Merge branch 'staging-next' into staging

2022-03-21 11:57:43 +01:00 · 2022-03-21 11:57:43 +01:00 · a519740b4c
commit a519740b4c
parent ffbe82639b b94a60e451
183 changed files with 2083 additions and 598 deletions
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -478,6 +478,12 @@
          still supported, because you can set arbitrary values in this
          freeform type.
        </para>
+        <para>
+          The <literal>listeners.*.bind_address</literal> option was
+          renamed to <literal>bind_addresses</literal> in order to match
+          the upstream <literal>homeserver.yaml</literal> option name.
+          It is now also a list of strings instead of a string.
+        </para>
        <para>
          An example to make the required migration clearer:
        </para>
@ -539,7 +545,7 @@

      listeners = [ {
        port = 8448;
-        bind_address = [
+        bind_addresses = [
          &quot;::&quot;
          &quot;0.0.0.0&quot;
        ];
@ -570,7 +576,14 @@
          Additionally a few option defaults have been synced up with
          upstream default values, for example the
          <literal>max_upload_size</literal> grew from
-          <literal>10M</literal> to <literal>50M</literal>.
+          <literal>10M</literal> to <literal>50M</literal>. For the same
+          reason, the default <literal>media_store_path</literal> was
+          changed from <literal>${dataDir}/media</literal> to
+          <literal>${dataDir}/media_store</literal> if
+          <literal>system.stateVersion</literal> is at least
+          <literal>22.05</literal>. Files will need to be manually moved
+          to the new location if the <literal>stateVersion</literal> is
+          updated.
        </para>
      </listitem>
      <listitem>
@ -834,6 +847,16 @@
          <literal>systemd.nspawn.&lt;name&gt;.execConfig.PrivateUsers = false</literal>
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The Tor SOCKS proxy is now actually disabled if
+          <literal>services.tor.client.enable</literal> is set to
+          <literal>false</literal> (the default). If you are using this
+          functionality but didn’t change the setting or set it to
+          <literal>false</literal>, you now need to set it to
+          <literal>true</literal>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The terraform 0.12 compatibility has been removed and the
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -162,6 +162,9 @@ In addition to numerous new and upgraded packages, this release has the followin
  module (`services.matrix-synapse`) now need to be moved into `services.matrix-synapse.settings`. And while not all options you
  may use are defined in there, they are still supported, because you can set arbitrary values in this freeform type.

+  The `listeners.*.bind_address` option was renamed to `bind_addresses` in order to match the upstream `homeserver.yaml` option
+  name. It is now also a list of strings instead of a string.
+
  An example to make the required migration clearer:

  Before:
@ -219,7 +222,7 @@ In addition to numerous new and upgraded packages, this release has the followin

        listeners = [ {
          port = 8448;
-          bind_address = [
+          bind_addresses = [
            "::"
            "0.0.0.0"
          ];
@ -244,7 +247,9 @@ In addition to numerous new and upgraded packages, this release has the followin

  The secrets in your original config should be migrated into a YAML file that is included via `extraConfigFiles`.

-  Additionally a few option defaults have been synced up with upstream default values, for example the `max_upload_size` grew from `10M` to `50M`.
+  Additionally a few option defaults have been synced up with upstream default values, for example the `max_upload_size` grew from `10M` to `50M`. For the same reason, the default
+  `media_store_path` was changed from `${dataDir}/media` to `${dataDir}/media_store` if `system.stateVersion` is at least `22.05`. Files will need to be manually moved to the new
+  location if the `stateVersion` is updated.

 - The MoinMoin wiki engine (`services.moinmoin`) has been removed, because Python 2 is being retired from nixpkgs.

@ -323,6 +328,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - `systemd-nspawn@.service` settings have been reverted to the default systemd behaviour. User namespaces are now activated by default. If you want to keep running nspawn containers without user namespaces you need to set `systemd.nspawn.<name>.execConfig.PrivateUsers = false`

+- The Tor SOCKS proxy is now actually disabled if `services.tor.client.enable` is set to `false` (the default). If you are using this functionality but didn't change the setting or set it to `false`, you now need to set it to `true`.
+
 - The terraform 0.12 compatibility has been removed and the `terraform.withPlugins` and `terraform-providers.mkProvider` implementations simplified. Providers now need to be stored under
 `$out/libexec/terraform-providers/<registry>/<owner>/<name>/<version>/<os>_<arch>/terraform-provider-<name>_v<version>` (which mkProvider does).

--- a/nixos/modules/services/matrix/matrix-synapse.xml
+++ b/nixos/modules/services/matrix/matrix-synapse.xml
@ -119,7 +119,7 @@ in {
    <link linkend="opt-services.matrix-synapse.settings.listeners">listeners</link> = [
      {
        <link linkend="opt-services.matrix-synapse.settings.listeners._.port">port</link> = 8008;
-        <link linkend="opt-services.matrix-synapse.settings.listeners._.bind_addresses">bind_address</link> = [ "::1" ];
+        <link linkend="opt-services.matrix-synapse.settings.listeners._.bind_addresses">bind_addresses</link> = [ "::1" ];
        <link linkend="opt-services.matrix-synapse.settings.listeners._.type">type</link> = "http";
        <link linkend="opt-services.matrix-synapse.settings.listeners._.tls">tls</link> = false;
        <link linkend="opt-services.matrix-synapse.settings.listeners._.x_forwarded">x_forwarded</link> = true;
@ -152,10 +152,10 @@ in {

  <para>
   If you want to run a server with public registration by anybody, you can
-   then enable <literal><link linkend="opt-services.matrix-synapse.settings.enable_registration">services.matrix-synapse.enable_registration</link> =
+   then enable <literal><link linkend="opt-services.matrix-synapse.settings.enable_registration">services.matrix-synapse.settings.enable_registration</link> =
   true;</literal>. Otherwise, or you can generate a registration secret with
   <command>pwgen -s 64 1</command> and set it with
-   <option><link linkend="opt-services.matrix-synapse.settings.registration_shared_secret">services.matrix-synapse.registration_shared_secret</link></option>.
+   <option><link linkend="opt-services.matrix-synapse.settings.registration_shared_secret">services.matrix-synapse.settings.registration_shared_secret</link></option>.
   To create a new user or admin, run the following after you have set the secret
   and have rebuilt NixOS:
 <screen>
--- a/nixos/modules/services/security/oauth2_proxy.nix
+++ b/nixos/modules/services/security/oauth2_proxy.nix
@ -102,17 +102,19 @@ in
    # Taken from: https://github.com/oauth2-proxy/oauth2-proxy/blob/master/providers/providers.go
    provider = mkOption {
      type = types.enum [
-        "google"
+        "adfs"
        "azure"
+        "bitbucket"
+        "digitalocean"
        "facebook"
        "github"
-        "keycloak"
        "gitlab"
+        "google"
+        "keycloak"
+        "keycloak-oidc"
        "linkedin"
        "login.gov"
-        "bitbucket"
        "nextcloud"
-        "digitalocean"
        "oidc"
      ];
      default = "google";
--- a/nixos/modules/services/security/tor.nix
+++ b/nixos/modules/services/security/tor.nix
@ -910,6 +910,11 @@ in
        ORPort = mkForce [];
        PublishServerDescriptor = mkForce false;
      })
+      (mkIf (!cfg.client.enable) {
+        # Make sure application connections via SOCKS are disabled
+        # when services.tor.client.enable is false
+        SOCKSPort = mkForce [ 0 ];
+      })
      (mkIf cfg.client.enable (
        { SOCKSPort = [ cfg.client.socksListenAddress ];
        } // optionalAttrs cfg.client.transparentProxy.enable {
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -286,6 +286,7 @@ in
  mailhog = handleTest ./mailhog.nix {};
  man = handleTest ./man.nix {};
  mariadb-galera = handleTest ./mysql/mariadb-galera.nix {};
+  mastodon = handleTestOn ["x86_64-linux" "i686-linux" "aarch64-linux"] ./web-apps/mastodon.nix {};
  matomo = handleTest ./matomo.nix {};
  matrix-appservice-irc = handleTest ./matrix-appservice-irc.nix {};
  matrix-conduit = handleTest ./matrix-conduit.nix {};
@ -521,6 +522,7 @@ in
  telegraf = handleTest ./telegraf.nix {};
  teleport = handleTest ./teleport.nix {};
  thelounge = handleTest ./thelounge.nix {};
+  terminal-emulators = handleTest ./terminal-emulators.nix {};
  tiddlywiki = handleTest ./tiddlywiki.nix {};
  tigervnc = handleTest ./tigervnc.nix {};
  timezone = handleTest ./timezone.nix {};
--- a/nixos/tests/terminal-emulators.nix
+++ b/nixos/tests/terminal-emulators.nix
@ -0,0 +1,207 @@
+# Terminal emulators all present a pretty similar interface.
+# That gives us an opportunity to easily test their basic functionality with a single codebase.
+#
+# There are two tests run on each terminal emulator
+# - can it successfully execute a command passed on the cmdline?
+# - can it successfully display a colour?
+# the latter is used as a proxy for "can it display text?", without going through all the intricacies of OCR.
+#
+# 256-colour terminal mode is used to display the test colour, since it has a universally-applicable palette (unlike 8- and 16- colour, where the colours are implementation-defined), and it is widely supported (unlike 24-bit colour).
+#
+# Future work:
+# - Wayland support (both for testing the existing terminals, and for testing wayland-only terminals like foot and havoc)
+# - Test keyboard input? (skipped for now, to eliminate the possibility of race conditions and focus issues)
+
+{ system ? builtins.currentSystem,
+  config ? {},
+  pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../lib/testing-python.nix { inherit system pkgs; };
+with pkgs.lib;
+
+let tests = {
+      alacritty.pkg = p: p.alacritty;
+
+      contour.pkg = p: p.contour;
+      contour.cmd = "contour $command";
+
+      cool-retro-term.pkg = p: p.cool-retro-term;
+      cool-retro-term.colourTest = false; # broken by gloss effect
+
+      ctx.pkg = p: p.ctx;
+      ctx.pinkValue = "#FE0065";
+
+      darktile.pkg = p: p.darktile;
+
+      eterm.pkg = p: p.eterm;
+      eterm.executable = "Eterm";
+      eterm.pinkValue = "#D40055";
+
+      germinal.pkg = p: p.germinal;
+
+      gnome-terminal.pkg = p: p.gnome.gnome-terminal;
+
+      guake.pkg = p: p.guake;
+      guake.cmd = "SHELL=$command guake --show";
+      guake.kill = true;
+
+      hyper.pkg = p: p.hyper;
+
+      kermit.pkg = p: p.kermit-terminal;
+
+      kgx.pkg = p: p.kgx;
+      kgx.cmd = "kgx -e $command";
+      kgx.kill = true;
+
+      kitty.pkg = p: p.kitty;
+      kitty.cmd = "kitty $command";
+
+      konsole.pkg = p: p.plasma5Packages.konsole;
+
+      lxterminal.pkg = p: p.lxterminal;
+
+      mate-terminal.pkg = p: p.mate.mate-terminal;
+      mate-terminal.cmd = "SHELL=$command mate-terminal --disable-factory"; # factory mode uses dbus, and we don't have a proper dbus session set up
+
+      mlterm.pkg = p: p.mlterm;
+
+      mrxvt.pkg = p: p.mrxvt;
+
+      qterminal.pkg = p: p.lxqt.qterminal;
+      qterminal.kill = true;
+
+      roxterm.pkg = p: p.roxterm;
+      roxterm.cmd = "roxterm -e $command";
+
+      sakura.pkg = p: p.sakura;
+
+      st.pkg = p: p.st;
+      st.kill = true;
+
+      stupidterm.pkg = p: p.stupidterm;
+      stupidterm.cmd = "stupidterm -- $command";
+
+      terminator.pkg = p: p.terminator;
+      terminator.cmd = "terminator -e $command";
+
+      terminology.pkg = p: p.enlightenment.terminology;
+      terminology.cmd = "SHELL=$command terminology --no-wizard=true";
+      terminology.colourTest = false; # broken by gloss effect
+
+      termite.pkg = p: p.termite;
+
+      termonad.pkg = p: p.termonad;
+
+      tilda.pkg = p: p.tilda;
+
+      tilix.pkg = p: p.tilix;
+      tilix.cmd = "tilix -e $command";
+
+      urxvt.pkg = p: p.rxvt-unicode;
+
+      wayst.pkg = p: p.wayst;
+      wayst.pinkValue = "#FF0066";
+
+      wezterm.pkg = p: p.wezterm;
+
+      xfce4-terminal.pkg = p: p.xfce.xfce4-terminal;
+
+      xterm.pkg = p: p.xterm;
+    };
+in mapAttrs (name: { pkg, executable ? name, cmd ? "SHELL=$command ${executable}", colourTest ? true, pinkValue ? "#FF0087", kill ? false }: makeTest
+{
+  name = "terminal-emulator-${name}";
+  meta = with pkgs.stdenv.lib.maintainers; {
+    maintainers = [ jjjollyjim ];
+  };
+
+  machine = { pkgsInner, ... }:
+
+  {
+    imports = [ ./common/x11.nix ./common/user-account.nix ];
+
+    # Hyper (and any other electron-based terminals) won't run as root
+    test-support.displayManager.auto.user = "alice";
+
+    environment.systemPackages = [
+      (pkg pkgs)
+      (pkgs.writeShellScriptBin "report-success" ''
+        echo 1 > /tmp/term-ran-successfully
+        ${optionalString kill "pkill ${executable}"}
+      '')
+      (pkgs.writeShellScriptBin "display-colour" ''
+        # A 256-colour background colour code for pink, then spaces.
+        #
+        # Background is used rather than foreground to minimize the effect of anti-aliasing.
+        #
+        # Keep adding more in case the window is partially offscreen to the left or requires
+        # a change to correctly redraw after initialising the window (as with ctx).
+
+        while :
+        do
+            echo -ne "\e[48;5;198m                   "
+            sleep 0.5
+        done
+        sleep infinity
+      '')
+      (pkgs.writeShellScriptBin "run-in-this-term" "sudo -u alice run-in-this-term-wrapped $1")
+
+      (pkgs.writeShellScriptBin "run-in-this-term-wrapped" "command=\"$(which \"$1\")\"; ${cmd}")
+    ];
+
+    # Helpful reminder to add this test to passthru.tests
+    warnings = if !((pkg pkgs) ? "passthru" && (pkg pkgs).passthru ? "tests") then [ "The package for ${name} doesn't have a passthru.tests" ] else [ ];
+  };
+
+  # We need imagemagick, though not tesseract
+  enableOCR = true;
+
+  testScript = { nodes, ... }: let
+  in ''
+    with subtest("wait for x"):
+        start_all()
+        machine.wait_for_x()
+
+    with subtest("have the terminal run a command"):
+        # We run this command synchronously, so we can be certain the exit codes are happy
+        machine.${if kill then "execute" else "succeed"}("run-in-this-term report-success")
+        machine.wait_for_file("/tmp/term-ran-successfully")
+    ${optionalString colourTest ''
+
+    import tempfile
+    import subprocess
+
+
+    def check_for_pink(final=False) -> bool:
+        with tempfile.NamedTemporaryFile() as tmpin:
+            machine.send_monitor_command("screendump {}".format(tmpin.name))
+
+            cmd = 'convert {} -define histogram:unique-colors=true -format "%c" histogram:info:'.format(
+                tmpin.name
+            )
+            ret = subprocess.run(cmd, shell=True, capture_output=True)
+            if ret.returncode != 0:
+                raise Exception(
+                    "image analysis failed with exit code {}".format(ret.returncode)
+                )
+
+            text = ret.stdout.decode("utf-8")
+            return "${pinkValue}" in text
+
+
+    with subtest("ensuring no pink is present without the terminal"):
+        assert (
+            check_for_pink() == False
+        ), "Pink was present on the screen before we even launched a terminal!"
+
+    with subtest("have the terminal display a colour"):
+        # We run this command in the background
+        machine.shell.send(b"(run-in-this-term display-colour |& systemd-cat -t terminal) &\n")
+
+        with machine.nested("Waiting for the screen to have pink on it:"):
+            retry(check_for_pink)
+  ''}'';
+}
+
+  ) tests
--- a/nixos/tests/web-apps/mastodon.nix
+++ b/nixos/tests/web-apps/mastodon.nix
@ -0,0 +1,170 @@
+import ../make-test-python.nix ({pkgs, ...}:
+let
+  test-certificates = pkgs.runCommandLocal "test-certificates" { } ''
+    mkdir -p $out
+    echo insecure-root-password > $out/root-password-file
+    echo insecure-intermediate-password > $out/intermediate-password-file
+    ${pkgs.step-cli}/bin/step certificate create "Example Root CA" $out/root_ca.crt $out/root_ca.key --password-file=$out/root-password-file --profile root-ca
+    ${pkgs.step-cli}/bin/step certificate create "Example Intermediate CA 1" $out/intermediate_ca.crt $out/intermediate_ca.key --password-file=$out/intermediate-password-file --ca-password-file=$out/root-password-file --profile intermediate-ca --ca $out/root_ca.crt --ca-key $out/root_ca.key
+  '';
+
+  hosts = ''
+    192.168.2.10 ca.local
+    192.168.2.11 mastodon.local
+  '';
+
+in
+{
+  name = "mastodon";
+  meta.maintainers = with pkgs.lib.maintainers; [ erictapen izorkin ];
+
+  nodes = {
+    ca = { pkgs, ... }: {
+      networking = {
+        interfaces.eth1 = {
+          ipv4.addresses = [
+            { address = "192.168.2.10"; prefixLength = 24; }
+          ];
+        };
+        extraHosts = hosts;
+      };
+      services.step-ca = {
+        enable = true;
+        address = "0.0.0.0";
+        port = 8443;
+        openFirewall = true;
+        intermediatePasswordFile = "${test-certificates}/intermediate-password-file";
+        settings = {
+          dnsNames = [ "ca.local" ];
+          root = "${test-certificates}/root_ca.crt";
+          crt = "${test-certificates}/intermediate_ca.crt";
+          key = "${test-certificates}/intermediate_ca.key";
+          db = {
+            type = "badger";
+            dataSource = "/var/lib/step-ca/db";
+          };
+          authority = {
+            provisioners = [
+              {
+                type = "ACME";
+                name = "acme";
+              }
+            ];
+          };
+        };
+      };
+    };
+
+    server = { pkgs, ... }: {
+      networking = {
+        interfaces.eth1 = {
+          ipv4.addresses = [
+            { address = "192.168.2.11"; prefixLength = 24; }
+          ];
+        };
+        extraHosts = hosts;
+        firewall.allowedTCPPorts = [ 80 443 ];
+      };
+
+      security = {
+        acme = {
+          acceptTerms = true;
+          defaults.server = "https://ca.local:8443/acme/acme/directory";
+          defaults.email = "mastodon@mastodon.local";
+        };
+        pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
+      };
+
+      services.redis.servers.mastodon = {
+        enable = true;
+        bind = "127.0.0.1";
+        port = 31637;
+      };
+
+      services.mastodon = {
+        enable = true;
+        configureNginx = true;
+        localDomain = "mastodon.local";
+        enableUnixSocket = false;
+        redis = {
+          createLocally = true;
+          host = "127.0.0.1";
+          port = 31637;
+        };
+        database = {
+          createLocally = true;
+          host = "/run/postgresql";
+          port = 5432;
+        };
+        smtp = {
+          createLocally = false;
+          fromAddress = "mastodon@mastodon.local";
+        };
+        extraConfig = {
+          EMAIL_DOMAIN_ALLOWLIST = "example.com";
+        };
+      };
+    };
+
+    client = { pkgs, ... }: {
+      environment.systemPackages = [ pkgs.jq ];
+      networking = {
+        interfaces.eth1 = {
+          ipv4.addresses = [
+            { address = "192.168.2.12"; prefixLength = 24; }
+          ];
+        };
+        extraHosts = hosts;
+      };
+
+      security = {
+        pki.certificateFiles = [ "${test-certificates}/root_ca.crt" ];
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    ca.wait_for_unit("step-ca.service")
+    ca.wait_for_open_port(8443)
+
+    server.wait_for_unit("nginx.service")
+    server.wait_for_unit("redis-mastodon.service")
+    server.wait_for_unit("postgresql.service")
+    server.wait_for_unit("mastodon-sidekiq.service")
+    server.wait_for_unit("mastodon-streaming.service")
+    server.wait_for_unit("mastodon-web.service")
+    server.wait_for_open_port(55000)
+    server.wait_for_open_port(55001)
+
+    # Check Mastodon version from remote client
+    client.succeed("curl --fail https://mastodon.local/api/v1/instance | jq -r '.version' | grep '${pkgs.mastodon.version}'")
+
+    # Check using admin CLI
+    # Check Mastodon version
+    server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl version' | grep '${pkgs.mastodon.version}'")
+
+    # Manage accounts
+    server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl email_domain_blocks add example.com'")
+    server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl email_domain_blocks list' | grep 'example.com'")
+    server.fail("su - mastodon -s /bin/sh -c 'mastodon-env tootctl email_domain_blocks list' | grep 'mastodon.local'")
+    server.fail("su - mastodon -s /bin/sh -c 'mastodon-env tootctl accounts create alice --email=alice@example.com'")
+    server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl email_domain_blocks remove example.com'")
+    server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl accounts create bob --email=bob@example.com'")
+    server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl accounts approve bob'")
+    server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl accounts delete bob'")
+
+    # Manage IP access
+    server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl ip_blocks add 192.168.0.0/16 --severity=no_access'")
+    server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl ip_blocks export' | grep '192.168.0.0/16'")
+    server.fail("su - mastodon -s /bin/sh -c 'mastodon-env tootctl p_blocks export' | grep '172.16.0.0/16'")
+    client.fail("curl --fail https://mastodon.local/about")
+    server.succeed("su - mastodon -s /bin/sh -c 'mastodon-env tootctl ip_blocks remove 192.168.0.0/16'")
+    client.succeed("curl --fail https://mastodon.local/about")
+
+    ca.shutdown()
+    server.shutdown()
+    client.shutdown()
+  '';
+})
--- a/nixos/tests/wine.nix
+++ b/nixos/tests/wine.nix
@ -3,7 +3,7 @@
 }:

 let
-  inherit (pkgs.lib) concatMapStrings listToAttrs;
+  inherit (pkgs.lib) concatMapStrings listToAttrs optionals optionalString;
  inherit (import ../lib/testing-python.nix { inherit system pkgs; }) makeTest;

  hello32 = "${pkgs.pkgsCross.mingw32.hello}/bin/hello.exe";
@ -27,6 +27,9 @@ let
              "bash -c 'wine ${exe} 2> >(tee wine-stderr >&2)'"
          )
          assert 'Hello, world!' in greeting
+        ''
+        # only the full version contains Gecko, but the error is not printed reliably in other variants
+        + optionalString (variant == "full") ''
          machine.fail(
              "fgrep 'Could not find Wine Gecko. HTML rendering will be disabled.' wine-stderr"
          )
@ -37,5 +40,9 @@ let

  variants = [ "base" "full" "minimal" "staging" "unstable" "wayland" ];

-in listToAttrs (map (makeWineTest "winePackages" [ hello32 ]) variants
-  ++ map (makeWineTest "wineWowPackages" [ hello32 hello64 ]) variants)
+in
+listToAttrs (
+  map (makeWineTest "winePackages" [ hello32 ]) variants
+  ++ optionals pkgs.stdenv.is64bit
+    (map (makeWineTest "wineWowPackages" [ hello32 hello64 ]) variants)
+)
--- a/pkgs/applications/audio/cider/default.nix
+++ b/pkgs/applications/audio/cider/default.nix
@ -0,0 +1,30 @@
+{ appimageTools, lib, fetchurl }:
+
+appimageTools.wrapType2 rec {
+  pname = "cider";
+  version = "1.3.1308";
+
+  src = fetchurl {
+    url = "https://1308-429851205-gh.circle-artifacts.com/0/%7E/Cider/dist/artifacts/Cider-${version}.AppImage";
+    sha256 = "1lbyvn1c8155p039qfzx7jwad7km073phkmrzjm0w3ahdpwz3wgi";
+  };
+
+  extraInstallCommands =
+    let contents = appimageTools.extract { inherit pname version src; };
+    in ''
+      mv $out/bin/${pname}-${version} $out/bin/${pname}
+
+      install -m 444 -D ${contents}/${pname}.desktop -t $out/share/applications
+      substituteInPlace $out/share/applications/${pname}.desktop \
+        --replace 'Exec=AppRun' 'Exec=${pname}'
+      cp -r ${contents}/usr/share/icons $out/share
+    '';
+
+  meta = with lib; {
+    description = "A new look into listening and enjoying Apple Music in style and performance.";
+    homepage = "https://github.com/ciderapp/Cider";
+    license = licenses.agpl3;
+    maintainers = [ maintainers.cigrainger ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/audio/eteroj.lv2/default.nix
+++ b/pkgs/applications/audio/eteroj.lv2/default.nix
@ -1,23 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, libuv, lv2 }:
-
-stdenv.mkDerivation rec {
-  pname = "eteroj.lv2";
-  version = "0.4.0";
-
-  src = fetchFromGitHub {
-    owner  = "OpenMusicKontrollers";
-    repo   = pname;
-    rev    = version;
-    sha256 = "0lzdk7hlz3vqgshrfpj0izjad1fmsnzk2vxqrry70xgz8xglvnmn";
-  };
-
-  buildInputs = [ libuv lv2 ];
-  nativeBuildInputs = [ cmake pkg-config ];
-
-  meta = with lib; {
-    description = "OSC injection/ejection from/to UDP/TCP/Serial for LV2";
-    homepage = "https://open-music-kontrollers.ch/lv2/eteroj";
-    license = licenses.artistic2;
-    maintainers = with maintainers; [ magnetophon ];
-  };
-}
--- a/pkgs/applications/audio/furnace/default.nix
+++ b/pkgs/applications/audio/furnace/default.nix
@ -1,8 +1,9 @@
 { stdenv
 , lib
-, nix-update-script
+, gitUpdater
+, testVersion
+, furnace
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , pkg-config
 , makeWrapper
@ -18,24 +19,16 @@

 stdenv.mkDerivation rec {
  pname = "furnace";
-  version = "0.5.6";
+  version = "0.5.8";

  src = fetchFromGitHub {
    owner = "tildearrow";
    repo = "furnace";
    rev = "v${version}";
    fetchSubmodules = true;
-    sha256 = "sha256-BcaPQuDFkAaxFQKwoI6xdSWcyHo5VsqZcwf++JISqRs=";
+    sha256 = "103ymd3wa1sfsr6qg15vpcs53j350i7zidv3azlf7cynk6k28xim";
  };

-  patches = [
-    (fetchpatch {
-      name = "0001-furnace-fix-wrong-include-path.patch";
-      url = "https://github.com/tildearrow/furnace/commit/456db22f9d9f0ed40d74fe50dde492e69e901fcc.patch";
-      sha256 = "17ikb1z9ldm7kdj00m4swsrq1qx94vlzhc6h020x3ryzwnglc8d3";
-    })
-  ];
-
  postPatch = ''
    # rtmidi is not used yet
    sed -i -e '/add_subdirectory(extern\/rtmidi/d' -e '/DEPENDENCIES_LIBRARIES rtmidi/d' CMakeLists.txt
@ -85,8 +78,16 @@ stdenv.mkDerivation rec {
    cp -r ../demos $out/share/furnace/
  '';

-  passthru.updateScript = nix-update-script {
-    attrPath = pname;
+  passthru = {
+    updateScript = gitUpdater {
+      inherit pname version;
+      rev-prefix = "v";
+    };
+    tests.version = testVersion {
+      package = furnace;
+      # The command always exits with code 1
+      command = "(furnace --version || [ $? -eq 1 ])";
+    };
  };

  meta = with lib; {
--- a/pkgs/applications/audio/lv2lint/default.nix
+++ b/pkgs/applications/audio/lv2lint/default.nix
@ -0,0 +1,22 @@
+{ stdenv, lib, fetchurl, pkg-config, meson, ninja, lv2, lilv, curl, libelf }:
+
+stdenv.mkDerivation rec {
+  pname = "lv2lint";
+  version = "0.14.0";
+
+  src = fetchurl {
+    url = "https://git.open-music-kontrollers.ch/lv2/${pname}/snapshot/${pname}-${version}.tar.xz";
+    sha256 = "sha256-yPKM7RToLNBT+AXSjfxxpncESmv89/wcGCt//pnEGqI=";
+  };
+
+  nativeBuildInputs = [ pkg-config meson ninja ];
+  buildInputs = [ lv2 lilv curl libelf ];
+
+  meta = with lib; {
+    description = "Check whether a given LV2 plugin is up to the specification";
+    homepage = "https://open-music-kontrollers.ch/lv2/${pname}:";
+    license = licenses.artistic2;
+    maintainers = [ maintainers.magnetophon ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/audio/open-music-kontrollers/eteroj.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/eteroj.nix
@ -0,0 +1,10 @@
+{ callPackage, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "eteroj";
+  version = "0.10.0";
+
+  sha256 = "18iv1sdwm0g6b53shsylj6bf3svmvvy5xadhfsgb4xg39qr07djz";
+
+  description = "OSC injection/ejection from/to UDP/TCP/Serial for LV2";
+})
--- a/pkgs/applications/audio/open-music-kontrollers/generic.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/generic.nix
@ -0,0 +1,37 @@
+{ stdenv, lib, fetchurl, pkg-config, meson, ninja, libGLU, lv2, serd, sord, libX11, libXext, glew, lv2lint
+, pname, version, sha256, description
+, url ? "https://git.open-music-kontrollers.ch/lv2/${pname}.lv2/snapshot/${pname}.lv2-${version}.tar.xz"
+, additionalBuildInputs ? []
+, postPatch ? ""
+, ...
+}:
+
+stdenv.mkDerivation {
+  inherit pname;
+
+  inherit version;
+
+  inherit postPatch;
+
+  src = fetchurl {
+    url = url;
+    sha256 = sha256;
+  };
+  nativeBuildInputs = [ pkg-config meson ninja ];
+  buildInputs = [
+    lv2
+    sord
+    libX11
+    libXext
+    glew
+    lv2lint
+  ] ++ additionalBuildInputs;
+
+  meta = with lib; {
+    description = description;
+    homepage = "https://open-music-kontrollers.ch/lv2/${pname}:";
+    license = licenses.artistic2;
+    maintainers = [ maintainers.magnetophon ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/applications/audio/open-music-kontrollers/jit.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/jit.nix
@ -0,0 +1,12 @@
+{ callPackage, lv2, fontconfig, libvterm-neovim, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "jit";
+  version = "unstable-2021-08-15";
+  url = "https://git.open-music-kontrollers.ch/lv2/${pname}.lv2/snapshot/${pname}.lv2-1f5d6935049fc0dd5a4dc257b84b36d2048f2d83.tar.xz";
+  sha256 = "sha256-XGICowVb0JgLJpn2h9GtViobYTdmo1LJ7/JFEyVsIqU=";
+
+  additionalBuildInputs = [ lv2 fontconfig libvterm-neovim ];
+
+  description = "A Just-in-Time C/Rust compiler embedded in an LV2 plugin";
+})
--- a/pkgs/applications/audio/open-music-kontrollers/mephisto.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/mephisto.nix
@ -0,0 +1,17 @@
+{ callPackage, faust, fontconfig, cmake, libvterm-neovim, libevdev, libglvnd, fira-code, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "mephisto";
+  version = "0.16.0";
+
+  sha256 = "0vgr3rsvdj4w0xpc5iqpvyqilk42wr9zs8bg26sfv3f2wi4hb6gx";
+
+  additionalBuildInputs = [ faust fontconfig cmake libvterm-neovim libevdev libglvnd fira-code ];
+
+  # see: https://github.com/OpenMusicKontrollers/mephisto.lv2/issues/6
+  postPatch = ''
+    sed -i 's/llvm-c-dsp/llvm-dsp-c/g' mephisto.c
+  '';
+
+  description = "A Just-in-time FAUST embedded in an LV2 plugin";
+})
--- a/pkgs/applications/audio/open-music-kontrollers/midi_matrix.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/midi_matrix.nix
@ -0,0 +1,10 @@
+{ callPackage, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "midi_matrix";
+  version = "0.30.0";
+
+  sha256 = "1nwmfxdzk4pvbwcgi3d7v4flqc10bmi2fxhrhrpfa7cafqs40ib6";
+
+  description = "An LV2 MIDI channel matrix patcher";
+})
--- a/pkgs/applications/audio/open-music-kontrollers/moony.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/moony.nix
@ -0,0 +1,13 @@
+{ callPackage, cairo, libvterm-neovim, robodoc, cmake, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "moony";
+  version = "0.40.0";
+
+  sha256 = "sha256-9a3gR3lV8xFFTDZD+fJPCALVztgmggzyIpsPZCOw/uY=";
+
+  additionalBuildInputs = [ cairo libvterm-neovim robodoc cmake ];
+
+  description = "Realtime Lua as programmable glue in LV2";
+
+})
--- a/pkgs/applications/audio/open-music-kontrollers/orbit.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/orbit.nix
@ -0,0 +1,12 @@
+{ callPackage, zlib, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "orbit";
+  version = "unstable-2021-04-13";
+  url = "https://git.open-music-kontrollers.ch/lv2/${pname}.lv2/snapshot/${pname}.lv2-f4aa620fc8d77418856581a6a955192af15b3860.tar.xz";
+  sha256 = "0z8d8h2w8fb2zx84n697jvy32dc0vf60jyiyh4gm22prgr2dvgkc";
+
+  additionalBuildInputs = [ zlib ];
+
+  description = "An LV2 time event manipulation plugin bundle";
+})
--- a/pkgs/applications/audio/open-music-kontrollers/patchmatrix.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/patchmatrix.nix
@ -0,0 +1,13 @@
+{ callPackage, libjack2, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "patchmatrix";
+  version = "0.26.0";
+
+  url = "https://git.open-music-kontrollers.ch/lad/${pname}/snapshot/${pname}-${version}.tar.xz";
+  sha256 = "sha256-cqPHCnrAhHB6a0xmPUYOAsZfLsqnGpXEuGR1W6i6W7I=";
+
+  additionalBuildInputs = [ libjack2 ];
+
+  description = "A JACK patchbay in flow matrix style";
+})
--- a/pkgs/applications/audio/open-music-kontrollers/router.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/router.nix
@ -0,0 +1,11 @@
+{ callPackage, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "router";
+  version = "unstable-2021-04-13";
+
+  url = "https://git.open-music-kontrollers.ch/lv2/${pname}.lv2/snapshot/${pname}.lv2-7d754dd64c540d40b828166401617715dc235ca3.tar.xz";
+  sha256 = "sha256-LjaW5Xdxfjzd6IJ2ptHzmHt7fhU1HQo7ubZ4USVqRE8=";
+
+  description = "An atom/audio/CV router LV2 plugin bundle";
+})
--- a/pkgs/applications/audio/open-music-kontrollers/sherlock.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/sherlock.nix
@ -0,0 +1,12 @@
+{ callPackage, sratom, flex, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "sherlock";
+  version = "0.28.0";
+
+  sha256 = "07zj88s1593fpw2s0r3ix7cj2icfd9zyirsyhr2i8l6d30b6n6fb";
+
+  additionalBuildInputs = [ sratom flex ];
+
+  description = "Plugins for visualizing LV2 atom, MIDI and OSC events";
+})
--- a/pkgs/applications/audio/open-music-kontrollers/synthpod.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/synthpod.nix
@ -0,0 +1,13 @@
+{ callPackage, lilv, libjack2, alsa-lib, zita-alsa-pcmi, libxcb, xcbutilxrm, sratom, gtk2, qt5,  libvterm-neovim, robodoc, cmake,... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "synthpod";
+  version = "unstable-2021-10-22";
+
+  url = "https://git.open-music-kontrollers.ch/lv2/synthpod/snapshot/synthpod-6f284bdad882037a522c120af92b96d8abf2de60.tar.xz";
+  sha256 = "sha256-59WBlOKum5Pcmq2CfFfRHCNEa8uPCoBk0kSjFlIcypw=";
+
+  additionalBuildInputs = [ lilv libjack2 alsa-lib zita-alsa-pcmi libxcb xcbutilxrm sratom gtk2 qt5.qtbase qt5.wrapQtAppsHook libvterm-neovim robodoc cmake ];
+
+  description = "Lightweight Nonlinear LV2 Plugin Container";
+})
--- a/pkgs/applications/audio/open-music-kontrollers/vm.nix
+++ b/pkgs/applications/audio/open-music-kontrollers/vm.nix
@ -0,0 +1,10 @@
+{ callPackage, ... } @ args:
+
+callPackage ./generic.nix (args // rec {
+  pname = "vm";
+  version = "0.14.0";
+
+  sha256 = "013gq7jn556nkk1nq6zzh9nmp3fb36jd7ndzvyq3qryw7khzkagc";
+
+  description = "A programmable virtual machine LV2 plugin";
+})
--- a/pkgs/applications/audio/patchmatrix/default.nix
+++ b/pkgs/applications/audio/patchmatrix/default.nix
@ -1,45 +0,0 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, libjack2
-, lv2
-, meson
-, ninja
-, pkg-config
-, glew
-, xorg
-}:
-
-stdenv.mkDerivation rec {
-  pname = "patchmatrix";
-  version = "0.26.0";
-
-  src = fetchFromGitHub {
-    owner = "OpenMusicKontrollers";
-    repo = pname;
-    rev = version;
-    hash = "sha256-rR3y5rGzmib//caPmhthvMelAdHRvV0lMRfvcj9kcCg=";
-  };
-
-  nativeBuildInputs = [
-    meson
-    ninja
-    pkg-config
-  ];
-
-  buildInputs = [
-    glew
-    libjack2
-    lv2
-    xorg.libX11
-    xorg.libXext
-  ];
-
-  meta = with lib; {
-    description = "A JACK patchbay in flow matrix style";
-    homepage = "https://github.com/OpenMusicKontrollers/patchmatrix";
-    license = licenses.artistic2;
-    maintainers = with maintainers; [ pennae ];
-    platforms = platforms.linux;
-  };
-}
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "pt2-clone";
-  version = "1.42";
+  version = "1.43";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "pt2-clone";
    rev = "v${version}";
-    sha256 = "sha256-CwnEvQsxrYStJ4RxnE0lHt1fBHQEZrjSldnQnTOPaE0=";
+    sha256 = "sha256-+sHGjgDqizv/9n0dDj8knsl+4MBfO3/pMkmD+MPsuNM=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/audio/pyradio/default.nix
+++ b/pkgs/applications/audio/pyradio/default.nix
@ -2,7 +2,7 @@

 python3Packages.buildPythonApplication rec {
  pname = "pyradio";
-  version = "0.8.9.14";
+  version = "0.8.9.15";

  propagatedBuildInputs = with python3Packages; [
    requests
@ -14,7 +14,7 @@ python3Packages.buildPythonApplication rec {
    owner = "coderholic";
    repo = pname;
    rev = version;
-    sha256 = "sha256-9q+YsQPFB7Ql5WnXvPj100cD7pGkmr1hHztqbpZStt8=";
+    sha256 = "sha256-r4T7t8Q46N59jqTkvdKBo6tffkrOYhoO/CZWvkBHOAQ=";
  };

  checkPhase = ''
--- a/pkgs/applications/audio/vocal/default.nix
+++ b/pkgs/applications/audio/vocal/default.nix
@ -56,7 +56,6 @@ stdenv.mkDerivation rec {
    libgee
    libnotify
    libunity
-    pantheon.elementary-icon-theme
    pantheon.granite
    sqlite
    webkitgtk
@ -73,6 +72,13 @@ stdenv.mkDerivation rec {
    })
  ];

+  postPatch = ''
+    # Fix build with vala 0.56
+    # https://github.com/needle-and-thread/vocal/pull/503
+    substituteInPlace src/Vocal.vala \
+      --replace "public const OptionEntry[] app_options" "private const OptionEntry[] app_options"
+  '';
+
  passthru = {
    updateScript = nix-update-script {
      attrPath = pname;
--- a/pkgs/applications/blockchains/chia/default.nix
+++ b/pkgs/applications/blockchains/chia/default.nix
@ -6,14 +6,14 @@

 let chia = python3Packages.buildPythonApplication rec {
  pname = "chia";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "Chia-Network";
    repo = "chia-blockchain";
    rev = version;
    fetchSubmodules = true;
-    hash = "sha256-eUvZc/7gqGkCB2tNKdwqKOmOgEcG9a/7TSvvyQzhNcQ=";
+    hash = "sha256-nH6rCzIQu5oWsdEHa+UkvbWeUGjrtpEKVEcLmSoor5k=";
  };

  postPatch = ''
@ -50,6 +50,7 @@ let chia = python3Packages.buildPythonApplication rec {
    dnslib
    dnspythonchia
    fasteners
+    filelock
    keyrings-cryptfile
    pyyaml
    setproctitle
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@ -8,13 +8,13 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "polkadot";
-  version = "0.9.16";
+  version = "0.9.17";

  src = fetchFromGitHub {
    owner = "paritytech";
    repo = "polkadot";
    rev = "v${version}";
-    sha256 = "sha256-NXuYUmo80rrBZCcuISKon48SKyyJrkzCEhggxaJNfBM=";
+    sha256 = "sha256-m47Y4IXGc43XLs5d6ehlD0A53BWC5kO3K2BS/xbYgl8=";

    # see the comment below on fakeGit for how this is used
    leaveDotGit = true;
@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
    '';
  };

-  cargoSha256 = "sha256-PIORMTzQbMdlrKwuF4MiGrLlg2nQpgLRsaHHeiCbqrg=";
+  cargoSha256 = "sha256-JBacioy2woAfKQuK6tXU9as4DNc+3uY3F3GWksCf6WU=";

  nativeBuildInputs =
    let
--- a/pkgs/applications/editors/cudatext/default.nix
+++ b/pkgs/applications/editors/cudatext/default.nix
@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "cudatext";
-  version = "1.156.2";
+  version = "1.158.2";

  src = fetchFromGitHub {
    owner = "Alexey-T";
    repo = "CudaText";
    rev = version;
-    sha256 = "sha256-waVTNyK3OHpOvBJrXio+Xjn9q3WmUczbx3E26ChsuKo=";
+    sha256 = "sha256-YrRG+LaG39q/6Ry3cXo9XUwtvokkBl96XuQfE22QxZI=";
  };

  postPatch = ''
--- a/pkgs/applications/editors/cudatext/deps.json
+++ b/pkgs/applications/editors/cudatext/deps.json
@ -1,23 +1,23 @@
 {
  "EncConv": {
    "owner": "Alexey-T",
-    "rev": "2021.01.01",
-    "sha256": "18fp7yz2rl80a6xw7v4bgc4092l74fb6p6z4yf312r7gw7b8naq6"
+    "rev": "2022.03.02",
+    "sha256": "sha256-fBN6Ix5CqhzMbNrWGn6nw6+JRDmEfqe6o8JGHERkiPE="
  },
  "ATBinHex-Lazarus": {
    "owner": "Alexey-T",
-    "rev": "2021.07.02",
-    "sha256": "sha256-XSt2XfHMiF/ZIf07M65u+k5FjacyToL0rWbpcflKcuY="
+    "rev": "2021.11.17",
+    "sha256": "sha256-wdYH0sISFNx42zt07gLn9ANxcyrq3WrbRhWfTFgPQWw="
  },
  "ATFlatControls": {
    "owner": "Alexey-T",
-    "rev": "2021.11.11",
-    "sha256": "sha256-lbRRiA8CHWmosJefTHrP2cTgU8nlK1SmNcppG6Bl54I="
+    "rev": "2022.03.17",
+    "sha256": "sha256-zpirFZcqIT53tZhgxQGdwVB6pA98SQLr1o3f+Lhq2QY="
  },
  "ATSynEdit": {
    "owner": "Alexey-T",
-    "rev": "2022.02.19",
-    "sha256": "sha256-cq2dirFNPaWRmZJu0F+CFA//+SuFOOpTH3Q5zL4oPQo="
+    "rev": "2022.03.17",
+    "sha256": "sha256-aJZGHodydkqfe2BJLKWUzIX6vbdiGKs4z5ZqtteM6NU="
  },
  "ATSynEdit_Cmp": {
    "owner": "Alexey-T",
@ -26,13 +26,13 @@
  },
  "EControl": {
    "owner": "Alexey-T",
-    "rev": "2022.02.02",
-    "sha256": "sha256-T/6SQJHKzbv/PlObDyc9bcpC14krHgcLDQn0v2fNkLM="
+    "rev": "2022.03.17",
+    "sha256": "sha256-sWRKRhUYf07TIrVWRqtpsYPZu0dPm0EhSIqoDLmkG0Y="
  },
  "ATSynEdit_Ex": {
    "owner": "Alexey-T",
-    "rev": "2022.02.01",
-    "sha256": "sha256-FAcq6ixmFPQFBAGG2gqB4T+YGYT+Rh/OlKdGcH/iL3g="
+    "rev": "2022.03.17",
+    "sha256": "sha256-FndLHJuCOyFr0IGUL4zFRjkEvTyNF3tHUO/Wx5IaV2Y="
  },
  "Python-for-Lazarus": {
    "owner": "Alexey-T",
--- a/pkgs/applications/emulators/vice/default.nix
+++ b/pkgs/applications/emulators/vice/default.nix
@ -23,6 +23,108 @@
 , file
 }:

+let
+  desktopItems = [
+    (makeDesktopItem {
+      name = "x128";
+      exec = "x128";
+      comment = "VICE: C128 Emulator";
+      desktopName = "VICE: C128 Emulator";
+      genericName = "Commodore 128 emulator";
+      categories = [ "System" ];
+    })
+
+    (makeDesktopItem {
+      name = "x64";
+      exec = "x64";
+      comment = "VICE: C64 Emulator";
+      desktopName = "VICE: C64 Emulator";
+      genericName = "Commodore 64 emulator";
+      categories = [ "System" ];
+    })
+
+    (makeDesktopItem {
+      name = "x64dtv";
+      exec = "x64dtv";
+      comment = "VICE: C64 DTV Emulator";
+      desktopName = "VICE: C64 DTV Emulator";
+      genericName = "Commodore 64 DTV emulator";
+      categories = [ "System" ];
+    })
+
+    (makeDesktopItem {
+      name = "x64sc";
+      exec = "x64sc";
+      comment = "VICE: C64 SC Emulator";
+      desktopName = "VICE: C64 SC Emulator";
+      genericName = "Commodore 64 SC emulator";
+      categories = [ "System" ];
+    })
+
+    (makeDesktopItem {
+      name = "xcbm2";
+      exec = "xcbm2";
+      comment = "VICE: CBM-II B-Model Emulator";
+      desktopName = "VICE: CBM-II B-Model Emulator";
+      genericName = "CBM-II B-Model Emulator";
+      categories = [ "System" ];
+    })
+
+    (makeDesktopItem {
+      name = "xcbm5x0";
+      exec = "xcbm5x0";
+      comment = "VICE: CBM-II P-Model Emulator";
+      desktopName = "VICE: CBM-II P-Model Emulator";
+      genericName = "CBM-II P-Model Emulator";
+      categories = [ "System" ];
+    })
+
+    (makeDesktopItem {
+      name = "xpet";
+      exec = "xpet";
+      comment = "VICE: PET Emulator";
+      desktopName = "VICE: PET Emulator";
+      genericName = "Commodore PET Emulator";
+      categories = [ "System" ];
+    })
+
+    (makeDesktopItem {
+      name = "xplus4";
+      exec = "xplus4";
+      comment = "VICE: PLUS4 Emulator";
+      desktopName = "VICE: PLUS4 Emulator";
+      genericName = "Commodore PLUS4 Emulator";
+      categories = [ "System" ];
+    })
+
+    (makeDesktopItem {
+      name = "xscpu64";
+      exec = "xscpu64";
+      comment = "VICE: SCPU64 Emulator";
+      desktopName = "VICE: SCPU64 Emulator";
+      genericName = "Commodore SCPU64 Emulator";
+      categories = [ "System" ];
+    })
+
+    (makeDesktopItem {
+      name = "xvic";
+      exec = "xvic";
+      comment = "VICE: VIC-20 Emulator";
+      desktopName = "VICE: VIC-20 Emulator";
+      genericName = "Commodore VIC-20 Emulator";
+      categories = [ "System" ];
+    })
+
+    (makeDesktopItem {
+      name = "vsid";
+      exec = "vsid";
+      comment = "VSID: The SID Emulator";
+      desktopName = "VSID: The SID Emulator";
+      genericName = "SID Emulator";
+      categories = [ "System" ];
+    })
+  ];
+in
 stdenv.mkDerivation rec {
  pname = "vice";
  version = "3.6.1";
@ -59,15 +161,6 @@ stdenv.mkDerivation rec {
  dontDisableStatic = true;
  configureFlags = [ "--enable-fullscreen" "--enable-gnomeui" "--disable-pdf-docs" ];

-  desktopItem = makeDesktopItem {
-    name = "vice";
-    exec = "x64";
-    comment = "Commodore 64 emulator";
-    desktopName = "VICE";
-    genericName = "Commodore 64 emulator";
-    categories = [ "Emulator" ];
-  };
-
  preBuild = ''
    for i in src/resid src/resid-dtv
    do
@ -77,12 +170,15 @@ stdenv.mkDerivation rec {
  '';

  postInstall = ''
-    mkdir -p $out/share/applications
-    cp ${desktopItem}/share/applications/* $out/share/applications
+    for app in ${toString desktopItems}
+    do
+        mkdir -p $out/share/applications
+        cp $app/share/applications/* $out/share/applications
+    done
  '';

  meta = {
-    description = "Commodore 64, 128 and other emulators";
+    description = "Emulators for a variety of 8-bit Commodore computers";
    homepage = "https://vice-emu.sourceforge.io/";
    license = lib.licenses.gpl2Plus;
    maintainers = [ lib.maintainers.sander ];
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@ -46,9 +46,9 @@ in rec {

  unstable = fetchurl rec {
    # NOTE: Don't forget to change the SHA256 for staging as well.
-    version = "7.2";
+    version = "7.4";
    url = "https://dl.winehq.org/wine/source/7.x/wine-${version}.tar.xz";
-    sha256 = "sha256-38ZBUjyNvGZBaLYXREFjPZcSdUVr9n3i3KqZyNql7hU=";
+    sha256 = "sha256-co6GbW5JzpKioMUUMz6f8Ivb9shvXvTmGAFDuNK31BY=";
    inherit (stable) gecko32 gecko64 patches;

    mono = fetchurl rec {
@ -61,7 +61,7 @@ in rec {
  staging = fetchFromGitHub rec {
    # https://github.com/wine-staging/wine-staging/releases
    inherit (unstable) version;
-    sha256 = "sha256-Ec9rienlsDg+2QkJqPrGorDb5NycG1/iGWhnqLZOrwg=";
+    sha256 = "0vlj3b8bnidyhlgkjrnlbah3878zjy3s557vbp16qka42zjaa51q";
    owner = "wine-staging";
    repo = "wine-staging";
    rev = "v${version}";
--- a/pkgs/applications/emulators/wine/vkd3d.nix
+++ b/pkgs/applications/emulators/wine/vkd3d.nix
@ -1,16 +1,18 @@
-{ lib, stdenv, fetchurl, moltenvk, vulkan-headers, spirv-headers, vulkan-loader }:
+{ lib, stdenv, fetchurl, moltenvk, vulkan-headers, spirv-headers, vulkan-loader, flex, bison }:

 #TODO: unstable

 stdenv.mkDerivation rec {
  pname = "vkd3d";
-  version = "1.2";
+  version = "1.3";

  src = fetchurl {
    url = "https://dl.winehq.org/vkd3d/source/vkd3d-${version}.tar.xz";
-    sha256 = "0szr1lw3xbgi9qjm13d1q4gyzzwv8i5wfxiwjg6dmwphrc7h6jxh";
+    sha256 = "134b347806d34a4d2b39ea29ff1c2b38443793803a3adc50800855bb929fb8b2";
  };

+  nativeBuildInputs = [ flex bison ];
+
  buildInputs = [ vulkan-headers spirv-headers ]
    ++ [ (if stdenv.isDarwin then moltenvk else vulkan-loader) ];

--- a/pkgs/applications/graphics/hydrus/default.nix
+++ b/pkgs/applications/graphics/hydrus/default.nix
@ -10,18 +10,19 @@

 python3Packages.buildPythonPackage rec {
  pname = "hydrus";
-  version = "474";
+  version = "477";
  format = "other";

  src = fetchFromGitHub {
    owner = "hydrusnetwork";
    repo = "hydrus";
    rev = "v${version}";
-    sha256 = "sha256-NeTHq8zlgBajw/eogwpabqeU0b7cp83Frqy6kisrths=";
+    sha256 = "sha256-/Gehlk+eMBPA+OT7xsTri6PDi2PBmzjckMVbqPGXT64=";
  };

  nativeBuildInputs = [
    wrapQtAppsHook
+    python3Packages.mkdocs-material
  ];

  propagatedBuildInputs = with python3Packages; [
@ -85,6 +86,7 @@ python3Packages.buildPythonPackage rec {
    # Move the hydrus module and related directories
    mkdir -p $out/${python3Packages.python.sitePackages}
    mv {hydrus,static} $out/${python3Packages.python.sitePackages}
+    mkdocs build -d help
    mv help $out/doc/

    # install the hydrus binaries
--- a/pkgs/applications/kde/konsole.nix
+++ b/pkgs/applications/kde/konsole.nix
@ -1,5 +1,5 @@
 {
-  mkDerivation, lib,
+  mkDerivation, lib, nixosTests,
  extra-cmake-modules, kdoctools,
  kbookmarks, kcompletion, kconfig, kconfigwidgets, kcoreaddons, kguiaddons,
  ki18n, kiconthemes, kinit, kio, knotifications,
@ -22,5 +22,7 @@ mkDerivation {
    kservice ktextwidgets kwidgetsaddons kwindowsystem kxmlgui qtscript knewstuff
  ];

+  passthru.tests.test = nixosTests.terminal-emulators.konsole;
+
  propagatedUserEnvPkgs = [ (lib.getBin kinit) ];
 }
--- a/pkgs/applications/misc/appeditor/default.nix
+++ b/pkgs/applications/misc/appeditor/default.nix
@ -43,6 +43,11 @@ stdenv.mkDerivation rec {
  ];

  postPatch = ''
+    # Fix build with vala 0.56
+    # https://github.com/donadigo/appeditor/pull/122
+    substituteInPlace src/Application.vala \
+      --replace "private static string? create_exec_filename;" "public static string? create_exec_filename;"
+
    chmod +x meson/post_install.py
    patchShebangs meson/post_install.py
  '';
--- a/pkgs/applications/misc/blender/default.nix
+++ b/pkgs/applications/misc/blender/default.nix
@ -1,11 +1,11 @@
 { config, stdenv, lib, fetchurl, fetchzip, boost, cmake, ffmpeg, gettext, glew
 , ilmbase, libXi, libX11, libXext, libXrender
 , libjpeg, libpng, libsamplerate, libsndfile
-, libtiff, libGLU, libGL, openal, opencolorio, openexr, openimagedenoise, openimageio2, openjpeg, python39Packages
+, libtiff, libGLU, libGL, openal, opencolorio, openexr, openimagedenoise, openimageio2, openjpeg, python310Packages
 , openvdb, libXxf86vm, tbb, alembic
-, zlib, fftw, opensubdiv, freetype, jemalloc, ocl-icd, addOpenGLRunpath
+, zlib, zstd, fftw, opensubdiv, freetype, jemalloc, ocl-icd, addOpenGLRunpath
 , jackaudioSupport ? false, libjack2
-, cudaSupport ? config.cudaSupport or false, cudatoolkit
+, cudaSupport ? config.cudaSupport or false, cudatoolkit_11
 , colladaSupport ? true, opencollada
 , spaceNavSupport ? stdenv.isLinux, libspnav
 , makeWrapper
@ -17,30 +17,31 @@

 with lib;
 let
-  python = python39Packages.python;
+  python = python310Packages.python;
  optix = fetchzip {
-    url = "https://developer.download.nvidia.com/redist/optix/v7.0/OptiX-7.0.0-include.zip";
-    sha256 = "1b3ccd3197anya2bj3psxdrvrpfgiwva5zfv2xmyrl73nb2dvfr7";
+    # url taken from the archlinux blender PKGBUILD
+    url = "https://developer.download.nvidia.com/redist/optix/v7.3/OptiX-7.3.0-Include.zip";
+    sha256 = "0max1j4822mchj0xpz9lqzh91zkmvsn4py0r174cvqfz8z8ykjk8";
  };

 in
 stdenv.mkDerivation rec {
  pname = "blender";
-  version = "2.93.5";
+  version = "3.1.0";

  src = fetchurl {
    url = "https://download.blender.org/source/${pname}-${version}.tar.xz";
-    sha256 = "1fsw8w80h8k5w4zmy659bjlzqyn5i198hi1kbpzfrdn8psxg2bfj";
+    sha256 = "1d0476bzcz86lwdnyjn7hyzkmhfiqh47ls5h09jlbm7v7k9x69hw";
  };

  patches = lib.optional stdenv.isDarwin ./darwin.patch;

-  nativeBuildInputs = [ cmake makeWrapper python39Packages.wrapPython llvmPackages.llvm.dev ]
+  nativeBuildInputs = [ cmake makeWrapper python310Packages.wrapPython llvmPackages.llvm.dev ]
    ++ optionals cudaSupport [ addOpenGLRunpath ];
  buildInputs =
    [ boost ffmpeg gettext glew ilmbase
      freetype libjpeg libpng libsamplerate libsndfile libtiff
-      opencolorio openexr openimagedenoise openimageio2 openjpeg python zlib fftw jemalloc
+      opencolorio openexr openimagedenoise openimageio2 openjpeg python zlib zstd fftw jemalloc
      alembic
      (opensubdiv.override { inherit cudaSupport; })
      tbb
@ -62,10 +63,10 @@ stdenv.mkDerivation rec {
      llvmPackages.openmp SDL Cocoa CoreGraphics ForceFeedback OpenAL OpenGL
    ])
    ++ optional jackaudioSupport libjack2
-    ++ optional cudaSupport cudatoolkit
+    ++ optional cudaSupport cudatoolkit_11
    ++ optional colladaSupport opencollada
    ++ optional spaceNavSupport libspnav;
-  pythonPath = with python39Packages; [ numpy requests ];
+  pythonPath = with python310Packages; [ numpy requests ];

  postPatch = ''
    # allow usage of dynamically linked embree
@ -84,7 +85,7 @@ stdenv.mkDerivation rec {
        --replace '${"$"}{LIBDIR}/opencollada' \
                  '${opencollada}' \
        --replace '${"$"}{PYTHON_LIBPATH}/site-packages/numpy' \
-                  '${python39Packages.numpy}/${python.sitePackages}/numpy'
+                  '${python310Packages.numpy}/${python.sitePackages}/numpy'
    '' else ''
      substituteInPlace extern/clew/src/clew.c --replace '"libOpenCL.so"' '"${ocl-icd}/lib/libOpenCL.so"'
    '');
@ -106,8 +107,8 @@ stdenv.mkDerivation rec {
      "-DPYTHON_VERSION=${python.pythonVersion}"
      "-DWITH_PYTHON_INSTALL=OFF"
      "-DWITH_PYTHON_INSTALL_NUMPY=OFF"
-      "-DPYTHON_NUMPY_PATH=${python39Packages.numpy}/${python.sitePackages}"
-      "-DPYTHON_NUMPY_INCLUDE_DIRS=${python39Packages.numpy}/${python.sitePackages}/numpy/core/include"
+      "-DPYTHON_NUMPY_PATH=${python310Packages.numpy}/${python.sitePackages}"
+      "-DPYTHON_NUMPY_INCLUDE_DIRS=${python310Packages.numpy}/${python.sitePackages}/numpy/core/include"
      "-DWITH_PYTHON_INSTALL_REQUESTS=OFF"
      "-DWITH_OPENVDB=ON"
      "-DWITH_TBB=ON"
--- a/pkgs/applications/misc/regextester/default.nix
+++ b/pkgs/applications/misc/regextester/default.nix
@ -37,7 +37,6 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    pantheon.elementary-icon-theme
    pantheon.granite
    glib
    libgee
--- a/pkgs/applications/misc/tootle/default.nix
+++ b/pkgs/applications/misc/tootle/default.nix
@ -68,6 +68,11 @@ stdenv.mkDerivation rec {
  ];

  postPatch = ''
+    # Fix build with vala 0.56
+    # https://github.com/bleakgrey/tootle/pull/346
+    substituteInPlace src/Application.vala \
+      --replace "public const GLib.ActionEntry[] app_entries" "private const GLib.ActionEntry[] app_entries"
+
    chmod +x meson/post_install.py
    patchShebangs meson/post_install.py
  '';
--- a/pkgs/applications/networking/browsers/palemoon/default.nix
+++ b/pkgs/applications/networking/browsers/palemoon/default.nix
@ -6,7 +6,7 @@
 , dbus
 , dbus-glib
 , desktop-file-utils
-, fetchzip
+, fetchFromGitea
 , ffmpeg
 , fontconfig
 , freetype
@ -44,12 +44,15 @@ assert with lib.strings; (

 stdenv.mkDerivation rec {
  pname = "palemoon";
-  version = "29.4.4";
+  version = "30.0.0";

-  src = fetchzip {
-    name = "${pname}-${version}";
-    url = "http://archive.palemoon.org/source/${pname}-${version}.source.tar.xz";
-    sha256 = "sha256-0R0IJd4rd7NqnxQxkHSx10cNlwECqpKgJnlfYAMx4wc=";
+  src = fetchFromGitea {
+    domain = "repo.palemoon.org";
+    owner = "MoonchildProductions";
+    repo = "Pale-Moon";
+    rev = "${version}_Release";
+    fetchSubmodules = true;
+    sha256 = "02qdw8b7hphphc66m3m14r4pmcfiq2c5z4jcscm2nymy18ycb10f";
  };

  nativeBuildInputs = [
@ -137,24 +140,15 @@ stdenv.mkDerivation rec {

    ./mach install

-    # Fix missing icon due to wrong WMClass
-    # https://forum.palemoon.org/viewtopic.php?f=3&t=26746&p=214221#p214221
-    substituteInPlace ./palemoon/branding/official/palemoon.desktop \
-      --replace 'StartupWMClass="pale moon"' 'StartupWMClass=Pale moon'
+    # Install official branding stuff (desktop file & icons)
    desktop-file-install --dir=$out/share/applications \
-      ./palemoon/branding/official/palemoon.desktop
-
-    # Install official branding icons
+      ./other-licenses/branding/palemoon/official/palemoon.desktop
    for iconname in default{16,22,24,32,48,256} mozicon128; do
      n=''${iconname//[^0-9]/}
      size=$n"x"$n
-      install -Dm644 ./palemoon/branding/official/$iconname.png $out/share/icons/hicolor/$size/apps/palemoon.png
+      install -Dm644 ./other-licenses/branding/palemoon/official/$iconname.png $out/share/icons/hicolor/$size/apps/palemoon.png
    done

-    # Remove unneeded SDK data from installation
-    # https://forum.palemoon.org/viewtopic.php?f=37&t=26796&p=214676#p214729
-    rm -rf $out/{include,share/idl,lib/palemoon-devel-${version}}
-
    runHook postInstall
  '';

--- a/pkgs/applications/networking/browsers/palemoon/mozconfig
+++ b/pkgs/applications/networking/browsers/palemoon/mozconfig
@ -12,7 +12,7 @@ _BUILD_64=@build64@
 _GTK_VERSION=@gtkversion@

 # Standard build options for Pale Moon
-ac_add_options --enable-application=palemoon
+ac_add_options --enable-application=browser
 ac_add_options --enable-optimize="-O2 -w"
 ac_add_options --enable-default-toolkit=cairo-gtk$_GTK_VERSION
 ac_add_options --enable-jemalloc
@ -20,8 +20,6 @@ ac_add_options --enable-strip
 ac_add_options --enable-devtools
 ac_add_options --enable-av1

-ac_add_options --disable-eme
-ac_add_options --disable-webrtc
 ac_add_options --disable-gamepad
 ac_add_options --disable-tests
 ac_add_options --disable-debug
--- a/pkgs/applications/networking/cawbird/default.nix
+++ b/pkgs/applications/networking/cawbird/default.nix
@ -23,14 +23,14 @@
 }:

 stdenv.mkDerivation rec {
-  version = "1.4.2";
+  version = "1.5";
  pname = "cawbird";

  src = fetchFromGitHub {
    owner = "IBBoard";
    repo = "cawbird";
    rev = "v${version}";
-    sha256 = "17575cp5qcgsqf37y3xqg3vr6l2j8bbbkmy2c1l185rxghfacida";
+    sha256 = "sha256-XFN9gfCoQDmYYysg1yrUoPPE0Ow40LttvV5Ltu0DTfI=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/cluster/fn-cli/default.nix
+++ b/pkgs/applications/networking/cluster/fn-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "fn";
-  version = "0.6.15";
+  version = "0.6.17";

  src = fetchFromGitHub {
    owner = "fnproject";
    repo = "cli";
    rev = version;
-    sha256 = "sha256-Gf4YxxyNALicb9GPpOW+Kzb2xrwcAU1XYOzXochH0LI=";
+    sha256 = "sha256-u/YISLlZFYlAUejSlaH7POA2WwKURPN8phFU86/caXU=";
  };

  vendorSha256 = null;
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -3,10 +3,10 @@
    "owner": "CiscoDevNet",
    "provider-source-address": "registry.terraform.io/CiscoDevNet/aci",
    "repo": "terraform-provider-aci",
-    "rev": "v2.0.1",
-    "sha256": "165k2sf4hq84zidlh0y5jmzwnid5gz7slhnb9rgp2771pzqm0gki",
+    "rev": "v2.1.0",
+    "sha256": "sha256-7fOvTEinJUpSaCnlP+191VTSEpE4z11+HUcH2iTFj60=",
    "vendorSha256": null,
-    "version": "2.0.1"
+    "version": "2.1.0"
  },
  "acme": {
    "owner": "vancluever",
@ -40,10 +40,10 @@
    "owner": "aliyun",
    "provider-source-address": "registry.terraform.io/aliyun/alicloud",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.160.0",
-    "sha256": "sha256-ijSOvBS8bcFKX0qa2Cl/xqDdwduamVdCWzgTCWao1Sg=",
-    "vendorSha256": "sha256-oKaghX3u8H9vDFvmo+jelTIbvuHnAt27Z9N0oEWxcxc=",
-    "version": "1.160.0"
+    "rev": "v1.161.0",
+    "sha256": "sha256-vQrX9mFZLy16aV6hEA8X9MV995Ew+lJb8PxCvxDGoN0=",
+    "vendorSha256": "sha256-rIydGW7X0tL+ZwV1wEu3Zz3FZPrNozQI0Qx+Ee9tAik=",
+    "version": "1.161.0"
  },
  "ansible": {
    "owner": "nbering",
@ -94,10 +94,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/aws",
    "repo": "terraform-provider-aws",
-    "rev": "v4.5.0",
-    "sha256": "sha256-L1LRuinU3YrqywRGpmUqGQgjZ1JuYhECjCN6ysYPzco=",
-    "vendorSha256": "sha256-3akEup/M7Zc5MPf2XA+324PxQiHegIwzR05JNSjYanw=",
-    "version": "4.5.0"
+    "rev": "v4.6.0",
+    "sha256": "sha256-Bq6DrwN4212LeBHb/j60v/fEvZwFseSRB8KZ3hrJYmQ=",
+    "vendorSha256": "sha256-hbN5apdCiA4eN0uCWlTRAEunO4nFB/VX+gchxp/6BJQ=",
+    "version": "4.6.0"
  },
  "azuread": {
    "owner": "hashicorp",
@ -148,10 +148,10 @@
    "owner": "DrFaust92",
    "provider-source-address": "registry.terraform.io/DrFaust92/bitbucket",
    "repo": "terraform-provider-bitbucket",
-    "rev": "v2.8.0",
-    "sha256": "sha256-W+mAud3DpBViLeFwXLWIwZ1+TOco8FWZnVrIbHUwgIU=",
-    "vendorSha256": "sha256-hSMVLDZXC9QMpcgREjEUjhxArtotrIrIyfdNIZw8uM4=",
-    "version": "2.8.0"
+    "rev": "v2.12.0",
+    "sha256": "sha256-FIJ2nnTHV+Rb4Dbtqcdc06qaBBg3hG8NBwv1LxgnoQI=",
+    "vendorSha256": "sha256-GEnLgGk9yohWXftNfp9Y21BQKE1B6QwN08d7k0ofKTc=",
+    "version": "2.12.0"
  },
  "brightbox": {
    "owner": "brightbox",
@ -230,19 +230,19 @@
    "owner": "Constellix",
    "provider-source-address": "registry.terraform.io/Constellix/constellix",
    "repo": "terraform-provider-constellix",
-    "rev": "v0.4.1",
-    "sha256": "15myw5ff22wi4cykwc2plghmfwl6d6m9pfskjqiwq8hffv35h50v",
+    "rev": "v0.4.2",
+    "sha256": "sha256-XnLTh/AP0OcFD5U2I1LSNpQ3s1OObueURDnioAtIQlU=",
    "vendorSha256": null,
-    "version": "0.4.1"
+    "version": "0.4.2"
  },
  "consul": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/consul",
    "repo": "terraform-provider-consul",
-    "rev": "v2.14.0",
-    "sha256": "19kmjjg4f74askwwwslbh5wvi5ndcr4wzm0374qr8gc57qiwxkpy",
+    "rev": "v2.15.0",
+    "sha256": "sha256-6NQL1ZlHZsxfoRV0zMOXApuCR+nj8CPWjpxj7BAJivY=",
    "vendorSha256": null,
-    "version": "2.14.0"
+    "version": "2.15.0"
  },
  "ct": {
    "owner": "poseidon",
@ -338,19 +338,19 @@
    "owner": "exoscale",
    "provider-source-address": "registry.terraform.io/exoscale/exoscale",
    "repo": "terraform-provider-exoscale",
-    "rev": "v0.33.0",
-    "sha256": "sha256-mih0Bo6fcNgpyeCQ+GWSPyTrPlGzmBXkEO43TOVWMds=",
+    "rev": "v0.33.1",
+    "sha256": "sha256-HlhJe8jyvtACOF0msFMSrt9l//Ik03poSvhP+JccRyQ=",
    "vendorSha256": null,
-    "version": "0.33.0"
+    "version": "0.33.1"
  },
  "external": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/external",
    "repo": "terraform-provider-external",
-    "rev": "v2.2.0",
-    "sha256": "0s7zxz9dni1p93di1ddx595d0mmizq7zrvkbbx1m4c5f208m262x",
-    "vendorSha256": "1f5gh110rylb1cw4dlwdzsj8sb0myj7xcj7ix966l5qa9x05p9pn",
-    "version": "2.2.0"
+    "rev": "v2.2.2",
+    "sha256": "sha256-gImRxsDUgBHmw/5DeKcO9BzB906JB8dUcSGKQj+Vcy0=",
+    "vendorSha256": "sha256-1BUFg8epcEsCf6yyJr4E4CdX2o6/3R384opRTxwrsng=",
+    "version": "2.2.2"
  },
  "fastly": {
    "owner": "fastly",
@ -392,10 +392,10 @@
    "owner": "integrations",
    "provider-source-address": "registry.terraform.io/integrations/github",
    "repo": "terraform-provider-github",
-    "rev": "v4.21.0",
-    "sha256": "sha256-ayL22zlfZkGL/ycyQX384g7CjFHDgK8k010kg1fI4h4=",
+    "rev": "v4.22.0",
+    "sha256": "sha256-bSKK72dBxfZCwSq3/vg97Dq1o/121KSM4h14MC87BMo=",
    "vendorSha256": null,
-    "version": "4.21.0"
+    "version": "4.22.0"
  },
  "gitlab": {
    "owner": "gitlabhq",
@ -411,20 +411,20 @@
    "provider-source-address": "registry.terraform.io/hashicorp/google",
    "proxyVendor": true,
    "repo": "terraform-provider-google",
-    "rev": "v4.13.0",
-    "sha256": "sha256-QSHlnvsWmkdUE7dd6HqzYtyYC+XDW69dIp/h7u1jD9g=",
-    "vendorSha256": "sha256-1tiFBc03RyIAtnu/NqhU3RowM8JhuLNS+blfyjXBcW0=",
-    "version": "4.13.0"
+    "rev": "v4.14.0",
+    "sha256": "sha256-VWbyxZ5ag9jRF5yaiEdVkRpmnsSb5IiE5FtE2e3j0b8=",
+    "vendorSha256": "sha256-NrP3+pBePNex/ZmVM349p5vI8uVcs21Sti2C3NfxZkQ=",
+    "version": "4.14.0"
  },
  "google-beta": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/google-beta",
    "proxyVendor": true,
    "repo": "terraform-provider-google-beta",
-    "rev": "v4.13.0",
-    "sha256": "sha256-jjYUijzUgIiSC9eL6rbgtuBSh6bbHLjeifN+GIndrVs=",
-    "vendorSha256": "sha256-1tiFBc03RyIAtnu/NqhU3RowM8JhuLNS+blfyjXBcW0=",
-    "version": "4.13.0"
+    "rev": "v4.14.0",
+    "sha256": "sha256-VEQff8SnyPLu9I6dbGRac5rF/hRAihlxFhX6KLaov/Y=",
+    "vendorSha256": "sha256-NrP3+pBePNex/ZmVM349p5vI8uVcs21Sti2C3NfxZkQ=",
+    "version": "4.14.0"
  },
  "grafana": {
    "owner": "grafana",
@ -511,10 +511,10 @@
    "owner": "IBM-Cloud",
    "provider-source-address": "registry.terraform.io/IBM-Cloud/ibm",
    "repo": "terraform-provider-ibm",
-    "rev": "v1.39.2",
-    "sha256": "sha256-9r0tt0N3m/IYq/9oepQ4DcB78ds8pb1up1TyjFYzX1U=",
-    "vendorSha256": "sha256-8qgm1zDdwKNE/bs1n5cpY/DUD3SKtFmnvEgwtKorASk=",
-    "version": "1.39.2"
+    "rev": "v1.40.0-beta0",
+    "sha256": "sha256-1C0JdzoHf/GKdlLyHA6GgJpb3lbYFXeMGeWYJ7RkyfU=",
+    "vendorSha256": "sha256-YgRgm5S7cXHO9yqUUuVVkFRQL+pf0RMPJI9oUaWob2I=",
+    "version": "1.40.0-beta0"
  },
  "icinga2": {
    "owner": "Icinga",
@ -565,10 +565,10 @@
    "owner": "kingsoftcloud",
    "provider-source-address": "registry.terraform.io/kingsoftcloud/ksyun",
    "repo": "terraform-provider-ksyun",
-    "rev": "v1.3.42",
-    "sha256": "sha256-wj4o2XSz8ylZJdseIi/TadlhOwFWZ6nfDOUezbeGYw4=",
+    "rev": "v1.3.43",
+    "sha256": "sha256-HOZ1nhHLdiYy+WR2y4OsyRGReK+OJFTaWqYU0X4eEQ0=",
    "vendorSha256": "sha256-nbAEaRFtFtB4ftLgnCv3MmkjFFbcNkCuxZc+G8/ObPE=",
-    "version": "1.3.42"
+    "version": "1.3.43"
  },
  "kubectl": {
    "owner": "gavinbunney",
@ -619,10 +619,10 @@
    "owner": "numtide",
    "provider-source-address": "registry.terraform.io/numtide/linuxbox",
    "repo": "terraform-provider-linuxbox",
-    "rev": "v0.4.2",
-    "sha256": "1ghlp0nnc67m5rsx6aixqxjd5vhpbi88gcfyv3710dvqxchdgscy",
-    "vendorSha256": "01d556pfaa2ycww5kgd1f3shp2i2r48kgwnls39lhplp5qmnkz4g",
-    "version": "0.4.2"
+    "rev": "v0.4.3",
+    "sha256": "sha256-MzasMVtXO7ZeZ+qEx2Z+7881fOIA0SFzSvXVHeEROtg=",
+    "vendorSha256": "sha256-Jlg3a91pOhMC5SALzL9onajZUZ2H9mXfU5CKvotbCbw=",
+    "version": "0.4.3"
  },
  "local": {
    "owner": "hashicorp",
@ -674,10 +674,10 @@
    "owner": "equinix",
    "provider-source-address": "registry.terraform.io/equinix/metal",
    "repo": "terraform-provider-metal",
-    "rev": "v3.3.0-alpha.1",
-    "sha256": "0lihzid312q8qh1bl9x1wqslshq7pb0q4m8dgbww1cszzg6xb5aq",
-    "vendorSha256": "0aniiiysh6iq20fcqvdgs6a4l3prbxzpqpp2ixpfaxhg4z5l8zrf",
-    "version": "3.3.0-alpha.1"
+    "rev": "v3.3.0-alpha.2",
+    "sha256": "sha256-RUD4BJy0/s23+OWlQfFEh59BEhhtobW7zDOOcosC0l4=",
+    "vendorSha256": "sha256-Ln9EyycPduVuj+JefH9f+Q5KlNGvbcwcEDgaqH2M0So=",
+    "version": "3.3.0-alpha.2"
  },
  "minio": {
    "owner": "aminueza",
@ -719,10 +719,10 @@
    "owner": "newrelic",
    "provider-source-address": "registry.terraform.io/newrelic/newrelic",
    "repo": "terraform-provider-newrelic",
-    "rev": "v2.39.2",
-    "sha256": "sha256-NfszsBliZAjY52kPWB7yhOEYZB2V4yOp6IDffF7EG6k=",
-    "vendorSha256": "sha256-DD6zXX7anks5jRw9tn8lUvgJY4k81oGSQr0a/xofkGk=",
-    "version": "2.39.2"
+    "rev": "v2.41.0-beta.2",
+    "sha256": "sha256-tAEEJuU2ceTwXRtgGUFiFw1jgdJHSPG/WfaMDRm+gGQ=",
+    "vendorSha256": "sha256-Dvm8vmlfV7LH73Y2jNTO106V/fOA7K78jFclbFKZVXA=",
+    "version": "2.41.0-beta.2"
  },
  "nomad": {
    "owner": "hashicorp",
@ -755,10 +755,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/null",
    "repo": "terraform-provider-null",
-    "rev": "v3.1.0",
-    "sha256": "0s6j2py9bb3knrn0f8aga8ypkxj6v5ns08k7zgw26h3wwdxwyd12",
-    "vendorSha256": null,
-    "version": "3.1.0"
+    "rev": "v3.1.1",
+    "sha256": "sha256-OKnlIt+R16d5GOKqM7/+sApQoC1+nv9h5Ty32QIIMuQ=",
+    "vendorSha256": "sha256-MtVpbcN/GZRYabsli2mhUXyCuRLRR0NEvcX1iLM552c=",
+    "version": "3.1.1"
  },
  "nutanix": {
    "deleteVendor": true,
@ -829,10 +829,10 @@
    "owner": "opentelekomcloud",
    "provider-source-address": "registry.terraform.io/opentelekomcloud/opentelekomcloud",
    "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.27.7",
-    "sha256": "sha256-8y++zfxRam4sZvGWajyGiPv/5G8K7D4+ReNU7DBlqe8=",
-    "vendorSha256": "sha256-OqN+QGclKYo4jjQi0HJ/80zVTPkcOQyl4n6i2BpDZQE=",
-    "version": "1.27.7"
+    "rev": "v1.28.0",
+    "sha256": "sha256-D+sIpGNQQ5UUNoesX6zd8BHo5RYfoTb/9x3lvFyoD50=",
+    "vendorSha256": "sha256-FMcPG7EJvU6XNKd2+8+xmjqSI0Ec9Xx/6gZvK9zJ3wg=",
+    "version": "1.28.0"
  },
  "opsgenie": {
    "owner": "opsgenie",
@ -928,10 +928,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/random",
    "repo": "terraform-provider-random",
-    "rev": "v3.1.0",
-    "sha256": "1677mia6bbydqa8w50f1y85rynpv9lhg9ar5s6japsr5g78lrcqf",
-    "vendorSha256": null,
-    "version": "3.1.0"
+    "rev": "v3.1.2",
+    "sha256": "sha256-Yk1CPR9gN70E+Qpc20vBQG2MY/RCO5cvaNtD8N++d5A=",
+    "vendorSha256": "sha256-/IjOv7/kQlGuV9+9Vhc7zUrr6hbcoxZyKi+q52YA/kk=",
+    "version": "3.1.2"
  },
  "rundeck": {
    "owner": "rundeck",
@ -1009,10 +1009,10 @@
    "owner": "chanzuckerberg",
    "provider-source-address": "registry.terraform.io/chanzuckerberg/snowflake",
    "repo": "terraform-provider-snowflake",
-    "rev": "v0.25.36",
-    "sha256": "sha256-AeIQfdn68EnSj2BXZIsC0+L3EJ6tRHLD0NYHdPcf89w=",
-    "vendorSha256": "sha256-oYjoTZ79ricoFZTokiFcCKNXAeqFvW4RIMQmTp763gE=",
-    "version": "0.25.36"
+    "rev": "v0.28.8",
+    "sha256": "sha256-v5+qmBqPJk9BTkjmXRn2yiIHlFkFcqoH7RuenM54Eys=",
+    "vendorSha256": "sha256-G/UIKuKtolLY7RIQF06wzn/ZYTMihEmJZ1DqVcHFGdg=",
+    "version": "0.28.8"
  },
  "sops": {
    "owner": "carlpett",
@ -1045,10 +1045,10 @@
    "owner": "StatusCakeDev",
    "provider-source-address": "registry.terraform.io/StatusCakeDev/statuscake",
    "repo": "terraform-provider-statuscake",
-    "rev": "v2.0.0-pre",
-    "sha256": "sha256-S9VJRGREoRJPIb9gv822Y/8ZRa0x7WoPjU7BxLlRpOM=",
-    "vendorSha256": "sha256-wKrbjxRCDk8GFAR0OFz4w9UnkIXH9EO/S+p2RKNLJaM=",
-    "version": "2.0.0-pre"
+    "rev": "v2.0.1-pre",
+    "sha256": "sha256-/SWmGy6kMAt4TAswlpmfs4rVAa/DZBFoE1Yv+EcWfGo=",
+    "vendorSha256": "sha256-sFKhbOsE2eQ4Qxfbtab19nZRIKhJXNdsg274tWRjoVg=",
+    "version": "2.0.1-pre"
  },
  "sumologic": {
    "owner": "SumoLogic",
@ -1072,10 +1072,10 @@
    "owner": "tencentcloudstack",
    "provider-source-address": "registry.terraform.io/tencentcloudstack/tencentcloud",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.65.0",
-    "sha256": "sha256-NpKZ4KbEDxCYmG2E4F/bHEUmK6invkcIaNkXDZjhmDI=",
+    "rev": "v1.65.2",
+    "sha256": "sha256-JrgLHagLc+yhTMa6gVJpVxy3NGCO2BED/87z0JEhesE=",
    "vendorSha256": null,
-    "version": "1.65.0"
+    "version": "1.65.2"
  },
  "tfe": {
    "owner": "hashicorp",
@ -1164,10 +1164,10 @@
    "owner": "Venafi",
    "provider-source-address": "registry.terraform.io/Venafi/venafi",
    "repo": "terraform-provider-venafi",
-    "rev": "v0.14.0",
-    "sha256": "16a7mr4dzfkvf9gg77dax92dp6g99plfg5qpzfhxdfanb25lq7za",
-    "vendorSha256": "0vmmki2pmg6ns75ldygyvj5pzl3blzz62zfqh4jsm1zbswfs75df",
-    "version": "0.14.0"
+    "rev": "v0.15.0",
+    "sha256": "sha256-7pfEQ7tHA+RiyotlvEymedCsDtR+8EDob1kKw55U5V0=",
+    "vendorSha256": "sha256-lj8cuv9jR+3P7OiO/eW8poHcX+LsQo+kOyspiqdMXRY=",
+    "version": "0.15.0"
  },
  "vercel": {
    "owner": "ondrejsika",
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@ -11,15 +11,15 @@

 buildGoModule rec {
  pname = "werf";
-  version = "1.2.76";
+  version = "1.2.77";

  src = fetchFromGitHub {
    owner = "werf";
    repo = "werf";
    rev = "v${version}";
-    sha256 = "sha256-OdMY7M9HCYtQ5v3yTjS1CJXDmg9bLA5LdcIxT7C3rcw=";
+    sha256 = "sha256-JmadwNERjexnJN+fBUjgMkvPtAaTbb7GITPsZlx2vik=";
  };
-  vendorSha256 = "sha256-q2blcmh1mHCfjDbeR3KQevjeDtBm0TwhhBIAvF55X00=";
+  vendorSha256 = "sha256-IPQiS1GgNP+k/INv3f3VitoHActC3MrRys905nTSXyI=";
  proxyVendor = true;

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@ -40,8 +40,13 @@ buildGoModule rec {
        ${rcloneBin}/bin/rclone genautocomplete $shell rclone.$shell
        installShellCompletion rclone.$shell
      done
-    '' + lib.optionalString (enableCmount && !stdenv.isDarwin) ''
-      wrapProgram $out/bin/rclone --prefix LD_LIBRARY_PATH : "${fuse}/lib"
+    '' + lib.optionalString (enableCmount && !stdenv.isDarwin)
+      # use --suffix here to ensure we don't shadow /run/wrappers/bin/fusermount,
+      # as the setuid wrapper is required as non-root on NixOS.
+      ''
+      wrapProgram $out/bin/rclone \
+                  --suffix PATH : "${lib.makeBinPath [ fuse ] }" \
+                  --prefix LD_LIBRARY_PATH : "${fuse}/lib"
    '';

  meta = with lib; {
--- a/pkgs/applications/office/bookworm/default.nix
+++ b/pkgs/applications/office/bookworm/default.nix
@ -26,7 +26,6 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    pantheon.elementary-icon-theme
    pantheon.granite
    glib
    libgee
--- a/pkgs/applications/office/spice-up/default.nix
+++ b/pkgs/applications/office/spice-up/default.nix
@ -46,7 +46,6 @@ stdenv.mkDerivation rec {
    libgee
    libgudev
    libsoup
-    pantheon.elementary-icon-theme
    pantheon.granite
  ];

--- a/pkgs/applications/office/zotero/default.nix
+++ b/pkgs/applications/office/zotero/default.nix
@ -1,4 +1,8 @@
-{ lib, stdenv, fetchurl, wrapGAppsHook, makeDesktopItem
+{ lib
+, stdenv
+, fetchurl
+, wrapGAppsHook
+, makeDesktopItem
 , atk
 , cairo
 , coreutils
@ -27,7 +31,8 @@
 , libXt
 , libnotify
 , gnome
-, libGLU, libGL
+, libGLU
+, libGL
 , nspr
 , nss
 , pango
@ -36,55 +41,56 @@

 stdenv.mkDerivation rec {
  pname = "zotero";
-  version = "5.0.96.3";
+  version = "6.0";

  src = fetchurl {
-    url = "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
-    sha256 = "sha256-eqSNzmkGNopGJ7VByvUffFEPJz3WHS7b5+jgUAW/hU4=";
+    url =
+      "https://download.zotero.org/client/release/${version}/Zotero-${version}_linux-x86_64.tar.bz2";
+    sha256 = "0zkgmmflcj6vbyv8rs51jf3vx1zq8pl7b5d5asgayhrdlwi0qgff";
  };

  nativeBuildInputs = [ wrapGAppsHook ];
-  buildInputs= [ gsettings-desktop-schemas glib gtk3 gnome.adwaita-icon-theme dconf ];
+  buildInputs =
+    [ gsettings-desktop-schemas glib gtk3 gnome.adwaita-icon-theme dconf ];

  dontConfigure = true;
  dontBuild = true;
  dontStrip = true;
  dontPatchELF = true;

-  libPath = lib.makeLibraryPath
-    [ stdenv.cc.cc
-      atk
-      cairo
-      curl
-      cups
-      dbus-glib
-      dbus
-      fontconfig
-      freetype
-      gdk-pixbuf
-      glib
-      glibc
-      gtk3
-      libX11
-      libXScrnSaver
-      libXcomposite
-      libXcursor
-      libxcb
-      libXdamage
-      libXext
-      libXfixes
-      libXi
-      libXinerama
-      libXrender
-      libXt
-      libnotify
-      libGLU libGL
-      nspr
-      nss
-      pango
-    ] + ":" + lib.makeSearchPathOutput "lib" "lib64" [
-      stdenv.cc.cc
-    ];
+  libPath = lib.makeLibraryPath [
+    stdenv.cc.cc
+    atk
+    cairo
+    curl
+    cups
+    dbus-glib
+    dbus
+    fontconfig
+    freetype
+    gdk-pixbuf
+    glib
+    glibc
+    gtk3
+    libX11
+    libXScrnSaver
+    libXcomposite
+    libXcursor
+    libxcb
+    libXdamage
+    libXext
+    libXfixes
+    libXi
+    libXinerama
+    libXrender
+    libXt
+    libnotify
+    libGLU
+    libGL
+    nspr
+    nss
+    pango
+  ] + ":" + lib.makeSearchPathOutput "lib" "lib64" [ stdenv.cc.cc ];

  postPatch = ''
    sed -i '/pref("app.update.enabled", true);/c\pref("app.update.enabled", false);' defaults/preferences/prefs.js
--- a/pkgs/applications/science/logic/isabelle/default.nix
+++ b/pkgs/applications/science/logic/isabelle/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, coreutils, nettools, java, scala, polyml, z3, veriT, vampire, eprover-ho, rlwrap, perl, makeDesktopItem }:
+{ lib, stdenv, fetchurl, coreutils, nettools, java, scala, polyml, z3, veriT, vampire, eprover-ho, naproche, rlwrap, perl, makeDesktopItem }:
 # nettools needed for hostname

 stdenv.mkDerivation rec {
@ -66,7 +66,8 @@ stdenv.mkDerivation rec {
      ISABELLE_JDK_HOME=${java}
    EOF

-    sed -i -e 's/naproche_server : bool = true/naproche_server : bool = false/' contrib/naproche-*/etc/options
+    rm contrib/naproche-*/x86*/Naproche-SAD
+    ln -s ${naproche}/bin/Naproche-SAD contrib/naproche-*/x86*/

    echo ISABELLE_LINE_EDITOR=${rlwrap}/bin/rlwrap >>etc/settings

--- a/pkgs/applications/science/logic/naproche/default.nix
+++ b/pkgs/applications/science/logic/naproche/default.nix
@ -0,0 +1,38 @@
+{ lib, fetchFromGitHub, haskellPackages, makeWrapper, eprover }:
+
+with haskellPackages; mkDerivation {
+  pname = "Naproche-SAD";
+  version = "0.1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "naproche";
+    repo = "naproche";
+    rev = "d39cea85ace04d5b3775fde9972a33886799bfe6";
+    sha256 = "1zqrldmxkzbyg9bssrbwb00zic29904igcipaz1m9al0456yjnkf";
+  };
+
+  isExecutable = true;
+
+  buildTools = [ hpack makeWrapper ];
+  executableHaskellDepends = [
+    base array bytestring containers ghc-prim megaparsec mtl network process
+    split temporary text threads time transformers uuid
+  ];
+
+  prePatch = "hpack";
+
+  checkPhase = ''
+    export NAPROCHE_EPROVER=${eprover}/bin/eprover
+    dist/build/Naproche-SAD/Naproche-SAD examples/cantor.ftl.tex -t 60 --tex=on
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/Naproche-SAD \
+      --set-default NAPROCHE_EPROVER ${eprover}/bin/eprover
+  '';
+
+  homepage = "https://github.com/naproche/naproche#readme";
+  description = "Write formal proofs in natural language and LaTeX";
+  maintainers = with lib.maintainers; [ jvanbruegge ];
+  license = lib.licenses.gpl3Only;
+}
--- a/pkgs/applications/science/math/nasc/default.nix
+++ b/pkgs/applications/science/math/nasc/default.nix
@ -48,7 +48,6 @@ stdenv.mkDerivation rec {
    gtk3
    gtksourceview
    libgee
-    pantheon.elementary-icon-theme
    pantheon.granite
    webkitgtk
    # We add libqalculate's runtime dependencies because nasc has it as a modified subproject.
--- a/pkgs/applications/science/math/qalculate-gtk/default.nix
+++ b/pkgs/applications/science/math/qalculate-gtk/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "qalculate-gtk";
-  version = "4.0.0";
+  version = "4.1.0";

  src = fetchFromGitHub {
    owner = "qalculate";
    repo = "qalculate-gtk";
    rev = "v${version}";
-    sha256 = "sha256-l9lR5MVHWiRz5RG/I/nXRY4GQSSaXXP7PlRNoAu9+yo=";
+    sha256 = "sha256-EOiExp8JBc3SybSiBVbuRxBqTujzLjysWM0v94goups=";
  };

  hardeningDisable = [ "format" ];
--- a/pkgs/applications/terminal-emulators/alacritty/default.nix
+++ b/pkgs/applications/terminal-emulators/alacritty/default.nix
@ -3,6 +3,7 @@
 , fetchFromGitHub
 , fetchpatch
 , rustPlatform
+, nixosTests

 , cmake
 , gzip
@ -132,6 +133,8 @@ rustPlatform.buildRustPackage rec {

  dontPatchELF = true;

+  passthru.tests.test = nixosTests.terminal-emulators.alacritty;
+
  meta = with lib; {
    description = "A cross-platform, GPU-accelerated terminal emulator";
    homepage = "https://github.com/alacritty/alacritty";
--- a/pkgs/applications/terminal-emulators/contour/default.nix
+++ b/pkgs/applications/terminal-emulators/contour/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, mkDerivation, fetchFromGitHub, cmake, pkg-config, freetype, libGL, pcre }:
+{ lib, stdenv, mkDerivation, fetchFromGitHub, cmake, pkg-config, freetype, libGL, pcre, nixosTests }:

 mkDerivation rec {
  pname = "contour";
@ -16,6 +16,8 @@ mkDerivation rec {

  buildInputs = [ freetype libGL pcre ];

+  passthru.tests.test = nixosTests.terminal-emulators.contour;
+
  meta = with lib; {
    description = "Modern C++ Terminal Emulator";
    homepage = "https://github.com/christianparpart/contour";
--- a/pkgs/applications/terminal-emulators/cool-retro-term/default.nix
+++ b/pkgs/applications/terminal-emulators/cool-retro-term/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, mkDerivation, qtbase, qtquick1, qmltermwidget
-, qtquickcontrols, qtgraphicaleffects, qmake }:
+, qtquickcontrols, qtgraphicaleffects, qmake, nixosTests }:

 mkDerivation rec {
  version = "1.1.1";
@ -29,6 +29,8 @@ mkDerivation rec {
    ln -s $out/bin/cool-retro-term.app/Contents/MacOS/cool-retro-term $out/bin/cool-retro-term
  '';

+  passthru.tests.test = nixosTests.terminal-emulators.cool-retro-term;
+
  meta = {
    description = "Terminal emulator which mimics the old cathode display";
    longDescription = ''
--- a/pkgs/applications/terminal-emulators/ctx/default.nix
+++ b/pkgs/applications/terminal-emulators/ctx/default.nix
@ -8,6 +8,7 @@
 , libdrm # Not documented
 , pkg-config
 , enableFb ? false
+, nixosTests
 }:

 stdenv.mkDerivation rec {
@ -43,6 +44,8 @@ stdenv.mkDerivation rec {
    "PREFIX=${placeholder "out"}"
  ];

+  passthru.tests.test = nixosTests.terminal-emulators.ctx;
+
  meta = with lib; {
    homepage = "https://ctx.graphics/";
    description = "Vector graphics terminal";
--- a/pkgs/applications/terminal-emulators/darktile/default.nix
+++ b/pkgs/applications/terminal-emulators/darktile/default.nix
@ -12,6 +12,7 @@
 , libXext
 , libXxf86vm
 , libGL
+, nixosTests
 }:

 stdenv.mkDerivation rec {
@ -57,6 +58,8 @@ stdenv.mkDerivation rec {
    runHook postInstall
  '';

+  passthru.tests.test = nixosTests.terminal-emulators.darktile;
+
  meta = with lib; {
    description = "A GPU rendered terminal emulator designed for tiling window managers";
    homepage = "https://github.com/liamg/darktile";
--- a/pkgs/applications/terminal-emulators/eterm/default.nix
+++ b/pkgs/applications/terminal-emulators/eterm/default.nix
@ -8,6 +8,7 @@
 , libXext
 , libast
 , pkg-config
+, nixosTests
 }:

 stdenv.mkDerivation rec {
@ -33,6 +34,8 @@ stdenv.mkDerivation rec {
    libast
  ];

+  passthru.tests.test = nixosTests.terminal-emulators.eterm;
+
  meta = with lib; {
    homepage = "https://github.com/mej/Eterm"; # http://www.eterm.org is gone
    description = "Terminal emulator";
--- a/pkgs/applications/terminal-emulators/germinal/default.nix
+++ b/pkgs/applications/terminal-emulators/germinal/default.nix
@ -9,6 +9,7 @@
 , tmux
 , vte
 , wrapGAppsHook
+, nixosTests
 }:

 stdenv.mkDerivation rec {
@ -45,6 +46,8 @@ stdenv.mkDerivation rec {
    runHook postFixup
  '';

+  passthru.tests.test = nixosTests.terminal-emulators.germinal;
+
  meta = with lib; {
    description = "A minimal terminal emulator";
    homepage = "https://github.com/Keruspe/Germinal";
--- a/pkgs/applications/terminal-emulators/guake/default.nix
+++ b/pkgs/applications/terminal-emulators/guake/default.nix
@ -10,6 +10,7 @@
 , libutempter
 , vte
 , libwnck
+, nixosTests
 }:

 python3.pkgs.buildPythonApplication rec {
@ -66,6 +67,8 @@ python3.pkgs.buildPythonApplication rec {
    gappsWrapperArgs+=(--prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libutempter ]}")
  '';

+  passthru.tests.test = nixosTests.terminal-emulators.guake;
+
  meta = with lib; {
    description = "Drop-down terminal for GNOME";
    homepage = "http://guake-project.org";
--- a/pkgs/applications/terminal-emulators/hyper/default.nix
+++ b/pkgs/applications/terminal-emulators/hyper/default.nix
@ -2,7 +2,7 @@
 , freetype, fontconfig, dbus, libXi, libXcursor, libXdamage, libXrandr, libXcomposite
 , libXext, libXfixes, libXrender, libX11, libXtst, libXScrnSaver, libxcb, nss, nspr
 , alsa-lib, cups, expat, udev, libpulseaudio, at-spi2-atk, at-spi2-core, libxshmfence
-, libdrm, libxkbcommon, mesa }:
+, libdrm, libxkbcommon, mesa, nixosTests}:

 let
  libPath = lib.makeLibraryPath [
@ -43,6 +43,8 @@ stdenv.mkDerivation rec {
      --replace "/opt/Hyper/hyper" "hyper"
  '';

+  passthru.tests.test = nixosTests.terminal-emulators.hyper;
+
  dontPatchELF = true;
  meta = with lib; {
    description = "A terminal built on web technologies";
--- a/pkgs/applications/terminal-emulators/kermit-terminal/default.nix
+++ b/pkgs/applications/terminal-emulators/kermit-terminal/default.nix
@ -6,6 +6,7 @@
 , pcre
 , pkg-config
 , vte
+, nixosTests
 }:

 stdenv.mkDerivation rec {
@ -31,6 +32,8 @@ stdenv.mkDerivation rec {
    vte
  ];

+  passthru.tests.test = nixosTests.terminal-emulators.kermit;
+
  meta = with lib; {
    homepage = "https://github.com/orhun/kermit";
    description = "A VTE-based, simple and froggy terminal emulator";
--- a/pkgs/applications/terminal-emulators/kgx/default.nix
+++ b/pkgs/applications/terminal-emulators/kgx/default.nix
@ -18,6 +18,7 @@
 , python3
 , sassc
 , wrapGAppsHook
+, nixosTests
 }:

 stdenv.mkDerivation {
@ -66,6 +67,8 @@ stdenv.mkDerivation {
      --replace "Exec=kgx" "Exec=$out/bin/kgx"
  '';

+  passthru.tests.test = nixosTests.terminal-emulators.kgx;
+
  meta = with lib; {
    description = "Simple user-friendly terminal emulator for the GNOME desktop";
    homepage = "https://gitlab.gnome.org/ZanderBrown/kgx";
--- a/pkgs/applications/terminal-emulators/kitty/default.nix
+++ b/pkgs/applications/terminal-emulators/kitty/default.nix
@ -22,6 +22,7 @@
 , zsh
 , fish
 , fetchpatch
+, nixosTests
 }:

 with python3Packages;
@ -176,6 +177,8 @@ buildPythonApplication rec {
    runHook postInstall
  '';

+  passthru.tests.test = nixosTests.terminal-emulators.kitty;
+
  meta = with lib; {
    homepage = "https://github.com/kovidgoyal/kitty";
    description = "A modern, hackable, featureful, OpenGL based terminal emulator";
--- a/pkgs/applications/terminal-emulators/lxterminal/default.nix
+++ b/pkgs/applications/terminal-emulators/lxterminal/default.nix
@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, automake, autoconf, intltool, pkg-config, gtk3, vte, wrapGAppsHook
-, libxslt, docbook_xml_dtd_412, docbook_xsl, libxml2, findXMLCatalogs
+, libxslt, docbook_xml_dtd_412, docbook_xsl, libxml2, findXMLCatalogs, nixosTests
 }:

 stdenv.mkDerivation rec {
@ -35,6 +35,8 @@ stdenv.mkDerivation rec {

  doCheck = true;

+  passthru.tests.test = nixosTests.terminal-emulators.lxterminal;
+
  meta = {
    description = "The standard terminal emulator of LXDE";
    longDescription = ''
--- a/pkgs/applications/terminal-emulators/mlterm/default.nix
+++ b/pkgs/applications/terminal-emulators/mlterm/default.nix
@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, pkg-config, autoconf, makeDesktopItem
+{ stdenv, lib, fetchFromGitHub, pkg-config, autoconf, makeDesktopItem, nixosTests
 , libX11, gdk-pixbuf, cairo, libXft, gtk3, vte
 , harfbuzz #substituting glyphs with opentype fonts
 , fribidi, m17n_lib #bidi and encoding
@ -110,6 +110,8 @@ stdenv.mkDerivation rec {
    startupNotify = false;
  };

+  passthru.tests.test = nixosTests.terminal-emulators.mlterm;
+
  meta = with lib; {
    description = "Multi Lingual TERMinal emulator";
    homepage = "http://mlterm.sourceforge.net/";
--- a/pkgs/applications/terminal-emulators/mrxvt/default.nix
+++ b/pkgs/applications/terminal-emulators/mrxvt/default.nix
@ -10,6 +10,7 @@
 , freetype
 , pkg-config
 , which
+, nixosTests
 }:

 stdenv.mkDerivation rec {
@ -38,6 +39,8 @@ stdenv.mkDerivation rec {
    NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE -I${freetype.dev}/include/freetype2";
  '';

+  passthru.tests.test = nixosTests.terminal-emulators.mrxvt;
+
  meta = with lib; {
    description = "Lightweight multitabbed feature-rich X11 terminal emulator";
    longDescription = "
--- a/pkgs/applications/terminal-emulators/roxterm/default.nix
+++ b/pkgs/applications/terminal-emulators/roxterm/default.nix
@ -1,7 +1,7 @@
 { at-spi2-core, cmake, dbus, dbus-glib, docbook_xsl, libepoxy, fetchFromGitHub
 , glib, gtk3, harfbuzz, libXdmcp, libXtst, libpthreadstubs
 , libselinux, libsepol, libtasn1, libxkbcommon, libxslt, p11-kit, pcre2
-, pkg-config, lib, stdenv, util-linuxMinimal, vte, wrapGAppsHook, xmlto
+, pkg-config, lib, stdenv, util-linuxMinimal, vte, wrapGAppsHook, xmlto, nixosTests
 }:

 stdenv.mkDerivation rec {
@ -23,6 +23,8 @@ stdenv.mkDerivation rec {
      libsepol libxkbcommon libepoxy at-spi2-core libXtst libtasn1 p11-kit
    ];

+  passthru.tests.test = nixosTests.terminal-emulators.roxterm;
+
  meta = with lib; {
    homepage = "https://github.com/realh/roxterm";
    license = licenses.gpl3;
--- a/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
+++ b/pkgs/applications/terminal-emulators/rxvt-unicode/default.nix
@ -7,6 +7,7 @@
 , gdkPixbufSupport ? true
 , unicode3Support  ? true
 , emojiSupport     ? false
+, nixosTests
 }:

 let
@ -102,6 +103,8 @@ stdenv.mkDerivation {
    cp -r ${desktopItem}/share/applications/ $out/share/
  '';

+  passthru.tests.test = nixosTests.terminal-emulators.urxvt;
+
  meta = {
    inherit description;
    homepage = "http://software.schmorp.de/pkg/rxvt-unicode.html";
--- a/pkgs/applications/terminal-emulators/rxvt-unicode/wrapper.nix
+++ b/pkgs/applications/terminal-emulators/rxvt-unicode/wrapper.nix
@ -5,6 +5,7 @@
 , rxvt-unicode-unwrapped
 , rxvt-unicode-plugins
 , perlPackages
+, nixosTests
 , configure ? { availablePlugins, ... }:
  { plugins = builtins.attrValues availablePlugins;
    extraDeps = [ ];
@ -51,7 +52,10 @@ let
            --suffix-each URXVT_PERL_LIB ':' "$out/lib/urxvt/perl"
        '';

-        passthru.plugins = plugins;
+        passthru = {
+          plugins = plugins;
+          tests.test = nixosTests.terminal-emulators.urxvt;
+        };
      };

 in
--- a/pkgs/applications/terminal-emulators/sakura/default.nix
+++ b/pkgs/applications/terminal-emulators/sakura/default.nix
@ -9,6 +9,7 @@
 , perl
 , pkg-config
 , vte
+, nixosTests
 }:

 stdenv.mkDerivation rec {
@ -43,6 +44,8 @@ stdenv.mkDerivation rec {
      --suffix XDG_DATA_DIRS : ${gtk3}/share/gsettings-schemas/${gtk3.name}/
  '';

+  passthru.tests.test = nixosTests.terminal-emulators.sakura;
+
  meta = with lib; {
    homepage = "https://www.pleyades.net/david/projects/sakura";
    description = "A terminal emulator based on GTK and VTE";
--- a/pkgs/applications/terminal-emulators/st/default.nix
+++ b/pkgs/applications/terminal-emulators/st/default.nix
@ -11,6 +11,7 @@
 , conf ? null
 , patches ? [ ]
 , extraLibs ? [ ]
+, nixosTests
 }:

 stdenv.mkDerivation rec {
@ -55,6 +56,8 @@ stdenv.mkDerivation rec {

  installFlags = [ "PREFIX=$(out)" ];

+  passthru.tests.test = nixosTests.terminal-emulators.st;
+
  meta = with lib; {
    homepage = "https://st.suckless.org/";
    description = "Simple Terminal for X from Suckless.org Community";
--- a/pkgs/applications/terminal-emulators/stupidterm/default.nix
+++ b/pkgs/applications/terminal-emulators/stupidterm/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, vte, gtk, pcre2 }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, vte, gtk, pcre2, nixosTests }:

 stdenv.mkDerivation {
  pname = "stupidterm";
@ -26,6 +26,8 @@ stdenv.mkDerivation {
      --replace "Exec=st" "Exec=$out/bin/stupidterm"
  '';

+  passthru.tests.test = nixosTests.terminal-emulators.stupidterm;
+
  meta = with lib; {
    description = "Simple wrapper around the VTE terminal emulator widget for GTK";
    homepage = "https://github.com/esmil/stupidterm";
--- a/pkgs/applications/terminal-emulators/terminator/default.nix
+++ b/pkgs/applications/terminal-emulators/terminator/default.nix
@ -9,6 +9,7 @@
 , libnotify
 , wrapGAppsHook
 , vte
+, nixosTests
 }:

 python3.pkgs.buildPythonApplication rec {
@ -62,6 +63,8 @@ python3.pkgs.buildPythonApplication rec {
    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
  '';

+  passthru.tests.test = nixosTests.terminal-emulators.terminator;
+
  meta = with lib; {
    description = "Terminal emulator with support for tiling and tabs";
    longDescription = ''
--- a/pkgs/applications/terminal-emulators/termite/default.nix
+++ b/pkgs/applications/terminal-emulators/termite/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, pkg-config, vte, gtk3, ncurses, pcre2, wrapGAppsHook }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, pkg-config, vte, gtk3, ncurses, pcre2, wrapGAppsHook, nixosTests }:

 let

@ -57,7 +57,10 @@ in stdenv.mkDerivation rec {

  outputs = [ "out" "terminfo" ];

-  passthru = { inherit vte-ng; };
+  passthru = {
+    inherit vte-ng;
+    tests = nixosTests.terminal-emulators.termite;
+  };

  postInstall = ''
    mkdir -p $terminfo/share
--- a/pkgs/applications/terminal-emulators/termonad/default.nix
+++ b/pkgs/applications/terminal-emulators/termonad/default.nix
@ -1,4 +1,4 @@
-{ stdenv, haskellPackages, makeWrapper, packages ? (pkgSet: []) }:
+{ stdenv, haskellPackages, makeWrapper, packages ? (pkgSet: []), nixosTests }:

 let
  termonadEnv = haskellPackages.ghcWithPackages (self: [ self.termonad ] ++ packages self);
@ -17,6 +17,8 @@ in stdenv.mkDerivation {
  preferLocalBuild = true;
  allowSubstitutes = false;

+  passthru.tests.test = nixosTests.terminal-emulators.termonad;
+
  meta = haskellPackages.termonad.meta // {
    mainProgram = "termonad";
  };
--- a/pkgs/applications/terminal-emulators/tilda/default.nix
+++ b/pkgs/applications/terminal-emulators/tilda/default.nix
@ -9,6 +9,7 @@
 , pcre2
 , vte
 , makeWrapper
+, nixosTests
 }:

 stdenv.mkDerivation rec {
@ -42,6 +43,8 @@ stdenv.mkDerivation rec {
        --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
  '';

+  passthru.tests.test = nixosTests.terminal-emulators.tilda;
+
  meta = with lib; {
    description = "A Gtk based drop down terminal for Linux and Unix";
    homepage = "https://github.com/lanoxx/tilda/";
--- a/pkgs/applications/terminal-emulators/tilix/default.nix
+++ b/pkgs/applications/terminal-emulators/tilix/default.nix
@ -17,6 +17,7 @@
 , wrapGAppsHook
 , libunwind
 , appstream
+, nixosTests
 }:

 stdenv.mkDerivation rec {
@ -66,6 +67,8 @@ stdenv.mkDerivation rec {
      --replace "Exec=tilix" "Exec=$out/bin/tilix"
  '';

+  passthru.tests.test = nixosTests.terminal-emulators.tilix;
+
  meta = with lib; {
    description = "Tiling terminal emulator following the Gnome Human Interface Guidelines";
    homepage = "https://gnunn1.github.io/tilix-web";
--- a/pkgs/applications/terminal-emulators/wayst/default.nix
+++ b/pkgs/applications/terminal-emulators/wayst/default.nix
@ -2,6 +2,7 @@
 , lib
 , fetchFromGitHub
 , pkg-config
+, nixosTests
 , freetype
 , fontconfig
 , libGL
@ -78,6 +79,8 @@ stdenv.mkDerivation rec {
    install -D icons/wayst.svg $out/share/icons/hicolor/scalable/apps/wayst.svg
  '';

+  passthru.tests.test = nixosTests.terminal-emulators.wayst;
+
  meta = with lib; {
    description = "A simple terminal emulator";
    mainProgram = "wayst";
--- a/pkgs/applications/terminal-emulators/wezterm/default.nix
+++ b/pkgs/applications/terminal-emulators/wezterm/default.nix
@ -22,11 +22,12 @@
 , Cocoa
 , Foundation
 , libiconv
+, nixosTests
 }:

 rustPlatform.buildRustPackage rec {
  pname = "wezterm";
-  version = "20220101-133340-7edc5b5a";
+  version = "20220319-142410-0fcdea07";

  outputs = [ "out" "terminfo" ];

@ -35,7 +36,7 @@ rustPlatform.buildRustPackage rec {
    repo = pname;
    rev = version;
    fetchSubmodules = true;
-    sha256 = "sha256-UZCvKbZdZ7K4RtvVLmr44M612tqd4rkrjF2tys0JHNM=";
+    sha256 = "sha256-KmIlfzSbVY003WesodN5srJ7qEQaU93izmrZW1MobCo=";
  };

  postPatch = ''
@ -45,7 +46,7 @@ rustPlatform.buildRustPackage rec {
    rm -r wezterm-ssh/tests
  '';

-  cargoSha256 = "1imil15n9mf1r71qdp4cb4q7kzrrc2cspml0d54825yqaq8vjhsc";
+  cargoSha256 = "sha256-+Iu6/pd14O1QIsLkHe7fTP30XyI+8J0GiRY8cnRPS5I=";

  nativeBuildInputs = [
    pkg-config
@ -99,6 +100,8 @@ rustPlatform.buildRustPackage rec {
    ln -s $out/bin/{wezterm,wezterm-mux-server,wezterm-gui,strip-ansi-escapes} "$OUT_APP"
  '';

+  passthru.tests.test = nixosTests.terminal-emulators.wezterm;
+
  meta = with lib; {
    description = "A GPU-accelerated cross-platform terminal emulator and multiplexer written by @wez and implemented in Rust";
    homepage = "https://wezfurlong.org/wezterm";
--- a/pkgs/applications/terminal-emulators/xterm/default.nix
+++ b/pkgs/applications/terminal-emulators/xterm/default.nix
@ -76,7 +76,10 @@ stdenv.mkDerivation rec {
  '';

  passthru = {
-    tests = { inherit (nixosTests) xterm; };
+    tests = {
+      customTest = nixosTests.xterm;
+      standardTest = nixosTests.terminal-emulators.xterm;
+    };

    updateScript = let
      # Tags that end in letters are unstable
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,14 +1,14 @@
 {
-  "version": "14.8.2",
-  "repo_hash": "1pl528qxsbg75l5nny7cw8hcsd0zs50hhn0ngdrf3gjpd6y7pzcc",
-  "yarn_hash": "0dlhslkhiha4jyfzm0k8i9cgwdk12r5m67i2rznxbrkl38gk9c1x",
+  "version": "14.8.4",
+  "repo_hash": "0ra4d324all26crz84iys9xb40ykpiaqj4z2790zaw1s45wakmgj",
+  "yarn_hash": "106js1j6wii2axh1dxvlfr7mqhvsnsb5qs0danp9c3h1ihd4nz91",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v14.8.2-ee",
+  "rev": "v14.8.4-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "14.8.2",
+    "GITALY_SERVER_VERSION": "14.8.4",
    "GITLAB_PAGES_VERSION": "1.54.0",
    "GITLAB_SHELL_VERSION": "13.23.2",
-    "GITLAB_WORKHORSE_VERSION": "14.8.2"
+    "GITLAB_WORKHORSE_VERSION": "14.8.4"
  }
 }
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -11,7 +11,7 @@ let
    gemdir = ./.;
  };

-  version = "14.8.2";
+  version = "14.8.4";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/v${lib.versions.major version}";
 in

@ -23,7 +23,7 @@ buildGoModule {
    owner = "gitlab-org";
    repo = "gitaly";
    rev = "v${version}";
-    sha256 = "sha256-GgQscKxxYpvzU2M99gmvGj0HM/oD+2Ke24FRzUxv6HM=";
+    sha256 = "sha256-3doXqYj1XsOifAr78ds5ioa6gUfw8uyUwn7JzqlMVSE=";
  };

  vendorSha256 = "sha256-Qw9/nlo1eB5dPcldXe9doy4QA4DDVUDad3o4kbdNu34=";
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -5,7 +5,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "14.8.2";
+  version = "14.8.4";

  src = fetchFromGitLab {
    owner = data.owner;
--- a/pkgs/applications/version-management/meld/default.nix
+++ b/pkgs/applications/version-management/meld/default.nix
@ -1,5 +1,6 @@
 { lib
 , fetchurl
+, fetchpatch
 , gettext
 , itstool
 , python3
@ -27,6 +28,16 @@ python3.pkgs.buildPythonApplication rec {
    sha256 = "cP6Y65Ms4h1nFw47D2pzF+gT6GLemJM+pROYLpoDMgI=";
  };

+  patches = [
+    # Pull upstream fix for meson-0.60:
+    #  https://gitlab.gnome.org/GNOME/meld/-/merge_requests/78
+    (fetchpatch {
+      name = "meson-0.60.patch";
+      url  = "https://gitlab.gnome.org/GNOME/meld/-/commit/cc7746c141d976a4779cf868774fae1fe7627a6d.patch";
+      sha256 = "sha256-4uJZyF00Z6svzrOebByZV1hutCZRkIQYC4rUxQr5fdQ=";
+    })
+  ];
+
  nativeBuildInputs = [
    meson
    ninja
--- a/pkgs/applications/virtualization/distrobox/default.nix
+++ b/pkgs/applications/virtualization/distrobox/default.nix
@ -2,13 +2,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "distrobox";
-  version = "1.2.13";
+  version = "1.2.14";

  src = fetchFromGitHub {
    owner = "89luca89";
    repo = pname;
    rev = version;
-    sha256 = "047mrhsfi88mgwylnnyxg6xa7hjjrajn2pf7vfmb6161myqybvfy";
+    sha256 = "sha256-gHKyuIL4K/SLBJw8xNuPdNifDcHI91AFTiHaiv38gus=";
  };

  dontConfigure = true;
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@ -10,7 +10,7 @@ rec {
      , containerdRev, containerdSha256
      , tiniRev, tiniSha256, buildxSupport ? true, composeSupport ? true
      # package dependencies
-      , stdenv, fetchFromGitHub, buildGoPackage
+      , stdenv, fetchFromGitHub, fetchpatch, buildGoPackage
      , makeWrapper, installShellFiles, pkg-config, glibc
      , go-md2man, go, containerd, runc, docker-proxy, tini, libtool
      , sqlite, iproute2, lvm2, systemd, docker-buildx, docker-compose_2
@ -79,6 +79,16 @@ rec {

      extraUserPath = optionals (stdenv.isLinux && !clientOnly) (makeBinPath [ rootlesskit slirp4netns fuse-overlayfs ]);

+      patches = [
+        # This patch incorporates code from a PR fixing using buildkit with the ZFS graph driver.
+        # It could be removed when a version incorporating this patch is released.
+        (fetchpatch {
+          name = "buildkit-zfs.patch";
+          url = "https://github.com/moby/moby/pull/43136.patch";
+          sha256 = "1WZfpVnnqFwLMYqaHLploOodls0gHF8OCp7MrM26iX8=";
+        })
+      ];
+
      postPatch = ''
        patchShebangs hack/make.sh hack/make/
      '';
--- a/pkgs/applications/virtualization/singularity/default.nix
+++ b/pkgs/applications/virtualization/singularity/default.nix
@ -15,11 +15,11 @@ with lib;

 buildGoPackage rec {
  pname = "singularity";
-  version = "3.8.6";
+  version = "3.8.7";

  src = fetchurl {
    url = "https://github.com/hpcng/singularity/releases/download/v${version}/singularity-${version}.tar.gz";
-    sha256 = "sha256-u1o7dnCsnHpLPOWyyfPWtb5g4hsI0zjJ39q7eyqZ9Sg=";
+    sha256 = "sha256-Myny5YP4SoNDyywDgKHWy86vrn0eYztcvK33FD6shZs=";
  };

  goPackagePath = "github.com/sylabs/singularity";
--- a/pkgs/applications/window-managers/i3/wsr.nix
+++ b/pkgs/applications/window-managers/i3/wsr.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "i3wsr";
-  version = "2.0.1";
+  version = "2.1.0";

  src = fetchFromGitHub {
    owner = "roosta";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-JzQWfC0kmnMArpIAE5fgb3YLmXktSCH5aUdrQH9pCbo=";
+    sha256 = "sha256-mwPU700eqyFYihWP1m3y56zXnX16sjSNzB6XNlCttBU=";
  };

-  cargoSha256 = "sha256-ZvSdJLaw1nfaqpTBKIiHiXvNFSZhsmLk0PBrV6ykv/w=";
+  cargoSha256 = "sha256-f0Yby/2g7apkqx0iCcd/QkQgMVYZDUQ1vWw8RCXQ9Z4=";

  nativeBuildInputs = [ python3 ];
  buildInputs = [ libxcb ];
--- a/pkgs/data/themes/yaru/default.nix
+++ b/pkgs/data/themes/yaru/default.nix
@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "yaru";
-  version = "22.04.1";
+  version = "22.04.2";

  src = fetchFromGitHub {
    owner = "ubuntu";
    repo = "yaru";
    rev = version;
-    sha256 = "sha256-5mB5eTIPw4CqYSQm675MKbRwsYLpg+5WJrLDkbc6nKs=";
+    sha256 = "sha256-oW5OOJPhC3OB3GIQWTQxPgqE7p4bAO1TyVbyKUHnyD0=";
  };

  nativeBuildInputs = [ meson sassc pkg-config glib ninja python3 ];
--- a/pkgs/desktops/enlightenment/terminology/default.nix
+++ b/pkgs/desktops/enlightenment/terminology/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, meson, ninja, pkg-config, python3, efl }:
+{ lib, stdenv, fetchurl, meson, ninja, pkg-config, python3, efl, nixosTests }:

 stdenv.mkDerivation rec {
  pname = "terminology";
@ -24,6 +24,8 @@ stdenv.mkDerivation rec {
    patchShebangs data/colorschemes/*.py
  '';

+  passthru.tests.test = nixosTests.terminal-emulators.terminology;
+
  meta = with lib; {
    description = "Powerful terminal emulator based on EFL";
    homepage = "https://www.enlightenment.org/about-terminology";
--- a/pkgs/desktops/gnome/core/gnome-terminal/default.nix
+++ b/pkgs/desktops/gnome/core/gnome-terminal/default.nix
@ -23,6 +23,7 @@
 , pcre2
 , libxslt
 , docbook-xsl-nons
+, nixosTests
 }:

 stdenv.mkDerivation rec {
@ -82,6 +83,8 @@ stdenv.mkDerivation rec {
    };
  };

+  passthru.tests.test = nixosTests.terminal-emulators.gnome-terminal;
+
  meta = with lib; {
    description = "The GNOME Terminal Emulator";
    homepage = "https://wiki.gnome.org/Apps/Terminal";
--- a/pkgs/desktops/lxqt/qterminal/default.nix
+++ b/pkgs/desktops/lxqt/qterminal/default.nix
@ -8,6 +8,7 @@
 , qttools
 , qtx11extras
 , lxqtUpdateScript
+, nixosTests
 }:

 mkDerivation rec {
@ -35,6 +36,8 @@ mkDerivation rec {

  passthru.updateScript = lxqtUpdateScript { inherit pname version src; };

+  passthru.tests.test = nixosTests.terminal-emulators.qterminal;
+
  meta = with lib; {
    homepage = "https://github.com/lxqt/qterminal";
    description = "A lightweight Qt-based terminal emulator";
--- a/pkgs/desktops/mate/mate-terminal/default.nix
+++ b/pkgs/desktops/mate/mate-terminal/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, gettext, itstool, libxml2, mate-desktop, dconf, vte, pcre2, wrapGAppsHook, mateUpdateScript }:
+{ lib, stdenv, fetchurl, pkg-config, gettext, itstool, libxml2, mate-desktop, dconf, vte, pcre2, wrapGAppsHook, mateUpdateScript, nixosTests }:

 stdenv.mkDerivation rec {
  pname = "mate-terminal";
@ -28,6 +28,8 @@ stdenv.mkDerivation rec {

  passthru.updateScript = mateUpdateScript { inherit pname version; };

+  passthru.tests.test = nixosTests.terminal-emulators.mate-terminal;
+
  meta = with lib; {
    description = "MATE desktop terminal emulator";
    homepage = "https://mate-desktop.org";
--- a/pkgs/desktops/xfce/applications/xfce4-terminal/default.nix
+++ b/pkgs/desktops/xfce/applications/xfce4-terminal/default.nix
@ -1,4 +1,4 @@
-{ lib, mkXfceDerivation, gtk3, libxfce4ui, vte, xfconf, pcre2, libxslt, docbook_xml_dtd_45, docbook_xsl }:
+{ lib, mkXfceDerivation, gtk3, libxfce4ui, vte, xfconf, pcre2, libxslt, docbook_xml_dtd_45, docbook_xsl, nixosTests }:

 mkXfceDerivation {
  category = "apps";
@ -11,6 +11,8 @@ mkXfceDerivation {

  buildInputs = [ gtk3 libxfce4ui vte xfconf pcre2 ];

+  passthru.tests.test = nixosTests.terminal-emulators.xfce4-terminal;
+
  meta = with lib; {
    description = "A modern terminal emulator";
    maintainers = with maintainers; [ ] ++ teams.xfce.members;
--- a/pkgs/development/haskell-modules/make-package-set.nix
+++ b/pkgs/development/haskell-modules/make-package-set.nix
@ -384,6 +384,18 @@ in package-set { inherit pkgs lib callPackage; } self // {
        # for the "shellFor" environment (ensuring that any test/benchmark
        # dependencies for "foo" will be available within the nix-shell).
      , genericBuilderArgsModifier ? (args: args)
+
+        # Extra dependencies, in the form of cabal2nix build attributes.
+        #
+        # An example use case is when you have Haskell scripts that use
+        # libraries that don't occur in your packages' dependencies.
+        #
+        # Example:
+        #
+        #   extraDependencies = p: {
+        #     libraryHaskellDepends = [ p.releaser ];
+        #   };
+      , extraDependencies ? p: {}
      , ...
      } @ args:
      let
@ -474,7 +486,7 @@ in package-set { inherit pkgs lib callPackage; } self // {
        # See the Note in `zipperCombinedPkgs` for what gets filtered out from
        # each of these dependency lists.
        packageInputs =
-          pkgs.lib.zipAttrsWith (_name: zipperCombinedPkgs) cabalDepsForSelected;
+          pkgs.lib.zipAttrsWith (_name: zipperCombinedPkgs) (cabalDepsForSelected ++ [ (extraDependencies self) ]);

        # A attribute set to pass to `haskellPackages.mkDerivation`.
        #
@ -514,7 +526,7 @@ in package-set { inherit pkgs lib callPackage; } self // {
        # pkgWithCombinedDepsDevDrv :: Derivation
        pkgWithCombinedDepsDevDrv = pkgWithCombinedDeps.envFunc { inherit withHoogle; };

-        mkDerivationArgs = builtins.removeAttrs args [ "genericBuilderArgsModifier" "packages" "withHoogle" "doBenchmark" ];
+        mkDerivationArgs = builtins.removeAttrs args [ "genericBuilderArgsModifier" "packages" "withHoogle" "doBenchmark" "extraDependencies" ];

      in pkgWithCombinedDepsDevDrv.overrideAttrs (old: mkDerivationArgs // {
        nativeBuildInputs = old.nativeBuildInputs ++ mkDerivationArgs.nativeBuildInputs or [];
--- a/Show More
+++ b/Show More