1skb5whv6qv88x7c0";
-    x86_64-darwin = "1b5jr08cgl49rh26id8iwi64d32ssr7kis72zcqg0jkw7larxvvh";
-    aarch64-linux = "1a62krnilfi7nr7mmxyv3danj7h2yfdwg784q8vhrdjyqjd8gjbs";
-    armv7l-linux = "1axazx7hf6iw0dq1m2049kfrmk8jndycz9pcn3csj6rm65plg746";
+    x86_64-linux = "1z8sxdzwbjip8csrili5l36v1kl3iq8fw19dhfnkjs3fl0sn360k";
+    x86_64-darwin = "0sp5k4pk9yjx16c79hqrwn64f2ab82iizm1cy93y9rr2r3px1yga";
+    aarch64-linux = "03qm5008knigsahs6zz5c614g1kid3k0ndg8vb0flfwmdrajrdw3";
+    armv7l-linux = "0sls3m5zwz6w01k7jym0vwbz006bkwv23yba7gf1gg84vbqgpb1x";
  }.${system};

  sourceRoot = {
@ -31,7 +31,7 @@ in

    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.59.0";
+    version = "1.59.1";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/graphics/akira/default.nix
+++ b/pkgs/applications/graphics/akira/default.nix
@ -24,13 +24,13 @@

 stdenv.mkDerivation rec {
  pname = "akira";
-  version = "0.0.15";
+  version = "0.0.16";

  src = fetchFromGitHub {
    owner = "akiraux";
    repo = "Akira";
    rev = "v${version}";
-    sha256 = "sha256-2GhpxajymLVAl2P6vZ0+nuZK3ZRRktFswWkj7TP8eHI=";
+    sha256 = "sha256-qrqmSCwA0kQVFD1gzutks9gMr7My7nw/KJs/VPisa0w=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/dosage/default.nix
+++ b/pkgs/applications/graphics/dosage/default.nix
@ -1,28 +1,30 @@
-{ lib, python3Packages, fetchFromGitHub }:
+{ lib, python3Packages }:

 python3Packages.buildPythonApplication rec {
  pname = "dosage";
-  version = "2018.04.08";
-  PBR_VERSION = version;
+  version = "2.17";

-  src = fetchFromGitHub {
-    owner = "webcomics";
-    repo = "dosage";
-    rev = "b2fdc13feb65b93762928f7e99bac7b1b7b31591";
-    sha256 = "1p6vllqaf9s6crj47xqp97hkglch1kd4y8y4lxvzx3g2shhhk9hh";
+  src = python3Packages.fetchPypi {
+    inherit pname version;
+    sha256 = "0vmxgn9wd3j80hp4gr5iq06jrl4gryz5zgfdd2ah30d12sfcfig0";
  };
-  checkInputs = with python3Packages; [ pytest responses ];
-  propagatedBuildInputs = with python3Packages; [ colorama lxml requests pbr setuptools ];
+
+  checkInputs = with python3Packages; [
+    pytestCheckHook pytest-xdist responses
+  ];
+
+  nativeBuildInputs = with python3Packages; [ setuptools-scm ];
+
+  propagatedBuildInputs = with python3Packages; [
+    colorama imagesize lxml requests setuptools six
+  ];

  disabled = python3Packages.pythonOlder "3.3";

-  checkPhase = ''
-    py.test tests/
-  '';
-
  meta = {
    description = "A comic strip downloader and archiver";
    homepage = "https://dosage.rocks/";
    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ toonn ];
  };
 }
--- a/pkgs/applications/graphics/drawpile/default.nix
+++ b/pkgs/applications/graphics/drawpile/default.nix
@ -2,7 +2,6 @@
 , lib
 , mkDerivation
 , fetchFromGitHub
-, fetchpatch
 , extra-cmake-modules

 # common deps
--- a/pkgs/applications/graphics/hydrus/default.nix
+++ b/pkgs/applications/graphics/hydrus/default.nix
@ -10,14 +10,14 @@

 python3Packages.buildPythonPackage rec {
  pname = "hydrus";
-  version = "450";
+  version = "451";
  format = "other";

  src = fetchFromGitHub {
    owner = "hydrusnetwork";
    repo = "hydrus";
    rev = "v${version}";
-    sha256 = "sha256-sMy5Yv7PGK3U/XnB8IrutSqSBiq1cfD6pAO5BxbWG5A=";
+    sha256 = "sha256-HoaXbnhwh6kDWgRFVs+VttzIY3MaxriteFTE1fwBUYs=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/rx/default.nix
+++ b/pkgs/applications/graphics/rx/default.nix
@ -29,7 +29,7 @@ rustPlatform.buildRustPackage rec {
  # FIXME: GLFW (X11) requires DISPLAY env variable for all tests
  doCheck = false;

-  postInstall = optional stdenv.isLinux ''
+  postInstall = optionalString stdenv.isLinux ''
    mkdir -p $out/share/applications
    cp $src/rx.desktop $out/share/applications
    wrapProgram $out/bin/rx --prefix LD_LIBRARY_PATH : ${libGL}/lib
--- a/pkgs/applications/misc/anytype/default.nix
+++ b/pkgs/applications/misc/anytype/default.nix
@ -15,9 +15,8 @@ in
 appimageTools.wrapType2 {
  inherit name src;

-  extraPkgs = { pkgs, ... }@args: [
-    pkgs.gnome3.libsecret
-  ] ++ appimageTools.defaultFhsEnvArgs.multiPkgs args;
+  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs)
+    ++ [ pkgs.libsecret ];

  extraInstallCommands = ''
    mv $out/bin/${name} $out/bin/${pname}
--- a/pkgs/applications/misc/firestarter/default.nix
+++ b/pkgs/applications/misc/firestarter/default.nix
@ -1,32 +1,83 @@
-{ lib, stdenv, fetchFromGitHub, glibc, python3, cudatoolkit,
-  withCuda ? true
+{ stdenv
+, lib
+, fetchFromGitHub
+, fetchzip
+, cmake
+, glibc_multi
+, glibc
+, git
+, pkg-config
+, cudatoolkit
+, withCuda ? false
+, linuxPackages
 }:

-with lib;
+let
+  hwloc = stdenv.mkDerivation rec {
+    pname = "hwloc";
+    version = "2.2.0";
+
+    src = fetchzip {
+      url = "https://download.open-mpi.org/release/hwloc/v${lib.versions.majorMinor version}/hwloc-${version}.tar.gz";
+      sha256 = "1ibw14h9ppg8z3mmkwys8vp699n85kymdz20smjd2iq9b67y80b6";
+    };
+
+    configureFlags = [
+      "--enable-static"
+      "--disable-libudev"
+      "--disable-shared"
+      "--disable-doxygen"
+      "--disable-libxml2"
+      "--disable-cairo"
+      "--disable-io"
+      "--disable-pci"
+      "--disable-opencl"
+      "--disable-cuda"
+      "--disable-nvml"
+      "--disable-gl"
+      "--disable-libudev"
+      "--disable-plugin-dlopen"
+      "--disable-plugin-ltdl"
+    ];
+
+    nativeBuildInputs = [ pkg-config ];
+
+    enableParallelBuilding = true;
+
+    outputs = [ "out" "lib" "dev" "doc" "man" ];
+  };
+
+in
 stdenv.mkDerivation rec {
  pname = "firestarter";
-  version = "1.7.4";
+  version = "2.0";

  src = fetchFromGitHub {
    owner = "tud-zih-energy";
    repo = "FIRESTARTER";
    rev = "v${version}";
-    sha256 = "0zqfqb7hf48z39g1qhbl1iraf8rz4d629h1q6ikizckpzfq23kd0";
+    sha256 = "1ik6j1lw5nldj4i3lllrywqg54m9i2vxkxsb2zr4q0d2rfywhn23";
+    fetchSubmodules = true;
  };

-  nativeBuildInputs = [ python3 ];
-  buildInputs = [ glibc.static ] ++ optionals withCuda [ cudatoolkit ];
-  preBuild = ''
-    mkdir -p build
-    cd build
-    python ../code-generator.py ${optionalString withCuda "--enable-cuda"}
-  '';
-  makeFlags = optionals withCuda [ "LINUX_CUDA_PATH=${cudatoolkit}" ];
-  enableParallelBuilding = true;
+  nativeBuildInputs = [ cmake git pkg-config ];
+
+  buildInputs = [ hwloc ] ++ (if withCuda then
+    [ glibc_multi cudatoolkit linuxPackages.nvidia_x11 ]
+  else
+    [ glibc.static ]);
+
+  cmakeFlags = [
+    "-DFIRESTARTER_BUILD_HWLOC=OFF"
+    "-DCMAKE_C_COMPILER_WORKS=1"
+    "-DCMAKE_CXX_COMPILER_WORKS=1"
+  ] ++ lib.optionals withCuda [
+    "-DFIRESTARTER_BUILD_TYPE=FIRESTARTER_CUDA"
+  ];

  installPhase = ''
    mkdir -p $out/bin
-    cp FIRESTARTER $out/bin/firestarter
+    cp src/FIRESTARTER${lib.optionalString withCuda "_CUDA"} $out/bin/
  '';

  meta = with lib; {
--- a/pkgs/applications/misc/lsd2dsl/default.nix
+++ b/pkgs/applications/misc/lsd2dsl/default.nix
@ -1,23 +1,33 @@
-{ stdenv, mkDerivation, lib, fetchFromGitHub, cmake
+{ lib, stdenv, mkDerivation, fetchFromGitHub
+, makeDesktopItem, copyDesktopItems, cmake
 , boost, libvorbis, libsndfile, minizip, gtest, qtwebkit }:

 mkDerivation rec {
  pname = "lsd2dsl";
-  version = "0.5.2";
+  version = "0.5.4";

  src = fetchFromGitHub {
    owner = "nongeneric";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0s0la6zkg584is93p4nj1ha3pbnvadq84zgsv8nym3r35n7k8czi";
+    sha256 = "sha256-PLgfsVVrNBTxI4J0ukEOFRoBkbmB55/sLNn5KyiHeAc=";
  };

-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake ] ++ lib.optional stdenv.isLinux copyDesktopItems;

  buildInputs = [ boost libvorbis libsndfile minizip gtest qtwebkit ];

  NIX_CFLAGS_COMPILE = "-Wno-error=unused-result -Wno-error=missing-braces";

+  desktopItems = lib.singleton (makeDesktopItem {
+    name = "lsd2dsl";
+    exec = "lsd2dsl-qtgui";
+    desktopName = "lsd2dsl";
+    genericName = "lsd2dsl";
+    comment = meta.description;
+    categories = "Dictionary;FileTools;Qt;";
+  });
+
  installPhase = ''
    install -Dm755 console/lsd2dsl gui/lsd2dsl-qtgui -t $out/bin
  '' + lib.optionalString stdenv.isDarwin ''
@ -33,6 +43,6 @@ mkDerivation rec {
    '';
    license = licenses.mit;
    maintainers = with maintainers; [ sikmir ];
-    platforms = with platforms; linux ++ darwin;
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/misc/moonlight-embedded/default.nix
+++ b/pkgs/applications/misc/moonlight-embedded/default.nix
@ -1,34 +1,34 @@
 { lib, stdenv, fetchFromGitHub, cmake, perl
 , alsa-lib, libevdev, libopus, udev, SDL2
 , ffmpeg, pkg-config, xorg, libvdpau, libpulseaudio, libcec
-, curl, expat, avahi, enet, libuuid, libva
+, curl, expat, avahi, libuuid, libva
 }:

 stdenv.mkDerivation rec {
  pname = "moonlight-embedded";
-  version = "2.4.11";
+  version = "2.5.1";

  src = fetchFromGitHub {
-    owner = "irtimmer";
+    owner = "moonlight-stream";
    repo = "moonlight-embedded";
    rev = "v${version}";
-    sha256 = "19wm4gizj8q6j4jwqfcn3bkhms97d8afwxmqjmjnqqxzpd2gxc16";
+    sha256 = "0wn6yjpqyjv52278xsx1ivnqrwca4fnk09a01fwzk4adpry1q9ck";
    fetchSubmodules = true;
  };

  outputs = [ "out" "man" ];

-  nativeBuildInputs = [ cmake perl ];
+  nativeBuildInputs = [ cmake perl pkg-config ];
  buildInputs = [
    alsa-lib libevdev libopus udev SDL2
-    ffmpeg pkg-config xorg.libxcb libvdpau libpulseaudio libcec
-    xorg.libpthreadstubs curl expat avahi enet libuuid libva
+    ffmpeg xorg.libxcb libvdpau libpulseaudio libcec
+    xorg.libpthreadstubs curl expat avahi libuuid libva
  ];

  meta = with lib; {
    description = "Open source implementation of NVIDIA's GameStream";
-    homepage = "https://github.com/irtimmer/moonlight-embedded";
-    license = licenses.gpl3;
+    homepage = "https://github.com/moonlight-stream/moonlight-embedded";
+    license = licenses.gpl3Plus;
    maintainers = [ maintainers.globin ];
    platforms = platforms.linux;
  };
--- a/pkgs/applications/misc/pwsafe/default.nix
+++ b/pkgs/applications/misc/pwsafe/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "pwsafe";
-  version = "3.55.0";
+  version = "3.56.0";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = version;
-    sha256 = "sha256-+Vfwz8xGmSzFNdiN5XYkRqGmFuBVIgexXdH3B+XYY3o=";
+    sha256 = "sha256-ZLX/3cs1cdia5+32QEwE6q3V0uFNkkmiIGboKW6Xej8=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/surface-control/default.nix
+++ b/pkgs/applications/misc/surface-control/default.nix
@ -31,7 +31,7 @@ rustPlatform.buildRustPackage rec {
      "Control various aspects of Microsoft Surface devices on Linux from the Command-Line";
    homepage = "https://github.com/linux-surface/surface-control";
    license = licenses.mit;
-    maintainers = with maintainers; [ winterqt ];
+    maintainers = with maintainers; [ ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/applications/misc/taskwarrior-tui/default.nix
+++ b/pkgs/applications/misc/taskwarrior-tui/default.nix
@ -5,19 +5,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "taskwarrior-tui";
-  version = "0.10.4";
+  version = "0.13.29";

  src = fetchFromGitHub {
    owner = "kdheepak";
    repo = "taskwarrior-tui";
    rev = "v${version}";
-    sha256 = "1rs6xpnmqzp45jkdzi8x06i8764gk7zl86sp6s0hiirbfqf7vwsy";
+    sha256 = "sha256-56+/WQESbf31UkJU4xONLY2T+WQVM0bI/x1yLZr3elI=";
  };

  # Because there's a test that requires terminal access
  doCheck = false;

-  cargoSha256 = "1c9vw1n6h7irwim1zf3mr0g520jnlvfqdy7y9v9g9xpkvbjr7ich";
+  cargoSha256 = "sha256-8am66wP2751AAMbWDBKZ89mAgr2poq3CU+aJF+I8/fs=";

  meta = with lib; {
    description = "A terminal user interface for taskwarrior ";
--- a/pkgs/applications/misc/tint2/default.nix
+++ b/pkgs/applications/misc/tint2/default.nix
@ -24,13 +24,13 @@

 stdenv.mkDerivation rec {
  pname = "tint2";
-  version = "17.0";
+  version = "17.0.1";

  src = fetchFromGitLab {
    owner = "o9000";
    repo = "tint2";
    rev = version;
-    sha256 = "1gy5kki7vqrj43yl47cw5jqwmj45f7a8ppabd5q5p1gh91j7klgm";
+    sha256 = "sha256-yiXdG0qYcdol2pA1L9ii4XiLZyyUAl8/EJop48OLoXs=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/vym/default.nix
+++ b/pkgs/applications/misc/vym/default.nix
@ -39,8 +39,6 @@ mkDerivation rec {
    install -Dm755 -t $out/share/man/man1 doc/*.1.gz
  '';

-  dontGzipMan = true;
-
  meta = with lib; {
    description = "A mind-mapping software";
    longDescription = ''
--- a/pkgs/applications/misc/waybar/default.nix
+++ b/pkgs/applications/misc/waybar/default.nix
@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
    "-Dman-pages=enabled"
  ];

-  preFixup = lib.optional withMediaPlayer ''
+  preFixup = lib.optionalString withMediaPlayer ''
      cp $src/resources/custom_modules/mediaplayer.py $out/bin/waybar-mediaplayer.py

      wrapProgram $out/bin/waybar-mediaplayer.py \
--- a/pkgs/applications/misc/wmname/default.nix
+++ b/pkgs/applications/misc/wmname/default.nix
@ -10,7 +10,7 @@ stdenv.mkDerivation rec {

  buildInputs = [ libX11 ];

-  preConfigure = [ ''sed -i "s@PREFIX = /usr/local@PREFIX = $out@g" config.mk'' ];
+  preConfigure = ''sed -i "s@PREFIX = /usr/local@PREFIX = $out@g" config.mk'';

  meta = {
    description = "Prints or set the window manager name property of the root window";
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -90,11 +90,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.28.105";
+  version = "1.28.106";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "1E2KWG5vHYBuph6Pv9J6FBOsUpegx4Ix/H99ZQ/x4zI=";
+    sha256 = "gr8d5Dh6ZHb2kThVOA61BoGo64MB77qF7ualUY2RRq0=";
  };

  dontConfigure = true;
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -169,9 +169,9 @@ let
      ./patches/no-build-timestamps.patch
      # For bundling Widevine (DRM), might be replaceable via bundle_widevine_cdm=true in gnFlags:
      ./patches/widevine-79.patch
+    ] ++ lib.optionals (versionRange "91" "94") [
      # Fix the build by adding a missing dependency (s. https://crbug.com/1197837):
      ./patches/fix-missing-atspi2-dependency.patch
-    ] ++ lib.optionals (versionRange "91" "94.0.4583.0") [
      # Required as dependency for the next patch:
      (githubPatch {
        # Reland "Reland "Linux sandbox syscall broker: use struct kernel_stat""
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -31,15 +31,15 @@
    }
  },
  "dev": {
-    "version": "94.0.4603.0",
-    "sha256": "1mhb7y7mhjbi5m79izcqvc6pjmgxvlk9vvr273k29gr2zq2m2fv3",
-    "sha256bin64": "1rqprc2vkyygwwwjk25xa2av30bqbx5dzs6nwhnzsdqwic5wdbbz",
+    "version": "94.0.4606.12",
+    "sha256": "1yv34wahg1f0l35kvlm3x17wvqdg8yyzmjj6naz2lnl5qai89zr8",
+    "sha256bin64": "19z9yzj6ig5ym8f9zzs8b4yixkspc0x62sz526r39803pbgs7s7i",
    "deps": {
      "gn": {
-        "version": "2021-07-31",
+        "version": "2021-08-11",
        "url": "https://gn.googlesource.com/gn",
-        "rev": "eea3906f0e2a8d3622080127d2005ff214d51383",
-        "sha256": "1wc969jrivb502c45wdcbgh0c5888nqxla05is9bimkrk9rqppw3"
+        "rev": "69ec4fca1fa69ddadae13f9e6b7507efa0675263",
+        "sha256": "031znmkbm504iim5jvg3gmazj4qnkfc7zg8aymjsij18fhf7piz0"
      }
    }
  },
--- a/pkgs/applications/networking/browsers/google-chrome/default.nix
+++ b/pkgs/applications/networking/browsers/google-chrome/default.nix
@ -75,6 +75,10 @@ let

  suffix = if channel != "stable" then "-" + channel else "";

+  crashpadHandlerBinary = if lib.versionAtLeast version "94"
+    then "chrome_crashpad_handler"
+    else "crashpad_handler";
+
 in stdenv.mkDerivation {
  inherit version;

@ -146,7 +150,7 @@ in stdenv.mkDerivation {
      --prefix XDG_DATA_DIRS   : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH" \
      --add-flags ${escapeShellArg commandLineArgs}

-    for elf in $out/share/google/$appname/{chrome,chrome-sandbox,crashpad_handler,nacl_helper}; do
+    for elf in $out/share/google/$appname/{chrome,chrome-sandbox,${crashpadHandlerBinary},nacl_helper}; do
      patchelf --set-rpath $rpath $elf
      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $elf
    done
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@ -52,14 +52,14 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "palemoon";
-  version = "29.3.0";
+  version = "29.4.0.1";

  src = fetchFromGitHub {
    githubBase = "repo.palemoon.org";
    owner = "MoonchildProductions";
    repo = "Pale-Moon";
    rev = "${version}_Release";
-    sha256 = "1q0w1ffmdfk22df4p2ks4n55zmz44ir8fbcdn5a5h4ihy73nf6xp";
+    sha256 = "1qzsryhlxvh9xx9j7s4dmxv575z13wdx8iigj8r0pdmg5kx6rpkb";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/networking/cluster/bosh-cli/default.nix
+++ b/pkgs/applications/networking/cluster/bosh-cli/default.nix
@ -8,13 +8,13 @@
 buildGoModule rec {
  pname = "bosh-cli";

-  version = "6.4.4";
+  version = "6.4.5";

  src = fetchFromGitHub {
    owner = "cloudfoundry";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-N7GrxePNewxhHnkQP/XBdUIEL5FsFD4avouZaIO+BKc=";
+    sha256 = "sha256-/1JRje7SNrIsb3V1tq5ZW5zsURaQUzM/Jp3TMR0MfKw=";
  };
  vendorSha256 = null;

--- a/pkgs/applications/networking/cluster/cilium/default.nix
+++ b/pkgs/applications/networking/cluster/cilium/default.nix
@ -0,0 +1,23 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "cilium-cli";
+  version = "0.8.6";
+
+  src = fetchFromGitHub {
+    owner = "cilium";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "07p62zifycw7gnwkd3230jsjns80k2q9fbj8drzp84s9cp7ddpa9";
+  };
+
+  vendorSha256 = null;
+
+  meta = with lib; {
+    description = "CLI to install, manage & troubleshoot Kubernetes clusters running Cilium";
+    license = licenses.asl20;
+    homepage = "https://www.cilium.io/";
+    maintainers = with maintainers; [ humancalico ];
+    mainProgram = "cilium";
+  };
+}
--- a/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
+++ b/pkgs/applications/networking/cluster/cloudfoundry-cli/default.nix
@ -2,17 +2,17 @@

 buildGoModule rec {
  pname = "cloudfoundry-cli";
-  version = "7.2.0";
+  version = "7.3.0";

  src = fetchFromGitHub {
    owner = "cloudfoundry";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "0cf5vshyz6j70sv7x43r1404hdcmkzxgdb7514kjilp5z6wsr1nv";
+    sha256 = "sha256-I+4tFAMmmsmi5WH9WKXIja1vVWsPHNGkWbvjWGUCmkU=";
  };
  # vendor directory stale
  deleteVendor = true;
-  vendorSha256 = "0p0s0dr7kpmmnim4fps62vj4zki2qxxdq5ww0fzrf1372xbl4kp2";
+  vendorSha256 = null;

  subPackages = [ "." ];

--- a/pkgs/applications/networking/cluster/cni/plugins.nix
+++ b/pkgs/applications/networking/cluster/cni/plugins.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "cni-plugins";
-  version = "0.9.1";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "containernetworking";
    repo = "plugins";
    rev = "v${version}";
-    sha256 = "sha256-n+OtFXgFmW0xsGEtC6ua0qjdsJSbEjn08mAl5Z51Kp8=";
+    sha256 = "sha256-RcDZW/iOAcJodGiuzmeZk3obtD0/mQoMF9vL0xNehbQ=";
  };

  vendorSha256 = null;
@ -32,7 +32,6 @@ buildGoModule rec {
    "plugins/main/vlan"
    "plugins/meta/bandwidth"
    "plugins/meta/firewall"
-    "plugins/meta/flannel"
    "plugins/meta/portmap"
    "plugins/meta/sbr"
    "plugins/meta/tuning"
--- a/pkgs/applications/networking/cluster/dnsname-cni/default.nix
+++ b/pkgs/applications/networking/cluster/dnsname-cni/default.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "cni-plugin-dnsname";
-  version = "1.2.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "dnsname";
    rev = "v${version}";
-    sha256 = "sha256-hHkQOHDso92gXFCz40iQ7j2cHTEAMsaeW8MCJV2Otqo=";
+    sha256 = "sha256-kebN1OLMOrBKBz4aBV0VYm+LmLm6S0mKnVgG2u5I+d4=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/networking/cluster/docker-machine/xhyve.nix
+++ b/pkgs/applications/networking/cluster/docker-machine/xhyve.nix
@ -17,7 +17,7 @@ buildGoPackage rec {
    export CGO_CFLAGS=-I$(pwd)/go/src/${goPackagePath}/vendor/github.com/jceel/lib9p
    export CGO_LDFLAGS=$(pwd)/go/src/${goPackagePath}/vendor/build/lib9p/lib9p.a
  '';
-  buildFlags = "--tags lib9p";
+  tags = [ "lib9p" ];

  src = fetchFromGitHub {
    rev    = "v${version}";
--- a/pkgs/applications/networking/cluster/kubebuilder/default.nix
+++ b/pkgs/applications/networking/cluster/kubebuilder/default.nix
@ -20,13 +20,13 @@ buildGoModule rec {

  subPackages = ["cmd"];

-  preBuild = ''
-    export buildFlagsArray+=("-ldflags=-X main.kubeBuilderVersion=v${version} \
-        -X main.goos=$GOOS \
-        -X main.goarch=$GOARCH \
-        -X main.gitCommit=v${version} \
-        -X main.buildDate=v${version}")
-  '';
+  ldflags = [
+    "-X main.kubeBuilderVersion=v${version}"
+    "-X main.goos=${go.GOOS}"
+    "-X main.goarch=${go.GOARCH}"
+    "-X main.gitCommit=v${version}"
+    "-X main.buildDate=v${version}"
+  ];

  doCheck = true;

--- a/pkgs/applications/networking/cluster/nerdctl/default.nix
+++ b/pkgs/applications/networking/cluster/nerdctl/default.nix
@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "nerdctl";
-  version = "0.11.0";
+  version = "0.11.1";

  src = fetchFromGitHub {
    owner = "containerd";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-uYiGerxZb5GW1dOcflERF3wvgJ8VOtRmQkyzC/ztwjk=";
+    sha256 = "sha256-r9VJQUmwe4UGCLmzxG2t9XHQ7KUeJxmEuAwxssPArcM=";
  };

-  vendorSha256 = "sha256-kGSibuXutyOvDkmajIQ0AqrwR3VUiWoM1Y2zk3MwwyU=";
+  vendorSha256 = "sha256-KnXxp/6L09a34cnv4h7vpPhNO6EGmeEC6c1ydyYXkxU=";

  nativeBuildInputs = [ makeWrapper installShellFiles ];

--- a/pkgs/applications/networking/cluster/sonobuoy/default.nix
+++ b/pkgs/applications/networking/cluster/sonobuoy/default.nix
@ -1,11 +1,11 @@
 { lib, buildGoModule, fetchFromGitHub }:

 # SHA of ${version} for the tool's help output. Unfortunately this is needed in build flags.
-let rev = "f6e19140201d6bf2f1274bf6567087bc25154210";
+let rev = "981a3ffd4368600eb1a5bca3f12a251e80895d37";
 in
 buildGoModule rec {
  pname = "sonobuoy";
-  version = "0.50.0"; # Do not forget to update `rev` above
+  version = "0.53.2"; # Do not forget to update `rev` above

  buildFlagsArray =
    let t = "github.com/vmware-tanzu/sonobuoy";
@ -17,13 +17,13 @@ buildGoModule rec {
    '';

  src = fetchFromGitHub {
-    sha256 = "sha256-LhprsDlWZjNRE6pu7V9WBszy/+bNpn5KoRopIoWvdsg=";
+    sha256 = "sha256-8bUZsknG1Z2TKWwtuJtnauK8ibikGphl3oiLXT3PZzY=";
    rev = "v${version}";
    repo = "sonobuoy";
    owner = "vmware-tanzu";
  };

-  vendorSha256 = "sha256-0Vx74nz0djJB12UPybo2Z8KVpSyKHuKPFymh/Rlpv88=";
+  vendorSha256 = "sha256-Lkwv95BZa7nFEXk1KcwXIRVpj9DZmqnWjkdrZkO/k24=";

  subPackages = [ "." ];

--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.31.3";
+  version = "0.31.5";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-I7S7B+mQxLdMWiLAkUIW39kXGU9k647OOhHysYotkfU=";
+    sha256 = "sha256-yovrqDGvw+GwzEiuveO2eLnP7mVVY5CQB0agzxIsHto=";
  };

  vendorSha256 = "sha256-CVWg2SvRO//xye05G3svGeqgaTKdRcoERrR7Tp0JZUo=";
--- a/pkgs/applications/networking/mailreaders/notmuch/default.nix
+++ b/pkgs/applications/networking/mailreaders/notmuch/default.nix
@ -83,8 +83,6 @@ stdenv.mkDerivation rec {
    moveToOutput bin/notmuch-emacs-mua $emacs
  '';

-  dontGzipMan = true; # already compressed
-
  passthru = {
    pythonSourceRoot = "notmuch-${version}/bindings/python";
    inherit version;
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@ -104,7 +104,7 @@ let
  server = source: generic {
    type = "murmur";

-    postPatch = lib.optional iceSupport ''
+    postPatch = lib.optionalString iceSupport ''
      grep -Rl '/usr/share/Ice' . | xargs sed -i 's,/usr/share/Ice/,${zeroc-ice.dev}/share/ice/,g'
    '';

--- a/pkgs/applications/networking/onionshare/default.nix
+++ b/pkgs/applications/networking/onionshare/default.nix
@ -23,12 +23,12 @@
 }:

 let
-  version = "2.3.2";
+  version = "2.3.3";
  src = fetchFromGitHub {
    owner = "micahflee";
    repo = "onionshare";
    rev = "v${version}";
-    sha256 = "sha256-mzLDvvpO82iGDnzY42wx1KCNmAxUgVhpaDVprtb+YOI=";
+    sha256 = "sha256-wU2020RNXlwJ2y9uzcLxIX4EECev1Z9YvNyiBalLj/Y=";
  };
  meta = with lib; {
    description = "Securely and anonymously send and receive files";
@ -94,6 +94,11 @@ in rec {
      # Tests use the home directory
      export HOME="$(mktemp -d)"
    '';
+
+    disabledTests = [
+      "test_firefox_like_behavior"
+      "test_if_unmodified_since"
+    ];
  };

  onionshare-gui = buildPythonApplication {
--- a/pkgs/applications/networking/sniffers/sngrep/default.nix
+++ b/pkgs/applications/networking/sniffers/sngrep/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "sngrep";
-  version = "1.4.8";
+  version = "1.4.9";

  src = fetchFromGitHub {
    owner = "irontec";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0lnwsw9x4y4lr1yh749y24f71p5zsghwh5lp28zqfanw025mipf2";
+    sha256 = "sha256-92wPRDFSoIOYFv3XKdsuYH8j3D8kXyg++q6VpIIMGDg=";
  };

  buildInputs = [
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@ -63,8 +63,6 @@ in (mkDrv rec {
    "-fno-visibility-inlines-hidden" # https://bugs.documentfoundation.org/show_bug.cgi?id=78174#c10
  ];

-  patches = [ ./xdg-open-brief.patch ];
-
  tarballPath = "external/tarballs";

  postUnpack = ''
--- a/pkgs/applications/office/libreoffice/src-fresh/override.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/override.nix
@ -7,4 +7,5 @@ attrs:
  configureFlags = attrs.configureFlags ++ [
    (lib.enableFeature kdeIntegration "kf5")
  ];
+  patches = [ ../xdg-open-brief.patch ]; # drop this when switching fresh to 7.2.0
 }
--- a/pkgs/applications/office/libreoffice/src-still/override.nix
+++ b/pkgs/applications/office/libreoffice/src-still/override.nix
@ -7,4 +7,5 @@ attrs:
  configureFlags = attrs.configureFlags ++ [
    (lib.enableFeature kdeIntegration "kf5")
  ];
+  patches = [ ../xdg-open-brief.patch ];
 }
--- a/pkgs/applications/office/portfolio/default.nix
+++ b/pkgs/applications/office/portfolio/default.nix
@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "PortfolioPerformance";
-  version = "0.54.1";
+  version = "0.54.2";

  src = fetchurl {
    url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "16sv938sdbs01byqwngrfqmzb81zfhvk72ar53l68cg8qjvzs5ml";
+    sha256 = "sha256-fKUKVeR0q8oylpwF4d3jnkON4vbQ80Fc9WYWStb67ek=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/biology/neuron/default.nix
+++ b/pkgs/applications/science/biology/neuron/default.nix
@ -60,13 +60,13 @@ stdenv.mkDerivation rec {
                        else ["--without-mpi"]);


-  postInstall = lib.optionals (python != null) [ ''
+  postInstall = lib.optionalString (python != null) ''
    ## standardise python neuron install dir if any
    if [[ -d $out/lib/python ]]; then
        mkdir -p ''${out}/${python.sitePackages}
        mv ''${out}/lib/python/*  ''${out}/${python.sitePackages}/
    fi
-  ''];
+  '';

  propagatedBuildInputs = [ readline ncurses which libtool ];

--- a/pkgs/applications/science/chemistry/pymol/default.nix
+++ b/pkgs/applications/science/chemistry/pymol/default.nix
@ -1,8 +1,18 @@
-{ lib, fetchurl, fetchFromGitHub, makeDesktopItem
-, python3, python3Packages
-, glew, glm, freeglut, libpng, libxml2, tk, freetype, msgpack }:
-
-
+{ lib
+, fetchFromGitHub
+, makeDesktopItem
+, python3
+, python3Packages
+, netcdf
+, glew
+, glm
+, freeglut
+, libpng
+, libxml2
+, tk
+, freetype
+, msgpack
+}:
 let
  pname = "pymol";
  description = "A Python-enhanced molecular graphics tool";
@ -20,15 +30,15 @@ let
 in
 python3Packages.buildPythonApplication rec {
  inherit pname;
-  version = "2.3.0";
+  version = "2.5.0";
  src = fetchFromGitHub {
    owner = "schrodinger";
    repo = "pymol-open-source";
    rev = "v${version}";
-    sha256 = "175cqi6gfmvv49i3ws19254m7ljs53fy6y82fm1ywshq2h2c93jh";
+    sha256 = "sha256-JdsgcVF1w1xFPZxVcyS+GcWg4a1Bd4SvxFOuSdlz9SM=";
  };

-  buildInputs = [ python3Packages.numpy glew glm freeglut libpng libxml2 tk freetype msgpack ];
+  buildInputs = [ python3Packages.numpy glew glm freeglut libpng libxml2 tk freetype msgpack netcdf ];
  NIX_CFLAGS_COMPILE = "-I ${libxml2.dev}/include/libxml2";
  hardeningDisable = [ "format" ];

@ -49,7 +59,7 @@ python3Packages.buildPythonApplication rec {
  '';

  meta = with lib; {
-    description = description;
+    inherit description;
    homepage = "https://www.pymol.org/";
    license = licenses.mit;
    maintainers = with maintainers; [ samlich ];
--- a/pkgs/applications/science/electronics/kicad/base.nix
+++ b/pkgs/applications/science/electronics/kicad/base.nix
@ -64,7 +64,7 @@ assert lib.assertMsg (!(sanitizeAddress && sanitizeThreads))
  "'sanitizeAddress' and 'sanitizeThreads' are mutually exclusive, use one.";

 let
-  inherit (lib) optional optionals;
+  inherit (lib) optional optionals optionalString;
 in
 stdenv.mkDerivation rec {
  pname = "kicad-base";
@ -172,7 +172,7 @@ stdenv.mkDerivation rec {

  dontStrip = debug;

-  postInstall = optional (withI18n) ''
+  postInstall = optionalString (withI18n) ''
    mkdir -p $out/share
    lndir ${i18n}/share $out/share
  '';
--- a/pkgs/applications/science/electronics/openroad/default.nix
+++ b/pkgs/applications/science/electronics/openroad/default.nix
@ -0,0 +1,94 @@
+{ lib
+, mkDerivation
+, fetchFromGitHub
+, bison
+, cmake
+, doxygen
+, flex
+, git
+, python3
+, swig4
+, boost172
+, cimg
+, eigen
+, lcov
+, lemon-graph
+, libjpeg
+, pcre
+, qtbase
+, readline
+, spdlog
+, tcl
+, tcllib
+, xorg
+, yosys
+, zlib
+}:
+
+mkDerivation rec {
+  pname = "openroad";
+  version = "2.0";
+
+  src = fetchFromGitHub {
+    owner = "The-OpenROAD-Project";
+    repo = "OpenROAD";
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "1p677xh16wskfj06jnplhpc3glibhdaqxmk0j09832chqlryzwyx";
+  };
+
+  nativeBuildInputs = [
+    bison
+    cmake
+    doxygen
+    flex
+    git
+    swig4
+  ];
+
+  buildInputs = [
+    boost172
+    cimg
+    eigen
+    lcov
+    lemon-graph
+    libjpeg
+    pcre
+    python3
+    qtbase
+    readline
+    spdlog
+    tcl
+    tcllib
+    yosys
+    xorg.libX11
+    zlib
+  ];
+
+  postPatch = ''
+    patchShebangs --build etc/find_messages.py
+  '';
+
+  # Enable output images from the placer.
+  cmakeFlags = [ "-DUSE_CIMG_LIB=ON" ];
+
+  # Resynthesis needs access to the Yosys binaries.
+  qtWrapperArgs = [ "--prefix PATH : ${lib.makeBinPath [ yosys ]}" ];
+
+  # Upstream uses vendored package versions for some dependencies, so regression testing is prudent
+  # to see if there are any breaking changes in unstable that should be vendored as well.
+  doCheck = false; # Disabled pending upstream release with fix for rcx log file creation.
+  checkPhase = ''
+    # Regression tests must be run from the project root not from within the CMake build directory.
+    cd ..
+    test/regression
+  '';
+
+  meta = with lib; {
+    description = "OpenROAD's unified application implementing an RTL-to-GDS flow";
+    homepage = "https://theopenroadproject.org";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ trepetti ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/science/math/colpack/default.nix
+++ b/pkgs/applications/science/math/colpack/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, gettext }:
+{ lib, stdenv, fetchFromGitHub, autoreconfHook }:

 stdenv.mkDerivation rec {

@ -12,20 +12,32 @@ stdenv.mkDerivation rec {
    sha256 = "1p05vry940mrjp6236c0z83yizmw9pk6ly2lb7d8rpb7j9h03glr";
  };

-  buildInputs = [ autoconf automake gettext libtool ];
+  nativeBuildInputs = [ autoreconfHook ];

-  configurePhase = ''
-    autoreconf -vif
-    ./configure --prefix=$out --enable-openmp
+  configureFlags = [
+    "--enable-openmp=${if stdenv.isLinux then "yes" else "no"}"
+    "--enable-examples=no"
+  ];
+
+  postInstall = ''
+    # Remove libtool archive
+    rm $out/lib/*.la
+
+    # Remove compiled examples (Basic examples get compiled anyway)
+    rm -r $out/examples
+
+    # Copy the example sources (Basic tree contains scripts and object files)
+    mkdir -p $out/share/ColPack/examples/Basic
+    cp SampleDrivers/Basic/*.cpp $out/share/ColPack/examples/Basic
+    cp -r SampleDrivers/Matrix* $out/share/ColPack/examples
  '';

  meta = with lib; {
    description = "A package comprising of implementations of algorithms for
    vertex coloring and derivative computation";
    homepage = "http://cscapes.cs.purdue.edu/coloringpage/software.htm#functionalities";
-    license = licenses.lgpl3;
-    platforms = platforms.linux;
+    license = licenses.lgpl3Plus;
+    platforms = platforms.unix;
    maintainers = with maintainers; [ edwtjo ];
  };
-
 }
--- a/Show More
+++ b/Show More
				`@ -0,0 +1 @@`
				`{:deps {clojupyter/clojupyter {:mvn/version "0.3.2"}}}`