Merge master into haskell-updates

2022-02-05 00:08:46 +00:00 · 2022-02-05 00:08:46 +00:00 · ae333b719e
commit ae333b719e
parent 7ef2b7a350 438ec49e52
120 changed files with 1841 additions and 1438 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -11571,6 +11571,13 @@
    githubId = 2666479;
    name = "Y Nguyen";
  };
+  superherointj = {
+    name = "Sérgio G.";
+    email = "5861043+superherointj@users.noreply.github.com";
+    matrix = "@superherointj:matrix.org";
+    github = "superherointj";
+    githubId = 5861043;
+  };
  SuperSandro2000 = {
    email = "sandro.jaeckel@gmail.com";
    matrix = "@sandro:supersandro.de";
--- a/nixos/modules/services/misc/matrix-conduit.nix
+++ b/nixos/modules/services/misc/matrix-conduit.nix
@ -86,6 +86,15 @@ in
                and is set to be read only.
              '';
            };
+            global.database_backend = mkOption {
+              type = types.enum [ "sqlite" "rocksdb" ];
+              default = "sqlite";
+              example = "rocksdb";
+              description = ''
+                The database backend for the service. Switching it on an existing
+                instance will require manual migration of data.
+              '';
+            };
          };
        };
        default = {};
--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@ -11,11 +11,15 @@ let
  opt = options.networking.wireless;

  wpa3Protocols = [ "SAE" "FT-SAE" ];
-  hasWPA3 = opts: !mutuallyExclusive opts.authProtocols wpa3Protocols;
+  hasMixedWPA = opts:
+    let
+      hasWPA3 = !mutuallyExclusive opts.authProtocols wpa3Protocols;
+      others = subtractLists wpa3Protocols opts.authProtocols;
+    in hasWPA3 && others != [];

  # Gives a WPA3 network higher priority
  increaseWPA3Priority = opts:
-    opts // optionalAttrs (hasWPA3 opts)
+    opts // optionalAttrs (hasMixedWPA opts)
      { priority = if opts.priority == null
                     then 1
                     else opts.priority + 1;
@ -33,7 +37,7 @@ let
  allNetworks =
    if cfg.fallbackToWPA2
      then map increaseWPA3Priority networkList
-           ++ map mkWPA2Fallback (filter hasWPA3 networkList)
+           ++ map mkWPA2Fallback (filter hasMixedWPA networkList)
      else networkList;

  # Content of wpa_supplicant.conf
--- a/nixos/modules/services/system/self-deploy.nix
+++ b/nixos/modules/services/system/self-deploy.nix
@ -126,9 +126,9 @@ in

  config = lib.mkIf cfg.enable {
    systemd.services.self-deploy = {
-      wantedBy = [ "multi-user.target" ];
+      inherit (cfg) startAt;

-      startAt = cfg.startAt;
+      wantedBy = [ "multi-user.target" ];

      requires = lib.mkIf (!(isPathType cfg.repository)) [ "network-online.target" ];

@ -140,8 +140,7 @@ in
      path = with pkgs; [
        git
        nix
-        systemd
-      ];
+      ] ++ lib.optionals (cfg.switchCommand == "boot") [ systemd ];

      script = ''
        if [ ! -e ${repositoryDirectory} ]; then
--- a/nixos/tests/haproxy.nix
+++ b/nixos/tests/haproxy.nix
@ -16,7 +16,6 @@ import ./make-test-python.nix ({ pkgs, ...}: {
          frontend http
            bind *:80
            mode http
-            option http-use-htx
            http-request use-service prometheus-exporter if { path /metrics }
            use_backend http_server
        '';
--- a/nixos/tests/sudo.nix
+++ b/nixos/tests/sudo.nix
@ -28,6 +28,10 @@ in
          enable = true;
          wheelNeedsPassword = false;

+          extraConfig = ''
+            Defaults lecture="never"
+          '';
+
          extraRules = [
            # SUDOERS SYNTAX CHECK (Test whether the module produces a valid output;
            # errors being detected by the visudo checks.
--- a/nixos/tests/sway.nix
+++ b/nixos/tests/sway.nix
@ -1,6 +1,4 @@
-import ./make-test-python.nix ({ pkgs, lib, ... }:
-
-{
+import ./make-test-python.nix ({ pkgs, lib, ... }: {
  name = "sway";
  meta = {
    maintainers = with lib.maintainers; [ primeos synthetica ];
@ -70,6 +68,14 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
  enableOCR = true;

  testScript = { nodes, ... }: ''
+    import shlex
+
+    def swaymsg(command: str, succeed=True):
+        with machine.nested(f"sending swaymsg {command!r}" + " (allowed to fail)" * (not succeed)):
+          (machine.succeed if succeed else machine.execute)(
+            f"su - alice -c {shlex.quote('swaymsg -- ' + command)}"
+          )
+
    start_all()
    machine.wait_for_unit("multi-user.target")

@ -81,9 +87,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
    machine.wait_for_file("/tmp/sway-ipc.sock")

    # Test XWayland (foot does not support X):
-    machine.succeed(
-        "su - alice -c 'swaymsg exec WINIT_UNIX_BACKEND=x11 WAYLAND_DISPLAY=invalid alacritty'"
-    )
+    swaymsg("exec WINIT_UNIX_BACKEND=x11 WAYLAND_DISPLAY=invalid alacritty")
    machine.wait_for_text("alice@machine")
    machine.send_chars("test-x11\n")
    machine.wait_for_file("/tmp/test-x11-exit-ok")
@ -107,9 +111,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:

    # Test gpg-agent starting pinentry-gnome3 via D-Bus (tests if
    # $WAYLAND_DISPLAY is correctly imported into the D-Bus user env):
-    machine.succeed(
-        "su - alice -c 'swaymsg -- exec gpg --no-tty --yes --quick-generate-key test'"
-    )
+    swaymsg("exec gpg --no-tty --yes --quick-generate-key test")
    machine.wait_until_succeeds("pgrep --exact gpg")
    machine.wait_for_text("Passphrase")
    machine.screenshot("gpg_pinentry")
@ -121,8 +123,15 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
    machine.wait_for_text("You pressed the exit shortcut.")
    machine.screenshot("sway_exit")

+    swaymsg("exec swaylock")
+    machine.wait_until_succeeds("pgrep -x swaylock")
+    machine.sleep(3)
+    machine.send_chars("${nodes.machine.config.users.users.alice.password}")
+    machine.send_key("ret")
+    machine.wait_until_fails("pgrep -x swaylock")
+
    # Exit Sway and verify process exit status 0:
-    machine.succeed("su - alice -c 'swaymsg exit || true'")
+    swaymsg("exit", succeed=False)
    machine.wait_until_fails("pgrep -x sway")
    machine.wait_for_file("/tmp/sway-exit-ok")
  '';
--- a/nixos/tests/wpa_supplicant.nix
+++ b/nixos/tests/wpa_supplicant.nix
@ -27,8 +27,19 @@ import ./make-test-python.nix ({ pkgs, lib, ...}:
      enable = lib.mkOverride 0 true;
      userControlled.enable = true;
      interfaces = [ "wlan1" ];
+      fallbackToWPA2 = true;

      networks = {
+        # test WPA2 fallback
+        mixed-wpa = {
+          psk = "password";
+          authProtocols = [ "WPA-PSK" "SAE" ];
+        };
+        sae-only = {
+          psk = "password";
+          authProtocols = [ "SAE" ];
+        };
+
        # test network
        nixos-test.psk = "@PSK_NIXOS_TEST@";

@ -64,8 +75,12 @@ import ./make-test-python.nix ({ pkgs, lib, ...}:
          machine.succeed(f"grep -q @PSK_MISSING@ {config_file}")
          machine.succeed(f"grep -q P@ssowrdWithSome@tSymbol {config_file}")

-          # save file for manual inspection
-          machine.copy_from_vm(config_file)
+      with subtest("WPA2 fallbacks have been generated"):
+          assert int(machine.succeed(f"grep -c sae-only {config_file}")) == 1
+          assert int(machine.succeed(f"grep -c mixed-wpa {config_file}")) == 2
+
+      # save file for manual inspection
+      machine.copy_from_vm(config_file)

      with subtest("Daemon is running and accepting connections"):
          machine.wait_for_unit("wpa_supplicant-wlan1.service")
--- a/pkgs/applications/accessibility/squeekboard/default.nix
+++ b/pkgs/applications/accessibility/squeekboard/default.nix
@ -19,14 +19,15 @@

 stdenv.mkDerivation rec {
  pname = "squeekboard";
-  version = "1.14.0";
+  version = "1.16.0";

  src = fetchFromGitLab {
-    domain = "source.puri.sm";
-    owner = "Librem5";
+    domain = "gitlab.gnome.org";
+    group = "World";
+    owner = "Phosh";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1ayap40pgzcpmfydk5pbf3gwhh26m3cmbk6lyly4jihr9qw7dgb0";
+    sha256 = "sha256-51Grkn6NSR6azTRuq1vdbDg7d3HuQQ+ZJCsM2mSrSHk=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
@ -35,18 +36,9 @@ stdenv.mkDerivation rec {
      cat Cargo.toml.in Cargo.deps > Cargo.toml
    '';
    name = "${pname}-${version}";
-    sha256 = "0148ynzmapxfrlccikf20ikmi0ssbkn9fl5wi6nh6azflv50pzzn";
+    sha256 = "sha256-vQaiEENxaQxBGYP1br03wSkU7OGOYkJvMBUAOeb3jGk=";
  };

-  patches = [
-    # remove when updating from 1.14.0
-    (fetchpatch {
-      name = "fix-rust-1.54-build.patch";
-      url = "https://gitlab.gnome.org/World/Phosh/squeekboard/-/commit/9cd56185c59ace535a6af26384ef6beca4423816.patch";
-      sha256 = "sha256-8rWcfhQmGiwlc2lpkRvJ95XQp1Xg7St+0K85x8nQ0mk=";
-    })
-  ];
-
  nativeBuildInputs = [
    meson
    ninja
--- a/pkgs/applications/audio/ft2-clone/default.nix
+++ b/pkgs/applications/audio/ft2-clone/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "ft2-clone";
-  version = "1.50";
+  version = "1.51";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "ft2-clone";
    rev = "v${version}";
-    sha256 = "sha256-OURD8k8DIa1DddDng55HrzgAN95srW4wm7RD7DbiJLQ=";
+    sha256 = "sha256-g8LZhP6qHctmvbmrhJ8gAOeAd57SePeO2tdFi9SVjQ0=";
  };

  # Adapt the linux-only CMakeLists to darwin (more reliable than make-macos.sh)
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "pt2-clone";
-  version = "1.39";
+  version = "1.40";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "pt2-clone";
    rev = "v${version}";
-    sha256 = "sha256-ZmgsNp2fRebbLxSzzCsLdM6/7kBKo+YFUCdWLSYfI5A=";
+    sha256 = "sha256-0qEhhkprIpseCEFStgJ0035TX0e9s271BK/1hVkn/JU=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/blockchains/bisq-desktop/default.nix
+++ b/pkgs/applications/blockchains/bisq-desktop/default.nix
@ -35,11 +35,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "bisq-desktop";
-  version = "1.8.0";
+  version = "1.8.2";

  src = fetchurl {
    url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb";
-    sha256 = "1q6x6w8mp5ax852hlvi2p61xgckb2lpr2ml21a9mfs9421b6m8h2";
+    sha256 = "154b8whbbpnb8lk1b3an44h53gh5fdzxkg5vdfrw1ld6miy68kii";
  };

  nativeBuildInputs = [ makeWrapper copyDesktopItems imagemagick dpkg gnutar zip xz ];
--- a/pkgs/applications/blockchains/electrs/default.nix
+++ b/pkgs/applications/blockchains/electrs/default.nix
@ -12,16 +12,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "electrs";
-  version = "0.9.4";
+  version = "0.9.5";

  src = fetchFromGitHub {
    owner = "romanz";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-37KTcLFVzuXlLpz9INXbasUdzuY+T34ef8EtfczQ+D8=";
+    hash = "sha256-6TR9OeIAVVbwDrshb9zHTS39x6taNWYK0UyRLbkW+g0=";
  };

-  cargoHash = "sha256-aOSCpvejMUfSZCDwShqMPEc3vXw9ri2QvTaCuHODTwA=";
+  cargoHash = "sha256-taOrbtx74DICvPLrwym70X3pv7EBA/H22VZmlxefANM=";

  # needed for librocksdb-sys
  nativeBuildInputs = [ llvmPackages.clang ];
--- a/pkgs/applications/blockchains/lnd/default.nix
+++ b/pkgs/applications/blockchains/lnd/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "lnd";
-  version = "0.14.1-beta";
+  version = "0.14.2-beta";

  src = fetchFromGitHub {
    owner = "lightningnetwork";
    repo = "lnd";
    rev = "v${version}";
-    sha256 = "0arm36682y4csdv9abqs0l8rgxkiqkamrps7q8wpyyg4n78yiij3";
+    sha256 = "sha256-JOKitxxWcTlGlxYR1XpySZlI2fT9jgBrOxNUwT/sqdQ=";
  };

-  vendorSha256 = "13zhs0gb7chi0zz5rabmw3sd5fcpxc4s553crfcg7lrnbn5hcwzv";
+  vendorSha256 = "sha256-shDmJcEyobY7Ih1MHMEY2GQnzAffsH/y4J1bme/bT7I=";

  subPackages = [ "cmd/lncli" "cmd/lnd" ];

--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -13,12 +13,12 @@ let
    sha256Hash = "LwG5IDJBFpdlspDoTNpbi1togri2fvEOEDbkkiYvrJE=";
  };
  betaVersion = {
-    version = "2021.1.1.18"; # "Android Studio Bumblebee (2021.1.1) Beta 5"
-    sha256Hash = "gWG8h3wTQDH84vSKlfTm3soUqLkwFYfSymJuAAFPDuQ=";
+    version = "2021.2.1.8"; # "Android Studio Chipmunk (2021.2.1) Beta 1"
+    sha256Hash = "bPfs4kw7czG9CbEgrzn0bQXdT03jyqPVqtaIuVBFSmc=";
  };
  latestVersion = { # canary & dev
-    version = "2021.2.1.5"; # "Android Studio Chipmunk (2021.2.1) Canary 5"
-    sha256Hash = "PS45nu5g9qXNeolYnFEs//Z6p8eIZoD6kUo/0yfHQ6A=";
+    version = "2021.3.1.1"; # "Android Studio Dolphin (2021.3.1) Canary 1"
+    sha256Hash = "W3pNQBM7WdDScQo5b8q5Va5NTgl73uZu0ks/zDMb4aA=";
  };
 in {
  # Attributes are named by their corresponding release channels
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -264,12 +264,12 @@ in

  datagrip = buildDataGrip rec {
    name = "datagrip-${version}";
-    version = "2021.3.3"; /* updated by script */
+    version = "2021.3.4"; /* updated by script */
    description = "Your Swiss Army Knife for Databases and SQL";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/datagrip/${name}.tar.gz";
-      sha256 = "0wbr7hjbj9zvxn4j7nrp7sdzjk78hcg7ssz430y35x9isfiqv5py"; /* updated by script */
+      sha256 = "09dkxj5vn99gkgc1yd18w7gqkw2vzci0z9q2fcih0zn7lvqp0im3"; /* updated by script */
    };
    wmClass = "jetbrains-datagrip";
    update-channel = "DataGrip RELEASE";
@ -277,12 +277,12 @@ in

  goland = buildGoland rec {
    name = "goland-${version}";
-    version = "2021.3.2"; /* updated by script */
+    version = "2021.3.3"; /* updated by script */
    description = "Up and Coming Go IDE";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "0csc52wwqggdxc61qkmbs84hdvyj3x60rcv5jrxcwp3bjq94kskw"; /* updated by script */
+      sha256 = "18z4mvxhds5fgdwcfywc4pj8s9ifvsknhradgzmxsvji0fbp0awx"; /* updated by script */
    };
    wmClass = "jetbrains-goland";
    update-channel = "GoLand RELEASE";
@ -290,12 +290,12 @@ in

  idea-community = buildIdea rec {
    name = "idea-community-${version}";
-    version = "2021.3.1"; /* updated by script */
+    version = "2021.3.2"; /* updated by script */
    description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
    license = lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "19xxbjcn17n3fk1vdb31nihn9cv5q65wfxdan6dx7z0wq5c4x9zd"; /* updated by script */
+      sha256 = "1j889b2r950bl9wiqq1z8v8s2qicidfcdar300cy666i8rc25qlr"; /* updated by script */
    };
    wmClass = "jetbrains-idea-ce";
    update-channel = "IntelliJ IDEA RELEASE";
@ -303,12 +303,12 @@ in

  idea-ultimate = buildIdea rec {
    name = "idea-ultimate-${version}";
-    version = "2021.3.1"; /* updated by script */
+    version = "2021.3.2"; /* updated by script */
    description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jbr.tar.gz";
-      sha256 = "0ys8f2h0qaj8s9ga94hg73vah552a6al4r1ypdp05f7j1m7lzajf"; /* updated by script */
+      sha256 = "0w36qnqgkvw6j1ks09h515237bhqfaixrimzg2r494ic98amvkps"; /* updated by script */
    };
    wmClass = "jetbrains-idea";
    update-channel = "IntelliJ IDEA RELEASE";
@ -343,12 +343,12 @@ in

  pycharm-community = buildPycharm rec {
    name = "pycharm-community-${version}";
-    version = "2021.3.1"; /* updated by script */
+    version = "2021.3.2"; /* updated by script */
    description = "PyCharm Community Edition";
    license = lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "1xd88rd1w3ghkm6jq8ilhhjy972qfm57si581rnsjpz65rj6xpgm"; /* updated by script */
+      sha256 = "1s36basydp7cxgbgdapjhkslx0x9vv3639xhm84ny76hf7s03bpi"; /* updated by script */
    };
    wmClass = "jetbrains-pycharm-ce";
    update-channel = "PyCharm RELEASE";
@ -356,12 +356,12 @@ in

  pycharm-professional = buildPycharm rec {
    name = "pycharm-professional-${version}";
-    version = "2021.3.1"; /* updated by script */
+    version = "2021.3.2"; /* updated by script */
    description = "PyCharm Professional Edition";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0639mzjh1hw158gmf4qqld03371z60k3xyca21l1pnv3551svd6d"; /* updated by script */
+      sha256 = "0rwykngqgby05mh47kls8wzi68gfka2z04k6kdmsxwn1hhx5gnbb"; /* updated by script */
    };
    wmClass = "jetbrains-pycharm";
    update-channel = "PyCharm RELEASE";
@ -369,12 +369,12 @@ in

  rider = buildRider rec {
    name = "rider-${version}";
-    version = "2021.3.2"; /* updated by script */
+    version = "2021.3.3"; /* updated by script */
    description = "A cross-platform .NET IDE based on the IntelliJ platform and ReSharper";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/rider/JetBrains.Rider-${version}.tar.gz";
-      sha256 = "0arnh9wlw874jqlgad00q0nf1kjp7pvb4xixwrb6v1l9fbr9nsan"; /* updated by script */
+      sha256 = "13q6hk5l3fqmz818z5wj014jd5iglpdcpi8zlpgaim1jg5fpvi8x"; /* updated by script */
    };
    wmClass = "jetbrains-rider";
    update-channel = "Rider RELEASE";
@ -382,12 +382,12 @@ in

  ruby-mine = buildRubyMine rec {
    name = "ruby-mine-${version}";
-    version = "2021.3.1"; /* updated by script */
+    version = "2021.3.2"; /* updated by script */
    description = "The Most Intelligent Ruby and Rails IDE";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "1xax3738myxjzm0p8zm8aaa2nw0336h80nrm9dqby2j7dass2jnm"; /* updated by script */
+      sha256 = "18ny40zl9hgkynkc5yyy2xqngl9diifh2gqrfnz7rfq14kp10xb9"; /* updated by script */
    };
    wmClass = "jetbrains-rubymine";
    update-channel = "RubyMine RELEASE";
--- a/pkgs/applications/graphics/menyoki/default.nix
+++ b/pkgs/applications/graphics/menyoki/default.nix
@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "menyoki";
-  version = "1.5.5";
+  version = "1.5.6";

  src = fetchFromGitHub {
    owner = "orhun";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-wEPt96z/odQ05hosN+GB5KLsCu8onR9WWamofJayhwU=";
+    sha256 = "sha256-2k8CRya9SylauYV+2aQS2QHkQhyiTHMgGp1DNoZ4jbU=";
  };

-  cargoSha256 = "sha256-nwxBreouL3Z47zHSH+Y/ej7KU2/bXyMQ+Tb7R4U+yKk=";
+  cargoSha256 = "sha256-NLPqJepg0WRt/X3am9J7vwIE9bn+dt2UHE26Dc/QRMM=";

  nativeBuildInputs = [ installShellFiles ]
    ++ lib.optional stdenv.isLinux pkg-config;
--- a/pkgs/applications/graphics/vengi-tools/default.nix
+++ b/pkgs/applications/graphics/vengi-tools/default.nix
@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchurl
+, writeText

 , cmake
 , pkg-config
@ -18,6 +18,7 @@
 , libuuid
 , wayland-protocols
 , Carbon
+, CoreServices
 # optionals
 , opencl-headers
 , OpenCL
@ -26,30 +27,37 @@
 , nixosTests
 }:

-# cmake 3.21 inserts invalid `ldd` and `-Wl,--no-as-needed` calls, apparently
-# related to
-# https://cmake.org/cmake/help/v3.21/prop_tgt/LINK_WHAT_YOU_USE.html
-let cmake3_22 = cmake.overrideAttrs (old: {
-  version = "3.22.0";
-  src = fetchurl {
-    url = "https://cmake.org/files/v3.22/cmake-3.22.0.tar.gz";
-    sha256 = "sha256-mYx7o0d40t/bPfimlUaeJLEeK/oh++QbNho/ReHJNF4=";
-  };
-});
-
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
  pname = "vengi-tools";
-  version = "0.0.14";
+  version = "0.0.17";

  src = fetchFromGitHub {
    owner = "mgerhardy";
-    repo = "engine";
+    repo = "vengi";
    rev = "v${version}";
-    sha256 = "sha256-v82hKskTSwM0NDgLVHpHZNRQW6tWug4pPIt91MrUwUo=";
+    sha256 = "sha256-h+R9L0BBD3NSFWUh43g4V2LBcNyqVInBeJiOLY03nRk=";
  };

+  # Patch from the project's author for fixing an issue with AnimationShaders.h
+  # not being included when turning off some components
+  patches = [(writeText "vengi-tools-fix-build.patch" ''
+    diff --git a/src/modules/voxelworldrender/CMakeLists.txt b/src/modules/voxelworldrender/CMakeLists.txt
+    index aebe5f97b..903e62b37 100644
+    --- a/src/modules/voxelworldrender/CMakeLists.txt
+    +++ b/src/modules/voxelworldrender/CMakeLists.txt
+    @@ -27,7 +27,7 @@ set(FILES
+            voxel/models/plants/3.qb
+            voxel/models/plants/4.qb
+     )
+    -engine_add_module(TARGET ''${LIB} SRCS ''${SRCS} ''${SRCS_SHADERS} FILES ''${FILES} DEPENDENCIES frontend voxelrender)
+    +engine_add_module(TARGET ''${LIB} SRCS ''${SRCS} ''${SRCS_SHADERS} FILES ''${FILES} DEPENDENCIES animation frontend voxelrender)
+     generate_shaders(''${LIB} world water postprocess)
+
+     set(TEST_SRCS
+  '')];
+
  nativeBuildInputs = [
-    cmake3_22
+    cmake
    pkg-config
    ninja
    python3
@ -69,7 +77,7 @@ in stdenv.mkDerivation rec {
    #libpqxx
    #mosquitto
  ] ++ lib.optional stdenv.isLinux wayland-protocols
-    ++ lib.optionals stdenv.isDarwin [ Carbon OpenCL ]
+    ++ lib.optionals stdenv.isDarwin [ Carbon CoreServices OpenCL ]
    ++ lib.optional (!stdenv.isDarwin) opencl-headers;

  cmakeFlags = [
@ -82,7 +90,7 @@ in stdenv.mkDerivation rec {
    "-DGAMES=OFF"
    "-DMAPVIEW=OFF"
    "-DAIDEBUG=OFF"
-  ];
+  ] ++ lib.optional stdenv.isDarwin "-DCORESERVICES_LIB=${CoreServices}";

  # Set the data directory for each executable. We cannot set it at build time
  # with the PKGDATADIR cmake variable because each executable needs a specific
@ -97,7 +105,10 @@ in stdenv.mkDerivation rec {
  '';

  passthru.tests = {
-    voxconvert-roundtrip = callPackage ./test-voxconvert-roundtrip.nix {};
+    # There used to be a roundtrip test here, but it started failing on 0.0.17
+    # Relevant upstream ticket:
+    # https://github.com/mgerhardy/vengi/issues/113
+    voxconvert-all-formats = callPackage ./test-voxconvert-all-formats.nix {};
    run-voxedit = nixosTests.vengi-tools;
  };

@ -110,10 +121,12 @@ in stdenv.mkDerivation rec {
      filemanager and a command line tool to convert between several voxel
      formats.
    '';
-    homepage = "https://mgerhardy.github.io/engine/";
-    downloadPage = "https://github.com/mgerhardy/engine/releases";
+    homepage = "https://mgerhardy.github.io/vengi/";
+    downloadPage = "https://github.com/mgerhardy/vengi/releases";
    license = [ licenses.mit licenses.cc-by-sa-30 ];
    maintainers = with maintainers; [ fgaz ];
    platforms = platforms.all;
+    # Requires SDK 10.14 https://github.com/NixOS/nixpkgs/issues/101229
+    broken = stdenv.isDarwin && stdenv.isx86_64;
  };
 }
--- a/pkgs/applications/graphics/vengi-tools/test-voxconvert-all-formats.nix
+++ b/pkgs/applications/graphics/vengi-tools/test-voxconvert-all-formats.nix
@ -0,0 +1,15 @@
+{ stdenv
+, vengi-tools
+}:
+
+stdenv.mkDerivation {
+  name = "vengi-tools-test-voxconvert-all-formats";
+  meta.timeout = 10;
+  buildCommand = ''
+    mkdir $out
+    for format in vox qef qbt qb vxm vxr binvox gox cub vxl csv; do
+      echo Testing $format export
+      ${vengi-tools}/bin/vengi-voxconvert --input ${vengi-tools}/share/vengi-voxedit/chr_knight.qb --output $out/chr_knight.$format
+    done
+  '';
+}
--- a/pkgs/applications/graphics/vengi-tools/test-voxconvert-roundtrip.nix
+++ b/pkgs/applications/graphics/vengi-tools/test-voxconvert-roundtrip.nix
@ -1,15 +0,0 @@
-{ stdenv
-, vengi-tools
-}:
-
-stdenv.mkDerivation {
-  name = "vengi-tools-test-voxconvert-roundtrip";
-  meta.timeout = 10;
-  buildCommand = ''
-    ${vengi-tools}/bin/vengi-voxconvert ${vengi-tools}/share/vengi-voxedit/chr_knight.qb chr_knight.vox
-    ${vengi-tools}/bin/vengi-voxconvert chr_knight.vox chr_knight.qb
-    ${vengi-tools}/bin/vengi-voxconvert chr_knight.qb chr_knight1.vox
-    diff chr_knight.vox chr_knight1.vox
-    touch $out
-  '';
-}
--- a/pkgs/applications/misc/ArchiSteamFarm/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/default.nix
@ -11,13 +11,13 @@

 buildDotnetModule rec {
  pname = "archisteamfarm";
-  version = "5.2.1.5";
+  version = "5.2.2.4";

  src = fetchFromGitHub {
    owner = "justarchinet";
    repo = pname;
    rev = version;
-    sha256 = "sha256-fjRf+9m1VGRq2ylqp5CP+FCPepUPyHjknSmJaei2yyE=";
+    sha256 = "sha256-Q5gR+CbqoE9QwFjDpnKOzVZuRPUDBukJ0EpqhN5cAws=";
  };

  dotnet-runtime = dotnetCorePackages.aspnetcore_6_0;
--- a/pkgs/applications/misc/ArchiSteamFarm/deps-aarch64-linux.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/deps-aarch64-linux.nix
@ -161,7 +161,7 @@
  (fetchNuGet { pname = "runtime.win.System.Net.Primitives"; version = "4.3.0"; sha256 = "1dixh195bi7473n17hspll6i562gghdz9m4jk8d4kzi1mlzjk9cf"; })
  (fetchNuGet { pname = "runtime.win.System.Net.Sockets"; version = "4.3.0"; sha256 = "0lr3zki831vs6qhk5wckv2b9qbfk9rcj0ds2926qvj1b9y9m6sck"; })
  (fetchNuGet { pname = "runtime.win.System.Runtime.Extensions"; version = "4.3.0"; sha256 = "1700famsxndccfbcdz9q14qb20p49lax67mqwpgy4gx3vja1yczr"; })
-  (fetchNuGet { pname = "SteamKit2"; version = "2.4.0"; sha256 = "14hi47zyp3nc21zjc4a7g6cg8zyq41y9gv35vb96yp1lab6kwa9r"; })
+  (fetchNuGet { pname = "SteamKit2"; version = "2.4.1"; sha256 = "13f7jra2d0kjlvnk4dghzhx8nhkd001i4xrkf6m19gisjvpjhpdr"; })
  (fetchNuGet { pname = "Swashbuckle.AspNetCore"; version = "6.2.3"; sha256 = "1kx50vliqcqw72aygkm2cs2q82pxdxz17gvz4chz6k858qj4gv0l"; })
  (fetchNuGet { pname = "Swashbuckle.AspNetCore.Annotations"; version = "6.2.3"; sha256 = "189i1ziv3xkdxpxhkpfx3xfji3iw124s88sqn3ga2vh04fbdak8x"; })
  (fetchNuGet { pname = "Swashbuckle.AspNetCore.Newtonsoft"; version = "6.2.3"; sha256 = "1r4z1mmgihnmcqb8zd1q6jbz1g72y5ggl833qhmd1q0wnq8awbs8"; })
--- a/pkgs/applications/misc/ArchiSteamFarm/deps-x86_64-linux.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/deps-x86_64-linux.nix
@ -161,7 +161,7 @@
  (fetchNuGet { pname = "runtime.win.System.Net.Primitives"; version = "4.3.0"; sha256 = "1dixh195bi7473n17hspll6i562gghdz9m4jk8d4kzi1mlzjk9cf"; })
  (fetchNuGet { pname = "runtime.win.System.Net.Sockets"; version = "4.3.0"; sha256 = "0lr3zki831vs6qhk5wckv2b9qbfk9rcj0ds2926qvj1b9y9m6sck"; })
  (fetchNuGet { pname = "runtime.win.System.Runtime.Extensions"; version = "4.3.0"; sha256 = "1700famsxndccfbcdz9q14qb20p49lax67mqwpgy4gx3vja1yczr"; })
-  (fetchNuGet { pname = "SteamKit2"; version = "2.4.0"; sha256 = "14hi47zyp3nc21zjc4a7g6cg8zyq41y9gv35vb96yp1lab6kwa9r"; })
+  (fetchNuGet { pname = "SteamKit2"; version = "2.4.1"; sha256 = "13f7jra2d0kjlvnk4dghzhx8nhkd001i4xrkf6m19gisjvpjhpdr"; })
  (fetchNuGet { pname = "Swashbuckle.AspNetCore"; version = "6.2.3"; sha256 = "1kx50vliqcqw72aygkm2cs2q82pxdxz17gvz4chz6k858qj4gv0l"; })
  (fetchNuGet { pname = "Swashbuckle.AspNetCore.Annotations"; version = "6.2.3"; sha256 = "189i1ziv3xkdxpxhkpfx3xfji3iw124s88sqn3ga2vh04fbdak8x"; })
  (fetchNuGet { pname = "Swashbuckle.AspNetCore.Newtonsoft"; version = "6.2.3"; sha256 = "1r4z1mmgihnmcqb8zd1q6jbz1g72y5ggl833qhmd1q0wnq8awbs8"; })
--- a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
@ -11,8 +11,8 @@ let
    repo = "ASF-ui";
    # updated by the update script
    # this is always the commit that should be used with asf-ui from the latest asf version
-    rev = "e292b5e3c37b0540d398fb4a04b10dd730976a5a";
-    sha256 = "1sxv2xkps2fln7di0i406nnhdqg4wd2yzgvwm5nfhawsq941g19z";
+    rev = "156992e88d5c695375e9f69c29f2c68bec24d2b1";
+    sha256 = "0zqiaj0957rr4kzw8q8zkxvd88nqw5ssym81dsd3pa0ypr4vqb4w";
  };

 in
--- a/pkgs/applications/misc/ArchiSteamFarm/web-ui/node-packages.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/web-ui/node-packages.nix
--- a/pkgs/applications/misc/electrum-grs/default.nix
+++ b/pkgs/applications/misc/electrum-grs/default.nix
@ -0,0 +1,129 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, wrapQtAppsHook
+, python3
+, zbar
+, secp256k1
+, enableQt ? true
+}:
+
+let
+  version = "4.1.5";
+
+  libsecp256k1_name =
+    if stdenv.isLinux then "libsecp256k1.so.0"
+    else if stdenv.isDarwin then "libsecp256k1.0.dylib"
+    else "libsecp256k1${stdenv.hostPlatform.extensions.sharedLibrary}";
+
+  libzbar_name =
+    if stdenv.isLinux then "libzbar.so.0"
+    else "libzbar${stdenv.hostPlatform.extensions.sharedLibrary}";
+
+  py = python3.override {
+    packageOverrides = self: super: {
+
+      aiorpcx = super.aiorpcx.overridePythonAttrs (oldAttrs: rec {
+        version = "0.18.7";
+        src = oldAttrs.src.override {
+          inherit version;
+          sha256 = "1rswrspv27x33xa5bnhrkjqzhv0sknv5kd7pl1vidw9d2z4rx2l0";
+        };
+      });
+    };
+  };
+
+in
+
+python3.pkgs.buildPythonApplication {
+  pname = "electrum-grs";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "Groestlcoin";
+    repo = "electrum-grs";
+    rev = "v${version}";
+    sha256 = "0wvbjj80r1zxpz24adkicxsdjnv3nciga6rl1wfmky463w03rca2";
+  };
+
+  postPatch = ''
+    substituteInPlace contrib/requirements/requirements.txt \
+      --replace "dnspython>=2.0,<2.1" "dnspython>=2.0"
+  '';
+
+  nativeBuildInputs = lib.optionals enableQt [ wrapQtAppsHook ];
+
+  propagatedBuildInputs = with py.pkgs; [
+    aiohttp
+    aiohttp-socks
+    aiorpcx
+    attrs
+    bitstring
+    cryptography
+    dnspython
+    groestlcoin_hash
+    jsonrpclib-pelix
+    matplotlib
+    pbkdf2
+    protobuf
+    pysocks
+    qrcode
+    requests
+    tlslite-ng
+    # plugins
+    btchip
+    ckcc-protocol
+    keepkey
+    trezor
+  ] ++ lib.optionals enableQt [
+    pyqt5
+    qdarkstyle
+  ];
+
+  preBuild = ''
+    sed -i 's,usr_share = .*,usr_share = "'$out'/share",g' setup.py
+    substituteInPlace ./electrum_grs/ecc_fast.py \
+      --replace ${libsecp256k1_name} ${secp256k1}/lib/libsecp256k1${stdenv.hostPlatform.extensions.sharedLibrary}
+  '' + (if enableQt then ''
+    substituteInPlace ./electrum_grs/qrscanner.py \
+      --replace ${libzbar_name} ${zbar.lib}/lib/libzbar${stdenv.hostPlatform.extensions.sharedLibrary}
+  '' else ''
+    sed -i '/qdarkstyle/d' contrib/requirements/requirements.txt
+  '');
+
+  postInstall = lib.optionalString stdenv.isLinux ''
+    # Despite setting usr_share above, these files are installed under $out/nix ...
+    mv $out/${python3.sitePackages}/nix/store/*/share $out
+    rm -rf $out/${python3.sitePackages}/nix
+
+    substituteInPlace $out/share/applications/electrum-grs.desktop \
+      --replace 'Exec=sh -c "PATH=\"\\$HOME/.local/bin:\\$PATH\"; electrum-grs %u"' \
+                "Exec=$out/bin/electrum-grs %u" \
+      --replace 'Exec=sh -c "PATH=\"\\$HOME/.local/bin:\\$PATH\"; electrum-grs --testnet %u"' \
+                "Exec=$out/bin/electrum-grs --testnet %u"
+
+  '';
+
+  postFixup = lib.optionalString enableQt ''
+    wrapQtApp $out/bin/electrum-grs
+  '';
+
+  postCheck = ''
+    $out/bin/electrum-grs help >/dev/null
+  '';
+
+  meta = with lib; {
+    description = "Lightweight Groestlcoin wallet";
+    longDescription = ''
+      An easy-to-use Groestlcoin client featuring wallets generated from
+      mnemonic seeds (in addition to other, more advanced, wallet options)
+      and the ability to perform transactions without downloading a copy
+      of the blockchain.
+    '';
+    homepage = "https://groestlcoin.org/";
+    downloadPage = "https://github.com/Groestlcoin/electrum-grs/releases/tag/v{version}";
+    license = licenses.mit;
+    platforms = platforms.all;
+    maintainers = with maintainers; [ gruve-p ];
+  };
+}
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.92.0";
+  version = "0.92.1";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-rzAt6jGj1MJ5AvkEKjAH91mKnUcLOPgHgiDkzkdibks=";
+    sha256 = "sha256-fOurAHMDOEDdPSo1qCa6es7D0EZ+Zgucm43xwzAPYPI=";
  };

-  vendorSha256 = "sha256-ar5ctfKjqUuEM0mSygoQQFMgj0RURlvQu10dsCtGu3o=";
+  vendorSha256 = "sha256-ZIbpzddgC1EHKia1KGWhQCSD663/0tK36GytsRpUB9c=";

  doCheck = false;

--- a/pkgs/applications/misc/xplr/default.nix
+++ b/pkgs/applications/misc/xplr/default.nix
@ -2,18 +2,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "xplr";
-  version = "0.17.1";
+  version = "0.17.2";

  src = fetchFromGitHub {
    owner = "sayanarijit";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-eRA9v5C6FFYs01a8cwnaVGliuNj026/ANSPC2FxEUws=";
+    sha256 = "sha256-iy03ucPFbFL/rRILt9P+NtfdGoIpjutbUDrykpZkAtk=";
  };

  buildInputs = lib.optional stdenv.isDarwin libiconv;

-  cargoSha256 = "sha256-xali/nvYVpvKIFRlOZpDNE/rv7iUHJCU9QV6RctJSO8=";
+  cargoSha256 = "sha256-VeV/vsM2XCg9h8KoYmniCmo/MJHjwcfn/tUCoZ1rKzM=";

  meta = with lib; {
    description = "A hackable, minimal, fast TUI file explorer";
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -161,21 +161,6 @@ let
      ./patches/no-build-timestamps.patch
      # For bundling Widevine (DRM), might be replaceable via bundle_widevine_cdm=true in gnFlags:
      ./patches/widevine-79.patch
-    ] ++ lib.optionals (versionRange "97" "98") [
-      # A critical Ozone/Wayland fix:
-      # (Note: The patch for surface_augmenter.cc doesn't apply on M97 so we extract that part.)
-      (fetchpatch {
-        # [linux/wayland] Fixed terminate caused by binding to wrong version.
-        url = "https://github.com/chromium/chromium/commit/dd4c3ddadbb9869f59cee201a38e9ca3b9154f4d.patch";
-        excludes = [ "ui/ozone/platform/wayland/host/surface_augmenter.cc" ];
-        sha256 = "sha256-lp4kxPNAkafdE9NfD3ittTCpomRpX9Hqhtt9GFf4Ntw=";
-      })
-      ./patches/m97-ozone-wayland-fix-surface_augmenter.patch
-      (githubPatch {
-        # [linux/wayland] Fixed terminate caused by binding to wrong version. (fixup)
-        commit = "a84b79daa8897b822336b8f348ef4daaae07af37";
-        sha256 = "sha256-2x6/rGGzTC6lKLMkVyD9RNCTsMVrtRQyr/NjSpaj2is=";
-      })
    ];

    postPatch = ''
--- a/pkgs/applications/networking/browsers/chromium/patches/m97-ozone-wayland-fix-surface_augmenter.patch
+++ b/pkgs/applications/networking/browsers/chromium/patches/m97-ozone-wayland-fix-surface_augmenter.patch
@ -1,31 +0,0 @@
-diff --git a/ui/ozone/platform/wayland/host/surface_augmenter.cc b/ui/ozone/platform/wayland/host/surface_augmenter.cc
-index d971d15e71426..6e5408398bcea 100644
--- a/ui/ozone/platform/wayland/host/surface_augmenter.cc
-+++ b/ui/ozone/platform/wayland/host/surface_augmenter.cc
-@@ -13,7 +13,8 @@
- namespace ui {
- 
- namespace {
-constexpr uint32_t kMaxSurfaceAugmenterVersion = 1;
-+constexpr uint32_t kMinVersion = 1;
-+constexpr uint32_t kMaxVersion = 1;
- }
- 
- // static
-@@ -27,11 +28,13 @@ void SurfaceAugmenter::Instantiate(WaylandConnection* connection,
-                                    uint32_t version) {
-   DCHECK_EQ(interface, kInterfaceName);
- 
-  if (connection->surface_augmenter_)
-+  if (connection->surface_augmenter_ ||
-+      !wl::CanBind(interface, version, kMinVersion, kMaxVersion)) {
-     return;
-+  }
- 
-  auto augmenter = wl::Bind<surface_augmenter>(
-      registry, name, std::min(version, kMaxSurfaceAugmenterVersion));
-+  auto augmenter = wl::Bind<surface_augmenter>(registry, name,
-+                                               std::min(version, kMaxVersion));
-   if (!augmenter) {
-     LOG(ERROR) << "Failed to bind surface_augmenter";
-     return;
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -19,22 +19,9 @@
    }
  },
  "beta": {
-    "version": "98.0.4758.80",
-    "sha256": "0wa1jhsw7qrym4x8wxmdvdvbilb8jdv0mizzib2342l61zi6cwn8",
-    "sha256bin64": "12a69cbv2sbrly6g477ln4pssh8n1rdg6mr6cc17iy2jhfihry0q",
-    "deps": {
-      "gn": {
-        "version": "2021-12-07",
-        "url": "https://gn.googlesource.com/gn",
-        "rev": "fc295f3ac7ca4fe7acc6cb5fb052d22909ef3a8f",
-        "sha256": "02bx3bp85kkis704gndb6jvjph7gv3ij746bq4anl30kfrkpcifh"
-      }
-    }
-  },
-  "dev": {
-    "version": "99.0.4844.16",
-    "sha256": "0xig6l1yx9glgb1a53idncnqc1imjvbszi5mrp39yvijarmx8s1f",
-    "sha256bin64": "18p2hqykizijb9w96dm8yxwgvpjx37vabyw6n9wc59l6wyhbjkkw",
+    "version": "99.0.4844.17",
+    "sha256": "18bhfy64rz4bilbzml33856azwzq4bhiisc2jlbncdnmk3x6n71s",
+    "sha256bin64": "1vaxcfgiww4skanny5ks431jyrnf0rgx7g850m29v8v49c3qflm8",
    "deps": {
      "gn": {
        "version": "2022-01-10",
@ -44,20 +31,33 @@
      }
    }
  },
-  "ungoogled-chromium": {
-    "version": "97.0.4692.99",
-    "sha256": "1fpc07zvashaqqalwn7wxnswxclrxvhjrxy1rzr6gcq5awhaw6y9",
-    "sha256bin64": "18afashha667rzcscq3frkp5ixa7nrirs7i3061njqi4z9ql0cs8",
+  "dev": {
+    "version": "100.0.4867.0",
+    "sha256": "1ay6p2aky90lf3gk3n87m4mrxyyhg4anr389kl648ijigsg6wlrd",
+    "sha256bin64": "11g8rlw5aahpn4cd2fl4b942g1giv05zcs10y0qrvirnwmp2i3ha",
    "deps": {
      "gn": {
-        "version": "2021-11-03",
+        "version": "2022-01-21",
        "url": "https://gn.googlesource.com/gn",
-        "rev": "90294ccdcf9334ed25a76ac9b67689468e506342",
-        "sha256": "0n0jml8s00ayy186jzrf207hbz70pxiq426znxwxd4gjcp60scsa"
+        "rev": "0725d7827575b239594fbc8fd5192873a1d62f44",
+        "sha256": "1dzdvcn2r5c9giknvasf3y5y4901kav7igivjvrpww66ywsj8fzr"
+      }
+    }
+  },
+  "ungoogled-chromium": {
+    "version": "98.0.4758.80",
+    "sha256": "0wa1jhsw7qrym4x8wxmdvdvbilb8jdv0mizzib2342l61zi6cwn8",
+    "sha256bin64": "0p2bh45ffgfhyh18bxw8fz4691g25s44lxxj4igk8b0bn71v1pgi",
+    "deps": {
+      "gn": {
+        "version": "2021-12-07",
+        "url": "https://gn.googlesource.com/gn",
+        "rev": "fc295f3ac7ca4fe7acc6cb5fb052d22909ef3a8f",
+        "sha256": "02bx3bp85kkis704gndb6jvjph7gv3ij746bq4anl30kfrkpcifh"
      },
      "ungoogled-patches": {
-        "rev": "97.0.4692.99-1",
-        "sha256": "1jgxpp3wl24hq39291mgmdwcxbarxg4rpa6il53k8z3rf6gd2s4i"
+        "rev": "98.0.4758.80-1",
+        "sha256": "0a8y9yz6xyh025gk3dr0ndrdwmrslhd1ph2f8nivmqk61j7c2g8h"
      }
    }
  }
--- a/pkgs/applications/networking/cluster/cmctl/default.nix
+++ b/pkgs/applications/networking/cluster/cmctl/default.nix
@ -0,0 +1,38 @@
+{ lib, buildGo117Module, fetchFromGitHub, installShellFiles }:
+
+buildGo117Module rec {
+  pname = "cmctl";
+  version = "1.7.1";
+
+  src = fetchFromGitHub {
+    owner = "cert-manager";
+    repo = "cert-manager";
+    rev = "v${version}";
+    sha256 = "sha256-RO7YcGEfAQ9kTxfqgekYf6M5b6Fg64hCPLA/vt6IWp8=";
+  };
+
+  vendorSha256 = "sha256-4zhdpedOmLl/i1G0QCto4ACxguWRZLzOm5HfMBMtvPY=";
+
+  subPackages = [ "cmd/ctl" ];
+
+  ldflags = [ "-s" "-w" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    mv $out/bin/ctl $out/bin/cmctl
+    installShellCompletion --cmd cmctl \
+      --bash <($out/bin/cmctl completion bash) \
+      --fish <($out/bin/cmctl completion fish) \
+      --zsh <($out/bin/cmctl completion zsh)
+  '';
+
+  meta = with lib; {
+    description = "A CLI tool for managing Cert-Manager service on Kubernetes clusters";
+    downloadPage = "https://github.com/cert-manager/cert-manager";
+    license = licenses.asl20;
+    homepage = "https://cert-manager.io/";
+    maintainers = with maintainers; [ superherointj ];
+  };
+}
+
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@ -24,7 +24,7 @@ let

 in stdenv.mkDerivation rec {
  pname = "signal-desktop";
-  version = "5.29.1"; # Please backport all updates to the stable channel.
+  version = "5.30.0"; # Please backport all updates to the stable channel.
  # All releases have a limited lifetime and "expire" 90 days after the release.
  # When releases "expire" the application becomes unusable until an update is
  # applied. The expiration date for the current release can be extracted with:
@ -34,7 +34,7 @@ in stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "1a56mnmv0lnizmd4dl8fya3mdsy0jy5qr5bqb72m9cipq0069alc";
+    sha256 = "sha256-+e3QzV4WIBOSGkpy6uk6vzIcNB5NpqQ05ZZfaoi58IU=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/syncthing/default.nix
+++ b/pkgs/applications/networking/syncthing/default.nix
@ -4,16 +4,16 @@ let
  common = { stname, target, postInstall ? "" }:
    buildGoModule rec {
      pname = stname;
-      version = "1.18.6";
+      version = "1.19.0";

      src = fetchFromGitHub {
        owner  = "syncthing";
        repo   = "syncthing";
        rev    = "v${version}";
-        sha256 = "sha256-fkIHHyhwZV0/aB/JFwz3XrYVOaCn5ZK3ihY3GVoOAHg=";
+        sha256 = "sha256-jQoY0mA/vAOCaCMR8Aapt49AF7HAmjPsr3MKLoaa24g=";
      };

-      vendorSha256 = "sha256-D16jlzP1amkiHW+/BqQV/DISf/H9MlZgvMJmlGtvrhg=";
+      vendorSha256 = "sha256-hZcMt3LlK5FuhhlwCmYtlDAJv1QNK+YY7NvZaWMBuys=";

      doCheck = false;

--- a/pkgs/applications/office/jameica/default.nix
+++ b/pkgs/applications/office/jameica/default.nix
@ -1,8 +1,8 @@
 { lib, stdenv, fetchFromGitHub, makeDesktopItem, makeWrapper, ant, jdk, jre, gtk2, glib, xorg, Cocoa }:

 let
-  _version = "2.10.0";
-  _build = "480";
+  _version = "2.10.1";
+  _build = "482";
  version = "${_version}-${_build}";
  name = "jameica-${version}";

@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
    owner = "willuhn";
    repo = "jameica";
    rev = "V_${builtins.replaceStrings ["."] ["_"] _version}_BUILD_${_build}";
-    sha256 = "0rzhbskzzvr9aan6fwxd2kmzg79ranx7aym5yn1i37z3ra67d1nz";
+    sha256 = "0pzcfqsf7flzipwivpinpkfb2xisand1sfjm00wif4pyj3f4qfh1";
  };

  # there is also a build.gradle, but it only seems to be used to vendor 3rd party libraries
@ -70,6 +70,6 @@ stdenv.mkDerivation rec {
    '';
    license = licenses.gpl2Plus;
    platforms = [ "x86_64-linux" "i686-linux" "x86_64-darwin" ];
-    maintainers = with maintainers; [ flokli ];
+    maintainers = with maintainers; [ flokli r3dl3g ];
  };
 }
--- a/pkgs/applications/office/trilium/0001-Use-console-logger-instead-of-rolling-files.patch
+++ b/pkgs/applications/office/trilium/0001-Use-console-logger-instead-of-rolling-files.patch
@ -1,13 +1,14 @@
 diff --git a/src/services/log.js b/src/services/log.js
-index 4f29994..1e89e0a 100644
+index 0fcd9812..dcbff070 100644
 --- a/src/services/log.js
 +++ b/src/services/log.js
-@@ -1,14 +1,5 @@
+@@ -1,15 +1,7 @@
 "use strict";
 
 -const fs = require('fs');
 -const dataDir = require('./data_dir');
-
+ const cls = require('./cls');
+ 
 -if (!fs.existsSync(dataDir.LOG_DIR)) {
 -    fs.mkdirSync(dataDir.LOG_DIR, 0o700);
 -}
@ -17,7 +18,7 @@ index 4f29994..1e89e0a 100644
 const SECOND = 1000;
 const MINUTE = 60 * SECOND;
 const HOUR = 60 * MINUTE;
-@@ -16,45 +7,7 @@ const DAY = 24 * HOUR;
+@@ -17,38 +9,6 @@ const DAY = 24 * HOUR;
 
 const NEW_LINE = process.platform === "win32" ? '\r\n' : '\n';
 
@ -54,6 +55,12 @@ index 4f29994..1e89e0a 100644
 -}
 -
 function log(str) {
+     const bundleNoteId = cls.get("bundleNoteId");
+ 
+@@ -56,12 +16,6 @@ function log(str) {
+         str = `[Script ${bundleNoteId}] ${str}`;
+     }
+ 
 -    let millisSinceMidnight = Date.now() - todaysMidnight.getTime();
 -
 -    millisSinceMidnight = checkDate(millisSinceMidnight);
@ -63,41 +70,3 @@ index 4f29994..1e89e0a 100644
     console.log(str);
 }
 
-@@ -83,37 +36,6 @@ function request(req, res, timeMs, responseLength = "?") {
-         `${res.statusCode} ${req.method} ${req.url} with ${responseLength} bytes took ${timeMs}ms`);
- }
- 
-function pad(num) {
-    num = Math.floor(num);
-
-    return num < 10 ? ("0" + num) : num.toString();
-}
-
-function padMilli(num) {
-    if (num < 10) {
-        return "00" + num;
-    }
-    else if (num < 100) {
-        return "0" + num;
-    }
-    else {
-        return num.toString();
-    }
-}
-
-function formatTime(millisSinceMidnight) {
-    return pad(millisSinceMidnight / HOUR)
-        + ":" + pad((millisSinceMidnight % HOUR) / MINUTE)
-        + ":" + pad((millisSinceMidnight % MINUTE) / SECOND)
-        + "." + padMilli(millisSinceMidnight % SECOND);
-}
-
-function formatDate() {
-    return pad(todaysMidnight.getFullYear())
-        + "-" + pad(todaysMidnight.getMonth() + 1)
-        + "-" + pad(todaysMidnight.getDate());
-}
-
- module.exports = {
-     info,
-     error,
--- a/pkgs/applications/office/trilium/default.nix
+++ b/pkgs/applications/office/trilium/default.nix
@ -19,16 +19,16 @@ let
    maintainers = with maintainers; [ fliegendewurst ];
  };

-  version = "0.49.5";
+  version = "0.50.1";

  desktopSource = {
    url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-${version}.tar.xz";
-    sha256 = "0bis0xkpcr8rvhm9364v0np5cnvkscv2fgl90f455lcwy7kk9m12";
+    sha256 = "1fb491ld3z6b2cndy8nl7zhpdsbb2v6kkrrc0hv92zm9qnfp7a99";
  };

  serverSource = {
    url = "https://github.com/zadam/trilium/releases/download/v${version}/trilium-linux-x64-server-${version}.tar.xz";
-    sha256 = "1wv9xz1asjadz1jzgpaxf6lzbj5azgsq0qpawp3y257h488r1z9k";
+    sha256 = "1yfj1i5hsphp1y52rgsapqmmv7cvl4imf6dkv8fp3qx5i7j4y5j9";
  };

 in {
--- a/pkgs/applications/science/misc/cwltool/default.nix
+++ b/pkgs/applications/science/misc/cwltool/default.nix
@ -7,14 +7,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "cwltool";
-  version = "3.1.20220124184855";
+  version = "3.1.20220202173120";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "common-workflow-language";
    repo = pname;
    rev = version;
-    sha256 = "0b0mxminfijbi3d9sslhwhs8awnagdsx8d2wh9x9ipdpwipihpmb";
+    sha256 = "sha256-TC0jSnjQTQ7HkEky8BZYJlqNn5uuPOnjGRxALcvumao=";
  };

  postPatch = ''
--- a/pkgs/applications/science/misc/foldingathome/control.nix
+++ b/pkgs/applications/science/misc/foldingathome/control.nix
@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
  installPhase = "cp -ar usr $out";

  postFixup = ''
-    sed -e 's|/usr/bin|$out/bin|g' -i $out/share/applications/FAHControl.desktop
+    sed -e "s|/usr/bin|$out/bin|g" -i $out/share/applications/FAHControl.desktop
    wrapProgram "$out/bin/FAHControl" \
      --suffix PATH : "${fahviewer.outPath}/bin" \
      --set PYTHONPATH "$out/lib/python2.7/dist-packages"
--- a/pkgs/applications/science/misc/foldingathome/viewer.nix
+++ b/pkgs/applications/science/misc/foldingathome/viewer.nix
@ -38,7 +38,7 @@ stdenv.mkDerivation rec {

  unpackPhase = ''
    dpkg-deb -x ${src} ./
-    sed -e 's|/usr/bin|$out/bin|g' -i usr/share/applications/FAHViewer.desktop
+    sed -e "s|/usr/bin|$out/bin|g" -i usr/share/applications/FAHViewer.desktop
  '';

  installPhase = ''
--- a/pkgs/applications/terminal-emulators/hyper/default.nix
+++ b/pkgs/applications/terminal-emulators/hyper/default.nix
@ -15,11 +15,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "hyper";
-  version = "3.1.5";
+  version = "3.2.0";

  src = fetchurl {
    url = "https://github.com/vercel/hyper/releases/download/v${version}/hyper_${version}_amd64.deb";
-    sha256 = "sha256-Pgu09QvP1PnZ13omQlQLVHr3NayhFaQndmsQdLM+W90=";
+    sha256 = "1ryw3315x0lb60j8nzz78h7zd36r2l1j39hnlfav0p7nq8dhqbpm";
  };

  nativeBuildInputs = [ dpkg ];
@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "A terminal built on web technologies";
    homepage    = "https://hyper.is/";
-    maintainers = with maintainers; [ puffnfresh ];
+    maintainers = with maintainers; [ puffnfresh fabiangd ];
    license     = licenses.mit;
    platforms   = [ "x86_64-linux" ];
  };
--- a/pkgs/applications/terminal-emulators/kitty/default.nix
+++ b/pkgs/applications/terminal-emulators/kitty/default.nix
@ -23,14 +23,14 @@
 with python3Packages;
 buildPythonApplication rec {
  pname = "kitty";
-  version = "0.24.1";
+  version = "0.24.2";
  format = "other";

  src = fetchFromGitHub {
    owner = "kovidgoyal";
    repo = "kitty";
    rev = "v${version}";
-    sha256 = "sha256-WPkyub7CwNXRksUmqiZeznnSqEPFpyHTeFLQ+D4Fb5c=";
+    sha256 = "sha256-nGBdoOueX8tcxXRDqKQ/Q+woT6rNQeLXwy1MJbwizKs=";
  };

  buildInputs = [
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,14 +1,14 @@
 {
-  "version": "14.7.0",
-  "repo_hash": "0jam4krhwkbri99642vz4gjlnr7zfgd6mq7pgjyf00f6pggvhq79",
-  "yarn_hash": "1cv3lxfw4i9snlw5x6bcip1n97wg72v5zpz9mjxdpzd2i1bwp6da",
+  "version": "14.7.1",
+  "repo_hash": "1zph7a2mqwbmgc6isd0vl6w8j9lrlcnxyhabzpcms4v3q3agr4f3",
+  "yarn_hash": "12k2r1y7kw95kfsmy0s8rbsf0vldr8c2liah0rkc7pihr19gq3w7",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v14.7.0-ee",
+  "rev": "v14.7.1-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "14.7.0",
+    "GITALY_SERVER_VERSION": "14.7.1",
    "GITLAB_PAGES_VERSION": "1.51.0",
    "GITLAB_SHELL_VERSION": "13.22.2",
-    "GITLAB_WORKHORSE_VERSION": "14.7.0"
+    "GITLAB_WORKHORSE_VERSION": "14.7.1"
  }
 }
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -23,7 +23,7 @@ let
    gemdir = ./.;
  };

-  version = "14.7.0";
+  version = "14.7.1";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/v${lib.versions.major version}";
 in

@ -35,7 +35,7 @@ buildGoModule {
    owner = "gitlab-org";
    repo = "gitaly";
    rev = "v${version}";
-    sha256 = "sha256-hOtdeJSjZLGcPCZpu42lGtCtQoLE0/AQqfQWLUJ6Hf8=";
+    sha256 = "sha256-MGcqYbHHeYwjfnvrJG/ZtOnyxsj+w1kPHOkVHf2AeMQ=";
  };

  vendorSha256 = "sha256-eapqtSstc7d3R7A/5krKV0uVr9GhGkHHMrmsBOpWAbo=";
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -5,7 +5,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "14.7.0";
+  version = "14.7.1";

  src = fetchFromGitLab {
    owner = data.owner;
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@ -1661,4 +1661,4 @@ DEPENDENCIES
  yajl-ruby (~> 1.4.1)

 BUNDLED WITH
-   2.2.24
+   2.3.6
--- a/pkgs/applications/window-managers/labwc/default.nix
+++ b/pkgs/applications/window-managers/labwc/default.nix
@ -30,6 +30,11 @@ stdenv.mkDerivation rec {
    hash = "sha256-O9jVDR7UROt5u8inUsZjbzB3dQTosiLYqXkeOyGrbaM=";
  };

+  patches = [
+    # Required to fix the build with wlroots 0.15.1:
+    ./relax-the-version-constraint-for-wlroots.patch
+  ];
+
  nativeBuildInputs = [
    meson
    ninja
--- a/pkgs/applications/window-managers/labwc/relax-the-version-constraint-for-wlroots.patch
+++ b/pkgs/applications/window-managers/labwc/relax-the-version-constraint-for-wlroots.patch
@ -0,0 +1,29 @@
+From 21d8bfcf7899f5ec50b29f523ace4c19cbfbe919 Mon Sep 17 00:00:00 2001
+From: Michael Weiss <dev.primeos@gmail.com>
+Date: Fri, 4 Feb 2022 21:17:05 +0100
+Subject: [PATCH] build: Relax the version constraint for wlroots to accept
+ patch releases
+
+Patch releases only contain backwards compatible changes (mainly bug
+fixes) so we want to allow them. This fixes the build with the recently
+released wlroots 0.15.1 and uses the same version constraints as other
+projects that depend on wlroots (e.g., Sway).
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/meson.build b/meson.build
+index f950b8e..1905dda 100644
+--- a/meson.build
+++ b/meson.build
+@@ -37,7 +37,7 @@ if git.found()
+ endif
+ add_project_arguments('-DLABWC_VERSION=@0@'.format(version), language: 'c')
+
+-wlroots_version = ['=0.15.0']
+wlroots_version = ['>=0.15.0', '<0.16.0']
+ wlroots_proj = subproject(
+   'wlroots',
+   default_options: ['default_library=static', 'examples=false'],
+--
+2.34.1
--- a/pkgs/applications/window-managers/weston/default.nix
+++ b/pkgs/applications/window-managers/weston/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, meson, ninja, pkg-config, wayland-scanner
+{ lib, stdenv, fetchurl, meson, ninja, pkg-config, wayland-scanner, python3
 , wayland, libGL, mesa, libxkbcommon, cairo, libxcb
 , libXcursor, xlibsWrapper, udev, libdrm, mtdev, libjpeg, pam, dbus, libinput, libevdev
 , colord, lcms2, pipewire ? null
@ -10,14 +10,14 @@
 with lib;
 stdenv.mkDerivation rec {
  pname = "weston";
-  version = "9.0.0";
+  version = "10.0.0";

  src = fetchurl {
    url = "https://wayland.freedesktop.org/releases/${pname}-${version}.tar.xz";
-    sha256 = "1zlql0xgiqc3pvgbpnnvj4xvpd91pwva8qf83xfb23if377ddxaw";
+    sha256 = "1bj7wnadr7ssn6xw7k8ki0wpj6np3kjd2pcysfz3h0mr290rc8sw";
  };

-  nativeBuildInputs = [ meson ninja pkg-config wayland-scanner ];
+  nativeBuildInputs = [ meson ninja pkg-config wayland-scanner python3 ];
  buildInputs = [
    wayland libGL mesa libxkbcommon cairo libxcb libXcursor xlibsWrapper udev libdrm
    mtdev libjpeg pam dbus libinput libevdev pango libunwind freerdp vaapi libva
--- a/pkgs/data/themes/graphite-kde-theme/default.nix
+++ b/pkgs/data/themes/graphite-kde-theme/default.nix
@ -0,0 +1,41 @@
+{ stdenv
+, lib
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation rec {
+  pname = "graphite-kde-theme";
+  version = "unstable-2022-01-22";
+
+  src = fetchFromGitHub {
+    owner = "vinceliuice";
+    repo = pname;
+    rev = "d60a26533b104d6d2251c5187a402f3f35ecbdf7";
+    sha256 = "0cry5s3wr0frpchc0hx97r9v6r3v6rvln7l1hb3znn8npkr4mssi";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    patchShebangs install.sh
+
+    substituteInPlace install.sh \
+      --replace '$HOME/.local' $out \
+      --replace '$HOME/.config' $out/share
+
+    name= ./install.sh --dest $out/share/themes
+
+    mkdir -p $out/share/sddm/themes
+    cp -a sddm/Graphite $out/share/sddm/themes/
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "A flat Design theme for KDE Plasma desktop";
+    homepage = "https://github.com/vinceliuice/Graphite-kde-theme";
+    license = licenses.gpl3Only;
+    platforms = platforms.all;
+    maintainers = [ maintainers.romildo ];
+  };
+}
--- a/pkgs/desktops/mate/mate-panel/default.nix
+++ b/pkgs/desktops/mate/mate-panel/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "mate-panel";
-  version = "1.26.1";
+  version = "1.26.2";

  src = fetchurl {
    url = "https://pub.mate-desktop.org/releases/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "038irkjl9ap7kqacf1c0i74h0rwkcpaw685vyml50vj5hg23hc38";
+    sha256 = "rsT5jInFnnbMBlbtBILx2CkS9N7MZg8hyNAE5JPgVBA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/go/1.18.nix
+++ b/pkgs/development/compilers/go/1.18.nix
@ -0,0 +1,275 @@
+{ lib
+, stdenv
+, fetchurl
+, tzdata
+, iana-etc
+, runCommand
+, perl
+, which
+, pkg-config
+, patch
+, procps
+, pcre
+, cacert
+, Security
+, Foundation
+, xcbuild
+, mailcap
+, runtimeShell
+, buildPackages
+, pkgsBuildTarget
+, callPackage
+}:
+
+let
+  go_bootstrap = buildPackages.callPackage ./bootstrap.nix { };
+
+  goBootstrap = runCommand "go-bootstrap" { } ''
+    mkdir $out
+    cp -rf ${go_bootstrap}/* $out/
+    chmod -R u+w $out
+    find $out -name "*.c" -delete
+    cp -rf $out/bin/* $out/share/go/bin/
+  '';
+
+  goarch = platform: {
+    "i686" = "386";
+    "x86_64" = "amd64";
+    "aarch64" = "arm64";
+    "arm" = "arm";
+    "armv5tel" = "arm";
+    "armv6l" = "arm";
+    "armv7l" = "arm";
+    "mips" = "mips";
+    "mipsel" = "mipsle";
+    "riscv64" = "riscv64";
+    "s390x" = "s390x";
+    "powerpc64le" = "ppc64le";
+  }.${platform.parsed.cpu.name} or (throw "Unsupported system");
+
+  # We need a target compiler which is still runnable at build time,
+  # to handle the cross-building case where build != host == target
+  targetCC = pkgsBuildTarget.targetPackages.stdenv.cc;
+in
+
+stdenv.mkDerivation rec {
+  pname = "go";
+  version = "1.18beta1";
+
+  src = fetchurl {
+    url = "https://go.dev/dl/go${version}.src.tar.gz";
+    sha256 = "sha256-QYwCjbFGmctbLUkHrTpBnXn3ibMZFu+HZIZ+SnjmU6E=";
+  };
+
+  # perl is used for testing go vet
+  nativeBuildInputs = [ perl which pkg-config patch procps ];
+  buildInputs = [ cacert pcre ]
+    ++ lib.optionals stdenv.isLinux [ stdenv.cc.libc.out ]
+    ++ lib.optionals (stdenv.hostPlatform.libc == "glibc") [ stdenv.cc.libc.static ];
+
+  propagatedBuildInputs = lib.optionals stdenv.isDarwin [ xcbuild ];
+
+  depsTargetTargetPropagated = lib.optionals stdenv.isDarwin [ Security Foundation ];
+
+  hardeningDisable = [ "all" ];
+
+  prePatch = ''
+    patchShebangs ./ # replace /bin/bash
+
+    # This source produces shell script at run time,
+    # and thus it is not corrected by patchShebangs.
+    substituteInPlace misc/cgo/testcarchive/carchive_test.go \
+      --replace '#!/usr/bin/env bash' '#!${runtimeShell}'
+
+    # Patch the mimetype database location which is missing on NixOS.
+    # but also allow static binaries built with NixOS to run outside nix
+    sed -i 's,\"/etc/mime.types,"${mailcap}/etc/mime.types\"\,\n\t&,' src/mime/type_unix.go
+
+    # Disabling the 'os/http/net' tests (they want files not available in
+    # chroot builds)
+    rm src/net/{listen,parse}_test.go
+    rm src/syscall/exec_linux_test.go
+
+    # !!! substituteInPlace does not seems to be effective.
+    # The os test wants to read files in an existing path. Just don't let it be /usr/bin.
+    sed -i 's,/usr/bin,'"`pwd`", src/os/os_test.go
+    sed -i 's,/bin/pwd,'"`type -P pwd`", src/os/os_test.go
+    # Fails on aarch64
+    sed -i '/TestFallocate/aif true \{ return\; \}' src/cmd/link/internal/ld/fallocate_test.go
+    # Skip this test since ssl patches mess it up.
+    sed -i '/TestLoadSystemCertsLoadColonSeparatedDirs/aif true \{ return\; \}' src/crypto/x509/root_unix_test.go
+    # Disable another PIE test which breaks.
+    sed -i '/TestTrivialPIE/aif true \{ return\; \}' misc/cgo/testshared/shared_test.go
+    # Disable the BuildModePie test
+    sed -i '/TestBuildmodePIE/aif true \{ return\; \}' src/cmd/go/go_test.go
+    # Disable the unix socket test
+    sed -i '/TestShutdownUnix/aif true \{ return\; \}' src/net/net_test.go
+    # Disable the hostname test
+    sed -i '/TestHostname/aif true \{ return\; \}' src/os/os_test.go
+    # ParseInLocation fails the test
+    sed -i '/TestParseInSydney/aif true \{ return\; \}' src/time/format_test.go
+    # Remove the api check as it never worked
+    sed -i '/src\/cmd\/api\/run.go/ireturn nil' src/cmd/dist/test.go
+    # Remove the coverage test as we have removed this utility
+    sed -i '/TestCoverageWithCgo/aif true \{ return\; \}' src/cmd/go/go_test.go
+    # Remove the timezone naming test
+    sed -i '/TestLoadFixed/aif true \{ return\; \}' src/time/time_test.go
+    # Remove disable setgid test
+    sed -i '/TestRespectSetgidDir/aif true \{ return\; \}' src/cmd/go/internal/work/build_test.go
+    # Remove cert tests that conflict with NixOS's cert resolution
+    sed -i '/TestEnvVars/aif true \{ return\; \}' src/crypto/x509/root_unix_test.go
+    # TestWritevError hangs sometimes
+    sed -i '/TestWritevError/aif true \{ return\; \}' src/net/writev_test.go
+    # TestVariousDeadlines fails sometimes
+    sed -i '/TestVariousDeadlines/aif true \{ return\; \}' src/net/timeout_test.go
+
+    sed -i 's,/etc/protocols,${iana-etc}/etc/protocols,' src/net/lookup_unix.go
+    sed -i 's,/etc/services,${iana-etc}/etc/services,' src/net/port_unix.go
+
+    # Disable cgo lookup tests not works, they depend on resolver
+    rm src/net/cgo_unix_test.go
+
+    # prepend the nix path to the zoneinfo files but also leave the original value for static binaries
+    # that run outside a nix server
+    sed -i 's,\"/usr/share/zoneinfo/,"${tzdata}/share/zoneinfo/\"\,\n\t&,' src/time/zoneinfo_unix.go
+
+  '' + lib.optionalString stdenv.isAarch32 ''
+    echo '#!${runtimeShell}' > misc/cgo/testplugin/test.bash
+  '' + lib.optionalString stdenv.isDarwin ''
+    substituteInPlace src/race.bash --replace \
+      "sysctl machdep.cpu.extfeatures | grep -qv EM64T" true
+    sed -i 's,strings.Contains(.*sysctl.*,true {,' src/cmd/dist/util.go
+    sed -i 's,"/etc","'"$TMPDIR"'",' src/os/os_test.go
+    sed -i 's,/_go_os_test,'"$TMPDIR"'/_go_os_test,' src/os/path_test.go
+
+    sed -i '/TestChdirAndGetwd/aif true \{ return\; \}' src/os/os_test.go
+    sed -i '/TestCredentialNoSetGroups/aif true \{ return\; \}' src/os/exec/exec_posix_test.go
+    sed -i '/TestRead0/aif true \{ return\; \}' src/os/os_test.go
+    sed -i '/TestSystemRoots/aif true \{ return\; \}' src/crypto/x509/root_darwin_test.go
+
+    sed -i '/TestGoInstallRebuildsStalePackagesInOtherGOPATH/aif true \{ return\; \}' src/cmd/go/go_test.go
+    sed -i '/TestBuildDashIInstallsDependencies/aif true \{ return\; \}' src/cmd/go/go_test.go
+
+    sed -i '/TestDisasmExtld/aif true \{ return\; \}' src/cmd/objdump/objdump_test.go
+
+    sed -i 's/unrecognized/unknown/' src/cmd/link/internal/ld/lib.go
+
+    # TestCurrent fails because Current is not implemented on Darwin
+    sed -i 's/TestCurrent/testCurrent/g' src/os/user/user_test.go
+    sed -i 's/TestLookup/testLookup/g' src/os/user/user_test.go
+
+    touch $TMPDIR/group $TMPDIR/hosts $TMPDIR/passwd
+  '';
+
+  patches = [
+    ./remove-tools-1.11.patch
+    ./ssl-cert-file-1.16.patch
+    ./remove-test-pie-1.15.patch
+    ./creds-test.patch
+    ./skip-chown-tests-1.16.patch
+    ./skip-external-network-tests-1.16.patch
+    ./skip-nohup-tests.patch
+    ./skip-cgo-tests-1.15.patch
+    ./go_no_vendor_checks-1.16.patch
+  ];
+
+  postPatch = ''
+    find . -name '*.orig' -exec rm {} ';'
+  '';
+
+  GOOS = stdenv.targetPlatform.parsed.kernel.name;
+  GOARCH = goarch stdenv.targetPlatform;
+  # GOHOSTOS/GOHOSTARCH must match the building system, not the host system.
+  # Go will nevertheless build a for host system that we will copy over in
+  # the install phase.
+  GOHOSTOS = stdenv.buildPlatform.parsed.kernel.name;
+  GOHOSTARCH = goarch stdenv.buildPlatform;
+
+  # {CC,CXX}_FOR_TARGET must be only set for cross compilation case as go expect those
+  # to be different from CC/CXX
+  CC_FOR_TARGET =
+    if (stdenv.buildPlatform != stdenv.targetPlatform) then
+      "${targetCC}/bin/${targetCC.targetPrefix}cc"
+    else
+      null;
+  CXX_FOR_TARGET =
+    if (stdenv.buildPlatform != stdenv.targetPlatform) then
+      "${targetCC}/bin/${targetCC.targetPrefix}c++"
+    else
+      null;
+
+  GOARM = toString (lib.intersectLists [ (stdenv.hostPlatform.parsed.cpu.version or "") ] [ "5" "6" "7" ]);
+  GO386 = "softfloat"; # from Arch: don't assume sse2 on i686
+  CGO_ENABLED = 1;
+  # Hopefully avoids test timeouts on Hydra
+  GO_TEST_TIMEOUT_SCALE = 3;
+
+  # Indicate that we are running on build infrastructure
+  # Some tests assume things like home directories and users exists
+  GO_BUILDER_NAME = "nix";
+
+  GOROOT_BOOTSTRAP = "${goBootstrap}/share/go";
+
+  postConfigure = ''
+    export GOCACHE=$TMPDIR/go-cache
+    # this is compiled into the binary
+    export GOROOT_FINAL=$out/share/go
+
+    export PATH=$(pwd)/bin:$PATH
+
+    ${lib.optionalString (stdenv.buildPlatform != stdenv.targetPlatform) ''
+    # Independent from host/target, CC should produce code for the building system.
+    # We only set it when cross-compiling.
+    export CC=${buildPackages.stdenv.cc}/bin/cc
+    ''}
+    ulimit -a
+  '';
+
+  postBuild = ''
+    (cd src && ./make.bash)
+  '';
+
+  doCheck = stdenv.hostPlatform == stdenv.targetPlatform && !stdenv.isDarwin;
+
+  checkPhase = ''
+    runHook preCheck
+    (cd src && HOME=$TMPDIR GOCACHE=$TMPDIR/go-cache ./run.bash --no-rebuild)
+    runHook postCheck
+  '';
+
+  preInstall = ''
+    rm -r pkg/obj
+    # Contains the wrong perl shebang when cross compiling,
+    # since it is not used for anything we can deleted as well.
+    rm src/regexp/syntax/make_perl_groups.pl
+  '' + (if (stdenv.buildPlatform != stdenv.hostPlatform) then ''
+    mv bin/*_*/* bin
+    rmdir bin/*_*
+    ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
+      rm -rf pkg/${GOHOSTOS}_${GOHOSTARCH} pkg/tool/${GOHOSTOS}_${GOHOSTARCH}
+    ''}
+  '' else if (stdenv.hostPlatform != stdenv.targetPlatform) then ''
+    rm -rf bin/*_*
+    ${lib.optionalString (!(GOHOSTARCH == GOARCH && GOOS == GOHOSTOS)) ''
+      rm -rf pkg/${GOOS}_${GOARCH} pkg/tool/${GOOS}_${GOARCH}
+    ''}
+  '' else "");
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $GOROOT_FINAL
+    cp -a bin pkg src lib misc api doc $GOROOT_FINAL
+    ln -s $GOROOT_FINAL/bin $out/bin
+    runHook postInstall
+  '';
+
+  disallowedReferences = [ goBootstrap ];
+
+  meta = with lib; {
+    homepage = "https://go.dev/";
+    description = "The Go Programming language";
+    license = licenses.bsd3;
+    maintainers = teams.golang.members;
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+}
--- a/pkgs/development/compilers/go/skip-chown-tests-1.16.patch
+++ b/pkgs/development/compilers/go/skip-chown-tests-1.16.patch
@ -0,0 +1,42 @@
+From 9a6718a6355d89b73011fbd1eb1bba8dcfa021e6 Mon Sep 17 00:00:00 2001
+From: regnat <rg@regnat.ovh>
+Date: Wed, 3 Nov 2021 10:17:28 +0100
+Subject: [PATCH] Disable the chown tests
+
+See https://github.com/golang/go/issues/42525 and
+https://github.com/NixOS/nix/issues/3245
+---
+ os/os_unix_test.go | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/os/os_unix_test.go b/os/os_unix_test.go
+index 51693fd..0936542 100644
+--- a/src/os/os_unix_test.go
+++ b/src/os/os_unix_test.go
+@@ -40,6 +40,7 @@ func checkUidGid(t *testing.T, path string, uid, gid int) {
+ }
+ 
+ func TestChown(t *testing.T) {
+        t.Skipf("https://github.com/golang/go/issues/42525")
+ 	// Use TempDir() to make sure we're on a local file system,
+ 	// so that the group ids returned by Getgroups will be allowed
+ 	// on the file. On NFS, the Getgroups groups are
+@@ -83,6 +84,7 @@ func TestChown(t *testing.T) {
+ }
+ 
+ func TestFileChown(t *testing.T) {
+        t.Skipf("https://github.com/golang/go/issues/42525")
+ 	// Use TempDir() to make sure we're on a local file system,
+ 	// so that the group ids returned by Getgroups will be allowed
+ 	// on the file. On NFS, the Getgroups groups are
+@@ -126,6 +128,7 @@ func TestFileChown(t *testing.T) {
+ }
+ 
+ func TestLchown(t *testing.T) {
+        t.Skipf("https://github.com/golang/go/issues/42525")
+ 	// Use TempDir() to make sure we're on a local file system,
+ 	// so that the group ids returned by Getgroups will be allowed
+ 	// on the file. On NFS, the Getgroups groups are
+-- 
+2.31.1
+
--- a/pkgs/development/libraries/libplacebo/default.nix
+++ b/pkgs/development/libraries/libplacebo/default.nix
@ -17,14 +17,14 @@

 stdenv.mkDerivation rec {
  pname = "libplacebo";
-  version = "4.192.0";
+  version = "4.192.1";

  src = fetchFromGitLab {
    domain = "code.videolan.org";
    owner = "videolan";
    repo = pname;
    rev = "v${version}";
-    sha256 = "19i7p9z8mmki5yq26059dp9055cccgxs0vfdlx0w1qak7pmv1vpm";
+    sha256 = "13z2f0vwf9fgfzqgkqzvqwa8c8nkymrg5hv7xslfx53dacjfidhy";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/pipewire/0050-pipewire-pulse-path.patch
+++ b/pkgs/development/libraries/pipewire/0050-pipewire-pulse-path.patch
@ -1,19 +1,19 @@
 diff --git a/meson_options.txt b/meson_options.txt
-index 71c2e35e9..a0f380c04 100644
+index 961ae2a76..692b84dfd 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -176,6 +176,9 @@ option('udev',
+@@ -179,6 +179,9 @@ option('udev',
 option('udevrulesdir',
        type : 'string',
        description : 'Directory for udev rules (defaults to /lib/udev/rules.d)')
 +option('pipewire_pulse_prefix',
 +       type : 'string',
 +       description: 'Install directory for the pipewire-pulse daemon')
- option('systemd-user-unit-dir',
+ option('systemd-system-unit-dir',
        type : 'string',
-        description : 'Directory for user systemd units (defaults to /usr/lib/systemd/user)')
+        description : 'Directory for system systemd units (defaults to /usr/lib/systemd/system)')
 diff --git a/src/daemon/systemd/user/meson.build b/src/daemon/systemd/user/meson.build
-index 5bd134537..5a3ca9ed5 100644
+index d17f3794f..34afe4f1a 100644
 --- a/src/daemon/systemd/user/meson.build
 +++ b/src/daemon/systemd/user/meson.build
@@ -9,7 +9,7 @@ install_data(
--- a/pkgs/development/libraries/pipewire/0090-pipewire-config-template-paths.patch
+++ b/pkgs/development/libraries/pipewire/0090-pipewire-config-template-paths.patch
@ -1,8 +1,8 @@
-diff --git a/src/daemon/pipewire.conf.in b/src/daemon/pipewire.conf.in
-index 648e13069..50f767f0c 100644
--- a/src/daemon/pipewire.conf.in
-+++ b/src/daemon/pipewire.conf.in
-@@ -131,7 +131,7 @@ context.modules = [
+diff --git a/src/daemon/minimal.conf.in b/src/daemon/minimal.conf.in
+index 6464839a0..05546201f 100644
+--- a/src/daemon/minimal.conf.in
+++ b/src/daemon/minimal.conf.in
+@@ -110,7 +110,7 @@ context.modules = [
             # access.allowed to list an array of paths of allowed
             # apps.
             #access.allowed = [
@ -11,7 +11,27 @@ index 648e13069..50f767f0c 100644
             #]
 
             # An array of rejected paths.
-@@ -235,12 +235,12 @@ context.exec = [
+@@ -298,5 +298,5 @@ context.exec = [
+     # It can be interesting to start another daemon here that listens
+     # on another address with the -a option (eg. -a tcp:4713).
+     #
+-    #@pulse_comment@{ path = "@pipewire_path@" args = "-c pipewire-pulse.conf" }
+    #@pulse_comment@{ path = "<pipewire_path>" args = "-c pipewire-pulse.conf" }
+ ]
+diff --git a/src/daemon/pipewire.conf.in b/src/daemon/pipewire.conf.in
+index a948a1b9b..4ece43c6f 100644
+--- a/src/daemon/pipewire.conf.in
+++ b/src/daemon/pipewire.conf.in
+@@ -132,7 +132,7 @@ context.modules = [
+             # access.allowed to list an array of paths of allowed
+             # apps.
+             #access.allowed = [
+-            #    @session_manager_path@
+            #    <session_manager_path>
+             #]
+ 
+             # An array of rejected paths.
+@@ -246,12 +246,12 @@ context.exec = [
     # but it is better to start it as a systemd service.
     # Run the session manager with -h for options.
     #
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@ -27,7 +27,6 @@
 , ncurses
 , readline81 # meson can't find <7 as those versions don't have a .pc file
 , lilv
-, openssl
 , makeFontsConf
 , callPackage
 , nixosTests
@ -55,8 +54,13 @@
 , libpulseaudio
 , zeroconfSupport ? true
 , avahi
+, raopSupport ? true
+, openssl
 , rocSupport ? true
 , roc-toolkit
+, x11Support ? true
+, libcanberra
+, xorg
 }:

 let
@ -65,7 +69,7 @@ let

  self = stdenv.mkDerivation rec {
    pname = "pipewire";
-    version = "0.3.43";
+    version = "0.3.45";

    outputs = [
      "out"
@ -83,7 +87,7 @@ let
      owner = "pipewire";
      repo = "pipewire";
      rev = version;
-      sha256 = "sha256-vjMA9dQvZe7dPbF9BNtCYf1V240RUBdtxeyqFjWA4j4=";
+      sha256 = "sha256-OnQd98qfOekAsVXLbciZLNPrM84KBX6fOx/f8y2BYI0=";
    };

    patches = [
@ -120,7 +124,6 @@ let
      libsndfile
      lilv
      ncurses
-      openssl
      readline81
      udev
      vulkan-headers
@ -134,7 +137,9 @@ let
    ++ lib.optionals bluezSupport [ bluez libfreeaptx ldacbt sbc fdk_aac ]
    ++ lib.optional pulseTunnelSupport libpulseaudio
    ++ lib.optional zeroconfSupport avahi
-    ++ lib.optional rocSupport roc-toolkit;
+    ++ lib.optional raopSupport openssl
+    ++ lib.optional rocSupport roc-toolkit
+    ++ lib.optionals x11Support [ libcanberra xorg.libxcb ];

    # Valgrind binary is required for running one optional test.
    checkInputs = lib.optional withValgrind valgrind;
@ -160,8 +165,10 @@ let
      "-Dbluez5-backend-hsphfpd=${mesonEnableFeature hsphfpdSupport}"
      "-Dsysconfdir=/etc"
      "-Dpipewire_confdata_dir=${placeholder "lib"}/share/pipewire"
+      "-Draop=${mesonEnableFeature raopSupport}"
      "-Dsession-managers="
      "-Dvulkan=enabled"
+      "-Dx11=${mesonEnableFeature x11Support}"
    ];

    # Fontconfig error: Cannot load default config file
@ -191,6 +198,8 @@ let
      moveToOutput "share/systemd/user/pipewire-pulse.*" "$pulse"
      moveToOutput "lib/systemd/user/pipewire-pulse.*" "$pulse"
      moveToOutput "bin/pipewire-pulse" "$pulse"
+
+      moveToOutput "bin/pw-jack" "$jack"
    '';

    passthru = {
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@ -38,7 +38,7 @@ lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)

  qtwebengine =
    let
-      branchName = "5.15.7";
+      branchName = "5.15.8";
      rev = "v${branchName}-lts";
    in
    {
@ -46,7 +46,7 @@ lib.mapAttrs mk (lib.importJSON ./srcs-generated.json)

      src = fetchgit {
        url = "https://github.com/qt/qtwebengine.git";
-        sha256 = "fssBN/CDgXAuiNj14MPeIDI15ZDRBGuF7wxSXns9exU=";
+        sha256 = "04xhg5qpnxm8hzgkanml45za64c9i5pbxhki2l2wcq4b4y7f3hyr";
        inherit rev branchName;
        fetchSubmodules = true;
        leaveDotGit = true;
--- a/pkgs/development/libraries/wlroots/0.15.nix
+++ b/pkgs/development/libraries/wlroots/0.15.nix
@ -9,14 +9,14 @@

 stdenv.mkDerivation rec {
  pname = "wlroots";
-  version = "0.15.0";
+  version = "0.15.1";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "wlroots";
    repo = "wlroots";
    rev = version;
-    sha256 = "0wdzs0wpv61pxgy3mx3xjsndyfmbj30v47d3w9ymmnd4r479n41n";
+    sha256 = "sha256-MFR38UuB/wW7J9ODDUOfgTzKLse0SSMIRYTpEaEdRwM=";
  };

  # $out for the library and $examples for the example programs (in examples):
--- a/pkgs/development/python-modules/aioconsole/default.nix
+++ b/pkgs/development/python-modules/aioconsole/default.nix
@ -16,7 +16,7 @@
 # wrapped to be able to find aioconsole and any other packages.
 buildPythonPackage rec {
  pname = "aioconsole";
-  version = "0.4.0";
+  version = "0.4.1";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "vxgmichel";
    repo = pname;
    rev = "v${version}";
-    sha256 = "185lzyqimi02l6q9dazkps7nlj08lf9l730ndyk59470jivccc21";
+    sha256 = "sha256-OCsao4oerHGpzsoqPP3EXJVs6NZeLNsoaC83k7oX688=";
  };

  checkInputs = [
--- a/pkgs/development/python-modules/aiogithubapi/default.nix
+++ b/pkgs/development/python-modules/aiogithubapi/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "aiogithubapi";
-  version = "22.1.2";
+  version = "22.2.0";
  format = "setuptools";

  disabled = pythonOlder "3.8";
@ -21,7 +21,7 @@ buildPythonPackage rec {
    owner = "ludeeus";
    repo = pname;
    rev = version;
-    sha256 = "sha256-n6OkyMh3HxsFY2zXqbpdvbv5NdFC+J30tW/tLEEaSeU=";
+    sha256 = "sha256-2M0EcDs3WmgG2tusvnXK750+ALE93RktlPyQO36+Ojw=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/faraday-plugins/default.nix
+++ b/pkgs/development/python-modules/faraday-plugins/default.nix
@ -16,14 +16,14 @@

 buildPythonPackage rec {
  pname = "faraday-plugins";
-  version = "1.5.10";
+  version = "1.6.0";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "infobyte";
    repo = "faraday_plugins";
    rev = "v${version}";
-    sha256 = "sha256-Xj1Ibl+xDN3uCww54StUBCc+w/iPMdbWucRqdb+GHVI=";
+    sha256 = "sha256-mvYbX8puqcT9kl1Abi785ptmmg9CxKZVTO6gPpk4sKU=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/flux-led/default.nix
+++ b/pkgs/development/python-modules/flux-led/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "flux-led";
-  version = "0.28.17";
+  version = "0.28.20";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "Danielhiversen";
    repo = "flux_led";
    rev = version;
-    sha256 = "1brh2wmv29vsvnndsjf1nbh2brwrkxicwcyj9brs9kgsrhvlv71s";
+    sha256 = "sha256-+2oY+dfRoY9Ypa2DJfIoz7jrTKMoSYz2zhjgl+BNmds=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/google-cloud-kms/default.nix
+++ b/pkgs/development/python-modules/google-cloud-kms/default.nix
@ -12,11 +12,11 @@

 buildPythonPackage rec {
  pname = "google-cloud-kms";
-  version = "2.10.1";
+  version = "2.11.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "6a1cedc549ee0886d8603f519cc8631de3112be6f84c0bbbaedab4ee3f9b58fc";
+    sha256 = "sha256-8JOa8HzYGJq1lrPXCWRvspXpopEK+qf5av7kmKbFIrQ=";
  };

  propagatedBuildInputs = [ grpc-google-iam-v1 google-api-core libcst proto-plus ];
--- a/pkgs/development/python-modules/google-cloud-texttospeech/default.nix
+++ b/pkgs/development/python-modules/google-cloud-texttospeech/default.nix
@ -11,11 +11,11 @@

 buildPythonPackage rec {
  pname = "google-cloud-texttospeech";
-  version = "2.9.1";
+  version = "2.10.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0a76bed3cf48cf72d4aa50329d5da2bbc008c5c7dd57326854fc038536e107f1";
+    sha256 = "sha256-j2MSeQLw7udQrEqj9LtMqvaGSgTLiItdpN8dUTedYdI=";
  };

  propagatedBuildInputs = [ libcst google-api-core proto-plus ];
--- a/pkgs/development/python-modules/identify/default.nix
+++ b/pkgs/development/python-modules/identify/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "identify";
-  version = "2.4.7";
+  version = "2.4.8";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "pre-commit";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Ub4R8jQH2nVhgMPEMV76JVcsJpX3X4BvciERVQXTA0o=";
+    sha256 = "sha256-MrlFTUNisT5VG8IUIk/qejkM7tV6qrU4ASBzAUCLWpQ=";
  };

  checkInputs = [
--- a/pkgs/development/python-modules/img2pdf/default.nix
+++ b/pkgs/development/python-modules/img2pdf/default.nix
@ -2,6 +2,7 @@
 , buildPythonPackage
 , isPy27
 , fetchPypi
+, fetchpatch
 , pikepdf
 , pillow
 , stdenv
@ -26,6 +27,15 @@ buildPythonPackage rec {
    sha256 = "sha256-jlHFBD76lddRSBtRYHGgBvh8KkBZlhqaxD7COJFd4J8=";
  };

+  patches = [
+    # Disable tests broken by Pillow 9.0.0
+    # https://gitlab.mister-muffin.de/josch/img2pdf/issues/130#issuecomment-586
+    (fetchpatch {
+      url = "https://salsa.debian.org/debian/img2pdf/-/raw/f77fefc81e7c4b235c47ae6777d222d391c59536/debian/patches/pillow9";
+      sha256 = "sha256-8giZCuv5PzSbrBQqslNqiLOhgxbg3LsdBVwt+DWnvh4=";
+    })
+  ];
+
  propagatedBuildInputs = [
    pikepdf
    pillow
--- a/pkgs/development/python-modules/jenkins-job-builder/default.nix
+++ b/pkgs/development/python-modules/jenkins-job-builder/default.nix
@ -9,11 +9,11 @@

 buildPythonPackage rec {
  pname = "jenkins-job-builder";
-  version = "3.11.0";
+  version = "3.12.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "42ea423f44beafee0e985009124968e300447f6e3be4180e83568cf21520d1b1";
+    sha256 = "sha256-gpsot4LW1IBfYt8eb72WJqMzWEAMt4gqWOD1KhTQjds=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pytile/default.nix
+++ b/pkgs/development/python-modules/pytile/default.nix
@ -13,7 +13,7 @@

 buildPythonPackage rec {
  pname = "pytile";
-  version = "2022.01.0";
+  version = "2022.02.0";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "bachya";
    repo = pname;
    rev = version;
-    sha256 = "sha256-7iR2R/ESaBd29Xf6ZKMGY41/uU55tB62QOvT3dFSZaE=";
+    sha256 = "sha256-IGjM9yU/3EjO9sV1ZZUX7RUL/a6CcMPzANhVMTcbZGU=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/pywlroots/default.nix
+++ b/pkgs/development/python-modules/pywlroots/default.nix
@ -18,11 +18,11 @@

 buildPythonPackage rec {
  pname = "pywlroots";
-  version = "0.15.6";
+  version = "0.15.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "vOdmwsMyDzz1kbA7+W2irax/1SFSNYTrRCQjfW7Npzk=";
+    sha256 = "EJAqtzFKx9Zripspv3lXIDj54pqHV0in6RrOCgFUyU8=";
  };

  # The XWayland detection uses some hard-coded FHS paths. Since we
--- a/pkgs/development/python-modules/renault-api/default.nix
+++ b/pkgs/development/python-modules/renault-api/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "renault-api";
-  version = "0.1.7";
+  version = "0.1.8";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -25,7 +25,7 @@ buildPythonPackage rec {
    owner = "hacf-fr";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-D0fsJ8mwBPcwuGuRkzgDTrwvnbe5yhilxTx49badKEQ=";
+    sha256 = "sha256-gGr9yzcEgcte2uYhHzgmqT80JRJyRia31bK/v+42teU=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@ -1,4 +1,5 @@
-{ bokeh
+{ azure-core
+, bokeh
 , buildPythonPackage
 , click
 , configparser
@ -11,6 +12,7 @@
 , jsonschema
 , lib
 , matplotlib
+, nbformat
 , pandas
 , pathtools
 , promise
@ -35,13 +37,13 @@

 buildPythonPackage rec {
  pname = "wandb";
-  version = "0.12.9";
+  version = "0.12.10";

  src = fetchFromGitHub {
    owner = pname;
    repo = "client";
    rev = "v${version}";
-    sha256 = "0704iv5dlsjs0gj6l4nx9hk9kzq46wlgd67ifw7i3qk6v4ljfs6y";
+    sha256 = "198c6zx7xih74cw0dwfqw7s7b7whik7wv4nfq6x6xw0kw86r6hby";
  };

  # The wandb requirements.txt does not distinguish python2/3 dependencies. We
@ -74,10 +76,6 @@ buildPythonPackage rec {
  ];

  disabledTestPaths = [
-    # Tests that require docker access, not possible in the nix build environment.
-    "tests/launch/test_launch.py"
-    "tests/launch/test_launch_cli.py"
-
    # Tests that try to get chatty over sockets or spin up servers, not possible in the nix build environment.
    "tests/test_cli.py"
    "tests/test_data_types.py"
@ -92,7 +90,6 @@ buildPythonPackage rec {
    "tests/test_metric_internal.py"
    "tests/test_mode_disabled.py"
    "tests/test_mp_full.py"
-    "tests/test_notebooks.py"
    "tests/test_public_api.py"
    "tests/test_redir.py"
    "tests/test_runtime.py"
@ -110,14 +107,19 @@ buildPythonPackage rec {

    # Fails and borks the pytest runner as well.
    "tests/wandb_test.py"
+
+    # Tries to access /homeless-shelter
+    "tests/test_tables.py"
  ];

  checkInputs = [
+    azure-core
    bokeh
    flask
    jsonref
    jsonschema
    matplotlib
+    nbformat
    pandas
    pydantic
    pytest-mock
--- a/pkgs/development/tools/analysis/bingrep/default.nix
+++ b/pkgs/development/tools/analysis/bingrep/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "bingrep";
-  version = "0.8.5";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "m4b";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-ayA3aEidZPa5GJgbbm5K3X2Xgd5Eb6TgUU80Gw/p07w=";
+    hash = "sha256-M3BYj1SKQKjEqP9cxaVlh7UeleDbcx6JN+UI6Ez+QJ8=";
  };

-  cargoSha256 = "sha256-XcXllex7UEufV5URhH7aqln1tNxwaiAETO3fUKmHf7s=";
+  cargoHash = "sha256-botAoLNg/qTh+cjPXcjo/Ol2Vktj/c5130k5falEuLY=";

  meta = with lib; {
    description = "Greps through binaries from various OSs and architectures, and colors them";
--- a/pkgs/development/tools/analysis/binlore/default.nix
+++ b/pkgs/development/tools/analysis/binlore/default.nix
@ -30,8 +30,8 @@ let
  src = fetchFromGitHub {
    owner = "abathur";
    repo = "binlore";
-    rev = "v0.1.3";
-    hash = "sha256-+rgv8gAQ3ptOpL/EhbKr/jq+k/4Lpn06/2qON+Ps2wE=";
+    rev = "v0.1.4";
+    hash = "sha256-+N0Bqyaj/mAwrcgFtUI8czmKo3VW6J8ZRxaPEghp7QM=";
  };
  /*
  binlore has one one more yallbacks responsible for
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@ -22,13 +22,13 @@ with py.pkgs;

 buildPythonApplication rec {
  pname = "checkov";
-  version = "2.0.763";
+  version = "2.0.787";

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = pname;
    rev = version;
-    hash = "sha256-KqxFFRKOCDzlGVKYMp3YNWMKGdxXT9f6xwaCc5XIruk=";
+    hash = "sha256-fnLnVr5WYpEG0qGjKm4JuQCHi3fbv9lu8jWNv/Z+3wM=";
  };

  nativeBuildInputs = with py.pkgs; [
@ -96,6 +96,7 @@ buildPythonApplication rec {
    "TestSarifReport"
    # Will probably be fixed in one of the next releases
    "test_valid_cyclonedx_bom"
+    "test_record_relative_path_with_direct_oberlay"
    # Requires prettytable release which is only available in staging
    "test_skipped_check_exists"
    "test_record_relative_path_with_relative_dir"
--- a/pkgs/development/tools/packer/default.nix
+++ b/pkgs/development/tools/packer/default.nix
@ -7,16 +7,16 @@

 buildGoModule rec {
  pname = "packer";
-  version = "1.7.9";
+  version = "1.7.10";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = "packer";
    rev = "v${version}";
-    sha256 = "sha256-e2G4kxcizE2lfdryS4S04OwWxseyUqGS0SAaBdiXax0=";
+    sha256 = "sha256-KkdkLos55n+IE9oIZPADIcSgrE6kn0rDWzEkwoYfoFw=";
  };

-  vendorSha256 = "sha256-5YcDaGbvw6xo5J8mtJ3CUS8JNCqKUD7kdUyfYIkQ6aE=";
+  vendorSha256 = "sha256-oSIwp8t+US8yNziuq0BR8BsVR1/e0jkxE4QuiqyheQQ=";

  subPackages = [ "." ];

@ -35,6 +35,5 @@ buildGoModule rec {
    maintainers = with maintainers; [ cstrahan zimbatm ma27 ];
    changelog   = "https://github.com/hashicorp/packer/blob/v${version}/CHANGELOG.md";
    platforms   = platforms.unix;
-    broken = stdenv.isDarwin; # needs to update gopsutil to at least v3.21.3 to include https://github.com/shirou/gopsutil/pull/1042
  };
 }
--- a/pkgs/development/tools/rust/cargo-xbuild/default.nix
+++ b/pkgs/development/tools/rust/cargo-xbuild/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-xbuild";
-  version = "0.6.2";
+  version = "0.6.5";

  src = fetchFromGitHub {
    owner = "rust-osdev";
    repo = pname;
    rev = "v${version}";
-    sha256 = "01whdjryz6zjsk4149h72w5xdjnkpcn5daf0xnsb59b0q38hjgg9";
+    sha256 = "sha256-bnceN47OFGlxs3ibcKoZFjoTgXRQxA2ZqxnthJ/fsqE=";
  };

-  cargoSha256 = "036a50shzl6wdjk5wypkacx1kjwbyb4x1aqhbzgjgpxxxrf0lj16";
+  cargoSha256 = "sha256-qMPJC61ZVW9olMgNnGrvcQ/je4se4J5gOVoaOpNMUo8=";

  meta = with lib; {
    description = "Automatically cross-compiles the sysroot crates core, compiler_builtins, and alloc";
--- a/pkgs/development/tools/scalafmt/default.nix
+++ b/pkgs/development/tools/scalafmt/default.nix
@ -2,7 +2,7 @@

 let
  baseName = "scalafmt";
-  version = "3.3.1";
+  version = "3.4.0";
  deps = stdenv.mkDerivation {
    name = "${baseName}-deps-${version}";
    buildCommand = ''
@ -13,7 +13,7 @@ let
    '';
    outputHashMode = "recursive";
    outputHashAlgo = "sha256";
-    outputHash     = "hEfy8hNuWin7mKXs9yD9bEKHCVNuxrz5qasTeLOi1zY=";
+    outputHash     = "l5F09bjRev2eBHKTMzojC7+USkW7qf3YtA2KSoN7MxM=";
  };
 in
 stdenv.mkDerivation {
--- a/pkgs/misc/vim-plugins/overrides.nix
+++ b/pkgs/misc/vim-plugins/overrides.nix
@ -692,7 +692,7 @@ self: super: {
    let
      # Based on the comment at the top of https://github.com/gittup/tup/blob/master/contrib/syntax/tup.vim
      ftdetect = builtins.toFile "tup.vim" ''
-        au BufNewFile,BufRead Tupfile, *.tup set filetype=tup
+        au BufNewFile,BufRead Tupfile,*.tup setf tup
      '';
    in
    buildVimPluginFrom2Nix {
--- a/pkgs/os-specific/linux/displaylink/default.nix
+++ b/pkgs/os-specific/linux/displaylink/default.nix
@ -20,22 +20,22 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "displaylink";
-  version = "5.4.1-55.174";
+  version = "5.5.0-beta-59.118";

  src = requireFile rec {
-    name = "displaylink.zip";
-    sha256 = "1biswvjz91gmx7xf9g05h3ra463hf2yv9mr2nkxclyrd283iiiqc";
+    name = "displaylink-55.zip";
+    sha256 = "0mid6p1mnkhbl96cr763ngdwrlgnpgs6c137rwc2sjf4v33g59ma";
    message = ''
      In order to install the DisplayLink drivers, you must first
      comply with DisplayLink's EULA and download the binaries and
      sources from here:

-      https://www.synaptics.com/products/displaylink-graphics/downloads/ubuntu-5.4.1
+      https://www.synaptics.com/products/displaylink-graphics/downloads/ubuntu-5.5-Beta

      Once you have downloaded the file, please use the following
      commands and re-run the installation:

-      mv \$PWD/"DisplayLink USB Graphics Software for Ubuntu ${lib.versions.majorMinor version}.zip" \$PWD/${name}
+      mv \$PWD/"DisplayLink USB Graphics Software for Ubuntu (Beta)5.5 Beta-EXE.zip" \$PWD/${name}
      nix-prefetch-url file://\$PWD/${name}
    '';
  };
--- a/pkgs/os-specific/linux/evdi/default.nix
+++ b/pkgs/os-specific/linux/evdi/default.nix
@ -2,15 +2,17 @@

 stdenv.mkDerivation rec {
  pname = "evdi";
-  version = "unstable-2021-07-07";
+  version = "1.10.0";

  src = fetchFromGitHub {
    owner = "DisplayLink";
    repo = pname;
-    rev = "b0b2c80eb63f9b858b71afa772135f434aea192a";
-    sha256 = "sha256-io+CbZovGjEJjwtmARFH23Djt933ONoHMDoea+i6xFo=";
+    rev = "v${version}";
+    sha256 = "sha256-vMcmUWdnO9JmImxz4vO3/UONlsrCGc8VH/o38YwCIzg=";
  };

+  NIX_CFLAGS_COMPILE = "-Wno-error -Wno-error=sign-compare";
+
  nativeBuildInputs = kernel.moduleBuildDependencies;

  buildInputs = [ kernel libdrm ];
@ -33,6 +35,6 @@ stdenv.mkDerivation rec {
    platforms = platforms.linux;
    license = with licenses; [ lgpl21Only gpl2Only ];
    homepage = "https://www.displaylink.com/";
-    broken = kernel.kernelOlder "4.19" || kernel.kernelAtLeast "5.15" || stdenv.isAarch64;
+    broken = kernel.kernelOlder "4.19" || stdenv.isAarch64;
  };
 }
--- a/pkgs/os-specific/linux/fnotifystat/default.nix
+++ b/pkgs/os-specific/linux/fnotifystat/default.nix
@ -1,22 +1,26 @@
-{ stdenv, lib, fetchurl }:
+{ stdenv, lib, fetchFromGitHub }:

 stdenv.mkDerivation rec {
  pname = "fnotifystat";
  version = "0.02.07";
-  src = fetchurl {
-    url = "https://kernel.ubuntu.com/~cking/tarballs/fnotifystat/fnotifystat-${version}.tar.gz";
-    sha256 = "0ipfg2gymbgx7bqlx1sq5p2y89k5j18iqnb0wa27n5s3kh9sh8w0";
+  src = fetchFromGitHub {
+    owner = "ColinIanKing";
+    repo = pname;
+    rev = "V${version}";
+    sha256 = "sha256-5oYM1t+vmWywYRbgXI2RGQlOuNJluj2gwCMf3pTpDC0=";
  };
-  installFlags = [ "DESTDIR=$(out)" ];
-  postInstall = ''
-    mv $out/usr/* $out
-    rm -r $out/usr
-  '';
+
+  installFlags = [
+    "BINDIR=${placeholder "out"}/bin"
+    "MANDIR=${placeholder "out"}/share/man/man8"
+    "BASHDIR=${placeholder "out"}/share/bash-completion/completions"
+  ];
+
  meta = with lib; {
    description = "File activity monitoring tool";
-    homepage = "https://kernel.ubuntu.com/~cking/fnotifystat/";
-    license = licenses.gpl2;
+    homepage = "https://github.com/ColinIanKing/fnotifystat";
+    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ womfoo ];
+    maintainers = with maintainers; [ womfoo dtzWill ];
  };
 }
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@ -2,51 +2,51 @@
    "4.14": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-4.14.262-hardened1.patch",
-            "sha256": "0z2vdqbsqngdm1w7dh65c1ir25x6vrpmyrjx3c8vgzql67c5xb4b",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.262-hardened1/linux-hardened-4.14.262-hardened1.patch"
+            "name": "linux-hardened-4.14.264-hardened1.patch",
+            "sha256": "1zlsww0mqaw5cswwqjvc9magh2a31v6ii7a4ivdra6nsv1xrdimy",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.264-hardened1/linux-hardened-4.14.264-hardened1.patch"
        },
-        "sha256": "05yl51r5n3q9l8pq6azx3bbl69l79lk8vkdivy3cvgzdh59pizac",
-        "version": "4.14.262"
+        "sha256": "1d1588f0zrq93dk9j8gmvfm9mlniyw98s0i3gmg2sa7h1p04pc2m",
+        "version": "4.14.264"
    },
    "4.19": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-4.19.225-hardened1.patch",
-            "sha256": "0wqwgsk0giwcp0kwp39nkv5bdqk4s2np7gsjymaqimq9187cnkvv",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.225-hardened1/linux-hardened-4.19.225-hardened1.patch"
+            "name": "linux-hardened-4.19.227-hardened1.patch",
+            "sha256": "127l8s1wb71iyb4iw1bxkxn48qcchz50qwjpx9r2vm81cihasxs7",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.227-hardened1/linux-hardened-4.19.227-hardened1.patch"
        },
-        "sha256": "15k7b04zx5ggfjagp8sfrylr9xgwgz3hb2bygdml7ka1jnbv76jb",
-        "version": "4.19.225"
+        "sha256": "0d1jyyxdrpyi35033fjg8g6zz99ffry2ks1wlldfaxfa6wh9dp39",
+        "version": "4.19.227"
    },
    "5.10": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.10.93-hardened1.patch",
-            "sha256": "0ka3vnd1pwdjkz10hpn4jpxbg6s00kf5jj47847vhbi7fmbgvbg5",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.93-hardened1/linux-hardened-5.10.93-hardened1.patch"
+            "name": "linux-hardened-5.10.96-hardened1.patch",
+            "sha256": "000mpwvyxkiw0kn0wdz8c97a39wafc8pia4rqraf7z21hbavbiav",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.10.96-hardened1/linux-hardened-5.10.96-hardened1.patch"
        },
-        "sha256": "1jxv7can60rc5i2yjgj8frcjvwi1jnba1jl8i3070xmb1d1qqy56",
-        "version": "5.10.93"
+        "sha256": "0j70nbsxy6qpynr3f9igl9wf14wx40diazf4j7w7mlwxh51a1r9m",
+        "version": "5.10.96"
    },
    "5.15": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.15.16-hardened1.patch",
-            "sha256": "0a8cdxw2s0jr39j072pn7xr5j8zfdmrbsfl5rbvcjqrfnj4ijc15",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.16-hardened1/linux-hardened-5.15.16-hardened1.patch"
+            "name": "linux-hardened-5.15.19-hardened1.patch",
+            "sha256": "0nkwf7dzvgm30hl24g8rpk3raqcxlplga0ksk8f9w7s87axpr5lm",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.15.19-hardened1/linux-hardened-5.15.19-hardened1.patch"
        },
-        "sha256": "150pzxra564z9xaaclmbbd29x4x9il8y78zz7szi50lzx0a0l2ms",
-        "version": "5.15.16"
+        "sha256": "0l70ckc0imnn7x9p9dawprzblszadk79468wx3zqz951yb4k5gh1",
+        "version": "5.15.19"
    },
    "5.4": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-5.4.173-hardened1.patch",
-            "sha256": "1zpczgxyh76lazsjgf7n1872aayaxg660x6phyr6db667wa8x3r4",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.173-hardened1/linux-hardened-5.4.173-hardened1.patch"
+            "name": "linux-hardened-5.4.176-hardened1.patch",
+            "sha256": "0w8zh2kcaclancivr65ij6mgbgyvf5vmlmf3mls4n1yj0ld15ghd",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.176-hardened1/linux-hardened-5.4.176-hardened1.patch"
        },
-        "sha256": "0ff2jvwxj55547wvwp94a8bsd610s72906d4nsyhiirrn9sy5s4r",
-        "version": "5.4.173"
+        "sha256": "0h67d34n8cwq60rv8nw0a7n9mkihs0cg0b5zl6ihfyjflqj0jq6r",
+        "version": "5.4.176"
    }
 }
--- a/pkgs/os-specific/linux/kernel/linux-4.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.4.nix
@ -1,12 +1,12 @@
 { buildPackages, fetchurl, perl, buildLinux, nixosTests, stdenv, ... } @ args:

 buildLinux (args // rec {
-  version = "4.4.301";
+  version = "4.4.302";
  extraMeta.branch = "4.4";
  extraMeta.broken = stdenv.isAarch64;

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0x0zq8i806i04p0cl742wxh8pxc0wglww0in98gr2ayp7r8qf7am";
+    sha256 = "1cvnydc7y5xrb1c4yfmsl846dd1jfrr7xf62gxbhnkk01fs7n09m";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.10.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.10.95";
+  version = "5.10.96";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "08zwcf66varjm2s4lb5a5yh5lh90kb43d6dlrg4xv1179vwxmnf8";
+    sha256 = "0j70nbsxy6qpynr3f9igl9wf14wx40diazf4j7w7mlwxh51a1r9m";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.15.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.15.18";
+  version = "5.15.19";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0pkcg3cns4l1i5r7ab77pksl76h54g2mnhvdhc1k8skp9pl71p91";
+    sha256 = "0l70ckc0imnn7x9p9dawprzblszadk79468wx3zqz951yb4k5gh1";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-5.16.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.16.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.16.4";
+  version = "5.16.5";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1gsh7gj5k6kqf5sf26b26rr0idgxdw4xxcba2qaajddyp502mqrb";
+    sha256 = "1ay7y7c2bdgvqd7hw8l9jxzx9m2rd5drdakjqnblz4w9sbcyvbpc";
  };
 } // (args.argsOverride or { }))
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@ -3,7 +3,7 @@
 with lib;

 buildLinux (args // rec {
-  version = "5.4.175";
+  version = "5.4.176";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0h2838jrw69xv1mg1qj0n8qx6g8n48iv8yna633xd20lzggip45c";
+    sha256 = "0h67d34n8cwq60rv8nw0a7n9mkihs0cg0b5zl6ihfyjflqj0jq6r";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@ -1,8 +1,8 @@
 { stdenv, lib, fetchsvn, linux
 , scripts ? fetchsvn {
    url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "18517";
-    sha256 = "1i4gppn3lyi3aqzscrdhm2dsvfa84xqhymcc468sakn9in3g85gg";
+    rev = "18587";
+    sha256 = "01h3mvj36b3wnkjm932ya5prsyfw7fszifdb9bvqwrd2ggawxng9";
  }
 , ...
 }:
--- a/pkgs/os-specific/linux/procdump/default.nix
+++ b/pkgs/os-specific/linux/procdump/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, bash, coreutils, gdb, zlib }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch, bash, coreutils, gdb, zlib }:

 stdenv.mkDerivation rec {
  pname = "procdump";
@ -11,6 +11,16 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-gVswAezHl7E2cBTJEQhPFXhHkzhWVHSpPF8m0s8+ekc=";
  };

+  patches = [
+    # Pull upstream patch to fix parallel builds:
+    #  https://github.com/Sysinternals/ProcDump-for-Linux/pull/133
+    (fetchpatch {
+      name = "parallel.patch";
+      url = "https://github.com/Sysinternals/ProcDump-for-Linux/commit/0d735836f11281cc6134be93eac8acb302f2055e.patch";
+      sha256 = "sha256-zsqllPHF8ZuXAIDSAPvbzdKa43uSSx9ilUKM1vFVW90=";
+    })
+  ];
+
  nativeBuildInputs = [ zlib ];
  buildInputs = [ bash coreutils gdb ];

@ -27,6 +37,8 @@ stdenv.mkDerivation rec {
    "MANDIR=/share/man/man1"
  ];

+  enableParallelBuilding = true;
+
  doCheck = false; # needs sudo root

  doInstallCheck = true;
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@ -2,7 +2,7 @@
 # Do not edit!

 {
-  version = "2022.2.0";
+  version = "2022.2.2";
  components = {
    "abode" = ps: with ps; [ abodepy ];
    "accuweather" = ps: with ps; [ accuweather ];
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@ -121,7 +121,7 @@ let
  extraBuildInputs = extraPackages python.pkgs;

  # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2022.2.0";
+  hassVersion = "2022.2.2";

 in python.pkgs.buildPythonApplication rec {
  pname = "homeassistant";
@ -139,7 +139,7 @@ in python.pkgs.buildPythonApplication rec {
    owner = "home-assistant";
    repo = "core";
    rev = version;
-    hash = "sha256:01gx6i147h7amj41mv46x6j9aah4qd1zjybv5px5y9p5cbhjccms";
+    hash = "sha256:09hji1n6blnr10k5y1rhp4v66iz2gwfd7afcd0sz156kw4g5mq89";
  };

  # leave this in, so users don't have to constantly update their downstream patch handling
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@ -4,11 +4,15 @@ buildPythonPackage rec {
  # the frontend version corresponding to a specific home-assistant version can be found here
  # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
  pname = "home-assistant-frontend";
-  version = "20220202.0";
+  version = "20220203.0";
+  format = "wheel";

  src = fetchPypi {
-    inherit pname version;
-    sha256 = "sha256-O5oDDptQmwM02SESSS314YlvCqrOcEHNBSKlYE/qrTc=";
+    inherit version format;
+    pname = "home_assistant_frontend";
+    dist = "py3";
+    python = "py3";
+    sha256 = "sha256-5iODXctmkw+MIdf/GECGhhWOMruMqeWBDWwwwrNQMjU=";
  };

  # there is nothing to strip in this package
--- a/pkgs/servers/limesurvey/default.nix
+++ b/pkgs/servers/limesurvey/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "limesurvey";
-  version = "3.23.7+201006";
+  version = "3.27.33+220125";

  src = fetchFromGitHub {
    owner = "LimeSurvey";
    repo = "LimeSurvey";
    rev = version;
-    sha256 = "19p978p0flknsg3iqlrrbr76qsk5ha2a84nxywqsvjrjvqrh5jrc";
+    sha256 = "sha256-iwTsn+glh8fwt1IaH9iDKDhEAnx1s1zvv1dmsdzUk8g=";
  };

  phpConfig = writeText "config.php" ''
@ -37,10 +37,5 @@ stdenv.mkDerivation rec {
    homepage = "https://www.limesurvey.org";
    maintainers = with maintainers; [offline];
    platforms = with platforms; unix;
-    knownVulnerabilities = [
-      # https://github.com/LimeSurvey/LimeSurvey/blob/3.x-LTS/docs/release_notes.txt
-      "Unauthorized access to statistics of a survey with certain permission configurations"
-      "Persistent XSS in browse response"
-    ];
  };
 }
--- a/pkgs/servers/matrix-conduit/default.nix
+++ b/pkgs/servers/matrix-conduit/default.nix
@ -1,22 +1,40 @@
-{ stdenv, lib, fetchFromGitLab, rustPlatform, }:
+{ stdenv, lib, fetchFromGitLab, rustPlatform, pkgs }:

 rustPlatform.buildRustPackage rec {
  pname = "matrix-conduit";
-  version = "0.2.0";
+  version = "0.3.0";

  src = fetchFromGitLab {
    owner = "famedly";
    repo = "conduit";
    rev = "v${version}";
-    sha256 = "0k3313bnv399v738j1xja9hngsmi39r3vzvgwssl5c24yvkvskdr";
+    sha256 = "sha256-jCBvenwXPgYms5Tbu16q/F8UNpvaw0Shao9kLEZLbHM=";
  };

-  cargoSha256 = "0379dvc8m8clc9lrxd1x0aciqvcgv3hjq7xfspz3bh8aq2a43pcs";
+  cargoSha256 = "sha256-fpjzc2HiWP6nV8YZOwxsIOhy4ht/tQqcvCkcLMIFUaQ=";
+
+  nativeBuildInputs = with pkgs; [
+    clang
+    llvmPackages.libclang
+  ];
+
+  buildInputs = with pkgs; [
+    pkg-config
+    clangStdenv
+    llvmPackages.libclang.lib
+    rocksdb
+  ];
+
+  preBuild = with pkgs; ''
+    export LIBCLANG_PATH="${llvmPackages.libclang.lib}/lib";
+  '';
+
+  cargoBuildFlags = "--bin conduit";

  meta = with lib; {
    description = "A Matrix homeserver written in Rust";
    homepage = "https://conduit.rs/";
    license = licenses.asl20;
-    maintainers = with maintainers; [ pstn piegames ];
+    maintainers = with maintainers; [ pstn piegames pimeys ];
  };
 }
--- a/pkgs/servers/prowlarr/default.nix
+++ b/pkgs/servers/prowlarr/default.nix
@ -16,14 +16,14 @@ let
  }."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

  hash = {
-    x64-linux_hash = "sha256-pkuq7waABHEo6gx6d3qJs4IXFu0EcrdpsQdKoMkjN3s=";
-    arm64-linux_hash = "sha256-+BLyb6mygCFQfe7u/MbGbJROF7XT0wdRPi08izI6u8c=";
-    x64-osx_hash = "sha256-f5EHxxXdXzj8x6BmTZCHQ9p8Sl8T0Rxe/K9FwTzbR4Q=";
+    x64-linux_hash = "sha256-NTkb6E0GRofd63TozLPxyNZ6GxO4pAc+MWsUDKWLZDY=";
+    arm64-linux_hash = "sha256-eB1Izvf/E0iOGkWt6fSc4oAt1sJ7XTxn/iwDNYz7WkA=";
+    x64-osx_hash = "sha256-TAphdcbzbNUZpWYVaHBkhI+RsgxWmI8n8Z6VwYxHXWg=";
  }."${arch}-${os}_hash";

 in stdenv.mkDerivation rec {
  pname = "prowlarr";
-  version = "0.1.10.1375";
+  version = "0.2.0.1448";

  src = fetchurl {
    url = "https://github.com/Prowlarr/Prowlarr/releases/download/v${version}/Prowlarr.develop.${version}.${os}-core-${arch}.tar.gz";
--- a/pkgs/servers/teleport/default.nix
+++ b/pkgs/servers/teleport/default.nix
@ -16,9 +16,9 @@ let
    owner = "gravitational";
    repo = "teleport";
    rev = "v${version}";
-    sha256 = "sha256-/Dn2X1VMQI1OYHmvNDlAjrLI64DFxmVmS3PeEKLFVjQ=";
+    sha256 = "sha256-ir2NMNIjSpv7l6dVNHczARg6b+doFofinsJy1smEC7o=";
  };
-  version = "8.1.1";
+  version = "8.1.3";

  roleTester = rustPlatform.buildRustPackage {
    name = "teleport-roletester";
@ -39,8 +39,8 @@ let
  webassets = fetchFromGitHub {
    owner = "gravitational";
    repo = "webassets";
-    rev = "36ba49bb58dd6933d5ed5c9599e86d2b6c828137";
-    sha256 = "sha256-XgH+IjTsaJUdM54Y+L8Rf/bt6y0vB4t8IcRES2EG70s=";
+    rev = "ea3c67c941c56cfb6c228612e88100df09fb6f9c";
+    sha256 = "sha256-oKvDXkxA73IJOi+ciBFVLkYcmeRUsTC+3rcYf64vDoY=";
  };
 in
 buildGo117Module rec {
--- a/pkgs/tools/X11/obconf/default.nix
+++ b/pkgs/tools/X11/obconf/default.nix
@ -0,0 +1,44 @@
+{ lib, stdenv, fetchgit, autoreconfHook, pkg-config, gtk3, openbox,
+  imlib2, libxml2, libstartup_notification, makeWrapper, libSM }:
+
+stdenv.mkDerivation rec {
+  pname = "obconf";
+  version = "unstable-2015-02-13";
+
+  src = fetchgit {
+    url = "git://git.openbox.org/dana/obconf";
+    rev = "63ec47c5e295ad4f09d1df6d92afb7e10c3fec39";
+    sha256 = "sha256-qwm66VA/ueRMFtSUcrmuObNkz+KYgWRnmR7TnQwpxiE=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    gtk3
+    imlib2
+    libSM
+    libstartup_notification
+    libxml2
+    makeWrapper
+    openbox
+  ];
+
+  postPatch = ''
+    substituteInPlace configure.ac --replace 2.0.4 ${version}
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/obconf --prefix XDG_DATA_DIRS : ${openbox}/share/
+  '';
+
+  meta = {
+    description = "GUI configuration tool for openbox";
+    homepage = "http://openbox.org/wiki/ObConf";
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ lib.maintainers.sfrijters ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/tools/inputmethods/fcitx5/default.nix
+++ b/pkgs/tools/inputmethods/fcitx5/default.nix
@ -41,13 +41,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "fcitx5";
-  version = "5.0.12";
+  version = "5.0.14";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = pname;
    rev = version;
-    sha256 = "sha256-v+K4rlUOBWoRXh7lNeETBbgtu5IJqYKXwSznIRzrrwE=";
+    sha256 = "sha256-Trpye+jTu+l8ieUK6IX+ZqNe4H2DvoJ10juiMkEGRKM=";
  };

  prePatch = ''
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-chinese-addons.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-chinese-addons.nix
@ -31,13 +31,13 @@ in

 mkDerivation rec {
  pname = "fcitx5-chinese-addons";
-  version = "5.0.10";
+  version = "5.0.11";

  src = fetchFromGitHub {
    owner = "fcitx";
-    repo = "fcitx5-chinese-addons";
+    repo = pname;
    rev = version;
-    sha256 = "sha256-8h2cHjxcn1swm2TsH9pZu+ojOB6xlspdd4IIXYxZM/8=";
+    sha256 = "sha256-PBKTc6yxCaLYZxfR7158rTkR7GsDCapjCKBuLxNu4dU=";
  };

  cmakeFlags = [
--- a/Show More
+++ b/Show More