Merge master into haskell-updates

2022-01-02 00:08:53 +00:00 · 2022-01-02 00:08:53 +00:00 · b0c76508ef
commit b0c76508ef
parent e122507667 82ccdfbdb9
184 changed files with 2528 additions and 1506 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -1170,6 +1170,17 @@
    githubId = 56650223;
    name = "Artturi N";
  };
+  azahi = {
+    email = "azahi@teknik.io";
+    matrix = "@azahi:matrix.org";
+    github = "azahi";
+    githubId = 22211000;
+    name = "Azat Bahawi";
+    keys = [{
+      longkeyid = "rsa2048/0xB40FCB6608BBE3B6";
+      fingerprint = "E9F3 483F 31C7 29B4 4CA2  7C38 B40F CB66 08BB E3B6";
+    }];
+  };
  ayazhafiz = {
    email = "ayaz.hafiz.1@gmail.com";
    github = "ayazhafiz";
@ -3125,6 +3136,16 @@
    githubId = 10198051;
    name = "Drew Risinger";
  };
+  drperceptron = {
+    email = "92106371+drperceptron@users.noreply.github.com";
+    github = "drperceptron";
+    githubId = 92106371;
+    name = "Dr Perceptron";
+    keys = [{
+      longkeyid = "rsa4096/0x95EB6DFF26D1CEB0";
+      fingerprint = "7E38 89D9 B1A8 B381 C8DE  A15F 95EB 6DFF 26D1 CEB0";
+    }];
+  };
  drupol = {
    name = "Pol Dellaiera";
    email = "pol.dellaiera@protonmail.com";
@ -11037,6 +11058,13 @@
    githubId = 26806;
    name = "Scott Olson";
  };
+  SomeoneSerge = {
+    email = "sergei.kozlukov@aalto.fi";
+    matrix = "@ss:someonex.net";
+    github = "SomeoneSerge";
+    githubId = 9720532;
+    name = "Sergei K";
+  };
  sondr3 = {
    email = "nilsen.sondre@gmail.com";
    github = "sondr3";
@ -11163,6 +11191,12 @@
    githubId = 7512804;
    name = "Martin Langlotz";
  };
+  steamwalker = {
+    email = "steamwalker@xs4all.nl";
+    github = "steamwalker";
+    githubId = 94006354;
+    name = "steamwalker";
+  };
  steell = {
    email = "steve@steellworks.com";
    github = "Steell";
@ -11795,6 +11829,13 @@
    githubId = 1618946;
    name = "Tiago Castro";
  };
+  tilcreator = {
+    name = "Tilman Jackel";
+    email = "contact.nixos@tc-j.de";
+    matrix = "@tilcreator:matrix.org";
+    github = "TilCreator";
+    githubId = 18621411;
+  };
  tilpner = {
    email = "till@hoeppner.ws";
    github = "tilpner";
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@ -273,13 +273,6 @@
          <link xlink:href="options.html#opt-services.peertube.enable">services.peertube</link>.
        </para>
      </listitem>
-      <listitem>
-        <para>
-          <link xlink:href="https://maddy.email">maddy</link>, a
-          composable all-in-one mail server. Available as
-          <link xlink:href="options.html#opt-services.maddy.enable">services.maddy</link>.
-        </para>
-      </listitem>
      <listitem>
        <para>
          <link xlink:href="https://sr.ht">sourcehut</link>, a
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -30,6 +30,14 @@
          PHP 8.1 is now available
        </para>
      </listitem>
+      <listitem>
+        <para>
+          Mattermost has been updated to version 6.2. Migrations may
+          take a while, see the
+          <link xlink:href="https://docs.mattermost.com/install/self-managed-changelog.html#release-v6.2-feature-release">upgrade
+          notes</link>.
+        </para>
+      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="sec-release-22.05-new-services">
@ -66,6 +74,13 @@
          <link xlink:href="options.html#opt-services.powerdns-admin.enable">services.powerdns-admin</link>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://maddy.email">maddy</link>, a
+          composable all-in-one mail server. Available as
+          <link xlink:href="options.html#opt-services.maddy.enable">services.maddy</link>.
+        </para>
+      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="sec-release-22.05-incompatibilities">
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@ -74,8 +74,6 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [PeerTube](https://joinpeertube.org/), developed by Framasoft, is the free and decentralized alternative to video platforms. Available at [services.peertube](options.html#opt-services.peertube.enable).

- [maddy](https://maddy.email), a composable all-in-one mail server. Available as [services.maddy](options.html#opt-services.maddy.enable).
-
 - [sourcehut](https://sr.ht), a collection of tools useful for software development. Available as [services.sourcehut](options.html#opt-services.sourcehut.enable).

 - [ucarp](https://download.pureftpd.org/pub/ucarp/README), an userspace implementation of the Common Address Redundancy Protocol (CARP). Available as [networking.ucarp](options.html#opt-networking.ucarp.enable).
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -13,6 +13,9 @@ In addition to numerous new and upgraded packages, this release has the followin

 - PHP 8.1 is now available

+- Mattermost has been updated to version 6.2. Migrations may take a while,
+  see the [upgrade notes](https://docs.mattermost.com/install/self-managed-changelog.html#release-v6.2-feature-release).
+
 ## New Services {#sec-release-22.05-new-services}

 - [aesmd](https://github.com/intel/linux-sgx#install-the-intelr-sgx-psw), the Intel SGX Architectural Enclave Service Manager. Available as [services.aesmd](#opt-services.aesmd.enable).
@ -22,6 +25,8 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [PowerDNS-Admin](https://github.com/ngoduykhanh/PowerDNS-Admin), a web interface for the PowerDNS server. Available at [services.powerdns-admin](options.html#opt-services.powerdns-admin.enable).

+- [maddy](https://maddy.email), a composable all-in-one mail server. Available as [services.maddy](options.html#opt-services.maddy.enable).
+
 ## Backward Incompatibilities {#sec-release-22.05-incompatibilities}

 - `pkgs.ghc` now refers to `pkgs.targetPackages.haskellPackages.ghc`.
--- a/nixos/modules/services/mail/maddy.nix
+++ b/nixos/modules/services/mail/maddy.nix
@ -3,9 +3,16 @@
 with lib;

 let
+
  name = "maddy";
+
  cfg = config.services.maddy;
+
  defaultConfig = ''
+    # Minimal configuration with TLS disabled, adapted from upstream example
+    # configuration here https://github.com/foxcpp/maddy/blob/master/maddy.conf
+    # Do not use this in production!
+
    tls off

    auth.pass_table local_authdb {
@ -131,22 +138,34 @@ let
 in {
  options = {
    services.maddy = {
+
      enable = mkEnableOption "Maddy, a free an open source mail server";

      user = mkOption {
        default = "maddy";
        type = with types; uniq string;
        description = ''
-          Name of the user under which maddy will run. If not specified, a
-          default user will be created.
+          User account under which maddy runs.
+
+          <note><para>
+          If left as the default value this user will automatically be created
+          on system activation, otherwise the sysadmin is responsible for
+          ensuring the user exists before the maddy service starts.
+          </para></note>
        '';
      };
+
      group = mkOption {
        default = "maddy";
        type = with types; uniq string;
        description = ''
-          Name of the group under which maddy will run. If not specified, a
-          default group will be created.
+          Group account under which maddy runs.
+
+          <note><para>
+          If left as the default value this group will automatically be created
+          on system activation, otherwise the sysadmin is responsible for
+          ensuring the group exists before the maddy service starts.
+          </para></note>
        '';
      };

@ -158,6 +177,7 @@ in {
          Hostname to use. It should be FQDN.
        '';
      };
+
      primaryDomain = mkOption {
        default = "localhost";
        type = with types; uniq string;
@ -166,6 +186,7 @@ in {
          Primary MX domain to use. It should be FQDN.
        '';
      };
+
      localDomains = mkOption {
        type = with types; listOf str;
        default = ["$(primary_domain)"];
@ -178,11 +199,18 @@ in {
          Define list of allowed domains.
        '';
      };
+
      config = mkOption {
        type = with types; nullOr lines;
        default = defaultConfig;
        description = ''
-          Server configuration.
+          Server configuration, see
+          <link xlink:href="https://maddy.email">https://maddy.email</link> for
+          more information. The default configuration of this module will setup
+          minimal maddy instance for mail transfer without TLS encryption.
+          <note><para>
+          This should not be used in a production environment.
+          </para></note>
        '';
      };

@ -203,9 +231,11 @@ in {
      packages = [ pkgs.maddy ];
      services.maddy = {
        serviceConfig = {
-          User = "${cfg.user}";
-          Group = "${cfg.group}";
+          User = cfg.user;
+          Group = cfg.group;
+          StateDirectory = [ "maddy" ];
        };
+        restartTriggers = [ config.environment.etc."maddy/maddy.conf".source ];
        wantedBy = [ "multi-user.target" ];
      };
    };
@ -220,20 +250,16 @@ in {
      '';
    };

-    users.users = optionalAttrs (cfg.user == "maddy") {
-      maddy = {
-        description = "Maddy service user";
-        group = cfg.group;
-        home = "/var/lib/maddy";
-        createHome = true;
+    users.users = optionalAttrs (cfg.user == name) {
+      ${name} = {
        isSystemUser = true;
+        group = cfg.group;
+        description = "Maddy mail transfer agent user";
      };
    };

-    users.groups = mkIf (cfg.group == "maddy") {
-      maddy = pkgs.lib.mkForce {
-        name = cfg.group;
-      };
+    users.groups = optionalAttrs (cfg.group == name) {
+      ${cfg.group} = { };
    };

    networking.firewall = mkIf cfg.openFirewall {
--- a/nixos/modules/services/web-apps/mattermost.nix
+++ b/nixos/modules/services/web-apps/mattermost.nix
@ -6,23 +6,95 @@ let

  cfg = config.services.mattermost;

-  defaultConfig = builtins.fromJSON (builtins.replaceStrings [ "\\u0026" ] [ "&" ]
-    (readFile "${pkgs.mattermost}/config/config.json")
-  );
-
  database = "postgres://${cfg.localDatabaseUser}:${cfg.localDatabasePassword}@localhost:5432/${cfg.localDatabaseName}?sslmode=disable&connect_timeout=10";

-  mattermostConf = foldl recursiveUpdate defaultConfig
-    [ { ServiceSettings.SiteURL = cfg.siteUrl;
-        ServiceSettings.ListenAddress = cfg.listenAddress;
-        TeamSettings.SiteName = cfg.siteName;
-        SqlSettings.DriverName = "postgres";
-        SqlSettings.DataSource = database;
-      }
-      cfg.extraConfig
-    ];
+  postgresPackage = config.services.postgresql.package;

-  mattermostConfJSON = pkgs.writeText "mattermost-config-raw.json" (builtins.toJSON mattermostConf);
+  createDb = {
+    statePath ? cfg.statePath,
+    localDatabaseUser ? cfg.localDatabaseUser,
+    localDatabasePassword ? cfg.localDatabasePassword,
+    localDatabaseName ? cfg.localDatabaseName,
+    useSudo ? true
+  }: ''
+    if ! test -e ${escapeShellArg "${statePath}/.db-created"}; then
+      ${lib.optionalString useSudo "${pkgs.sudo}/bin/sudo -u ${escapeShellArg config.services.postgresql.superUser} \\"}
+        ${postgresPackage}/bin/psql postgres -c \
+          "CREATE ROLE ${localDatabaseUser} WITH LOGIN NOCREATEDB NOCREATEROLE ENCRYPTED PASSWORD '${localDatabasePassword}'"
+      ${lib.optionalString useSudo "${pkgs.sudo}/bin/sudo -u ${escapeShellArg config.services.postgresql.superUser} \\"}
+        ${postgresPackage}/bin/createdb \
+          --owner ${escapeShellArg localDatabaseUser} ${escapeShellArg localDatabaseName}
+      touch ${escapeShellArg "${statePath}/.db-created"}
+    fi
+  '';
+
+  mattermostPluginDerivations = with pkgs;
+    map (plugin: stdenv.mkDerivation {
+      name = "mattermost-plugin";
+      installPhase = ''
+        mkdir -p $out/share
+        cp ${plugin} $out/share/plugin.tar.gz
+      '';
+      dontUnpack = true;
+      dontPatch = true;
+      dontConfigure = true;
+      dontBuild = true;
+      preferLocalBuild = true;
+    }) cfg.plugins;
+
+  mattermostPlugins = with pkgs;
+    if mattermostPluginDerivations == [] then null
+    else stdenv.mkDerivation {
+      name = "${cfg.package.name}-plugins";
+      nativeBuildInputs = [
+        autoPatchelfHook
+      ] ++ mattermostPluginDerivations;
+      buildInputs = [
+        cfg.package
+      ];
+      installPhase = ''
+        mkdir -p $out/data/plugins
+        plugins=(${escapeShellArgs (map (plugin: "${plugin}/share/plugin.tar.gz") mattermostPluginDerivations)})
+        for plugin in "''${plugins[@]}"; do
+          hash="$(sha256sum "$plugin" | cut -d' ' -f1)"
+          mkdir -p "$hash"
+          tar -C "$hash" -xzf "$plugin"
+          autoPatchelf "$hash"
+          GZIP_OPT=-9 tar -C "$hash" -cvzf "$out/data/plugins/$hash.tar.gz" .
+          rm -rf "$hash"
+        done
+      '';
+
+      dontUnpack = true;
+      dontPatch = true;
+      dontConfigure = true;
+      dontBuild = true;
+      preferLocalBuild = true;
+    };
+
+  mattermostConfWithoutPlugins = recursiveUpdate
+    { ServiceSettings.SiteURL = cfg.siteUrl;
+      ServiceSettings.ListenAddress = cfg.listenAddress;
+      TeamSettings.SiteName = cfg.siteName;
+      SqlSettings.DriverName = "postgres";
+      SqlSettings.DataSource = database;
+      PluginSettings.Directory = "${cfg.statePath}/plugins/server";
+      PluginSettings.ClientDirectory = "${cfg.statePath}/plugins/client";
+    }
+    cfg.extraConfig;
+
+  mattermostConf = recursiveUpdate
+    mattermostConfWithoutPlugins
+    (
+      if mattermostPlugins == null then {}
+      else {
+        PluginSettings = {
+          Enable = true;
+        };
+      }
+    );
+
+  mattermostConfJSON = pkgs.writeText "mattermost-config.json" (builtins.toJSON mattermostConf);

 in

@ -31,6 +103,13 @@ in
    services.mattermost = {
      enable = mkEnableOption "Mattermost chat server";

+      package = mkOption {
+        type = types.package;
+        default = pkgs.mattermost;
+        defaultText = "pkgs.mattermost";
+        description = "Mattermost derivation to use.";
+      };
+
      statePath = mkOption {
        type = types.str;
        default = "/var/lib/mattermost";
@ -77,6 +156,16 @@ in
        '';
      };

+      preferNixConfig = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          If both mutableConfig and this option are set, the Nix configuration
+          will take precedence over any settings configured in the server
+          console.
+        '';
+      };
+
      extraConfig = mkOption {
        type = types.attrs;
        default = { };
@ -85,6 +174,17 @@ in
        '';
      };

+      plugins = mkOption {
+        type = types.listOf (types.oneOf [types.path types.package]);
+        default = [];
+        example = "[ ./com.github.moussetc.mattermost.plugin.giphy-2.0.0.tar.gz ]";
+        description = ''
+          Plugins to add to the configuration. Overrides any installed if non-null.
+          This is a list of paths to .tar.gz files or derivations evaluating to
+          .tar.gz files. All entries will be passed to `mattermost plugin add`.
+        '';
+      };
+
      localDatabaseCreate = mkOption {
        type = types.bool;
        default = true;
@ -135,6 +235,12 @@ in

      matterircd = {
        enable = mkEnableOption "Mattermost IRC bridge";
+        package = mkOption {
+          type = types.package;
+          default = pkgs.matterircd;
+          defaultText = "pkgs.matterircd";
+          description = "matterircd derivation to use.";
+        };
        parameters = mkOption {
          type = types.listOf types.str;
          default = [ ];
@ -167,7 +273,7 @@ in
      # The systemd service will fail to execute the preStart hook
      # if the WorkingDirectory does not exist
      system.activationScripts.mattermost = ''
-        mkdir -p ${cfg.statePath}
+        mkdir -p "${cfg.statePath}"
      '';

      systemd.services.mattermost = {
@ -176,39 +282,41 @@ in
        after = [ "network.target" "postgresql.service" ];

        preStart = ''
-          mkdir -p ${cfg.statePath}/{data,config,logs}
-          ln -sf ${pkgs.mattermost}/{bin,fonts,i18n,templates,client} ${cfg.statePath}
+          mkdir -p "${cfg.statePath}"/{data,config,logs,plugins}
+          mkdir -p "${cfg.statePath}/plugins"/{client,server}
+          ln -sf ${cfg.package}/{bin,fonts,i18n,templates,client} "${cfg.statePath}"
+        '' + lib.optionalString (mattermostPlugins != null) ''
+          rm -rf "${cfg.statePath}/data/plugins"
+          ln -sf ${mattermostPlugins}/data/plugins "${cfg.statePath}/data"
        '' + lib.optionalString (!cfg.mutableConfig) ''
-          rm -f ${cfg.statePath}/config/config.json
-          cp ${mattermostConfJSON} ${cfg.statePath}/config/config.json
-          ${pkgs.mattermost}/bin/mattermost config migrate ${cfg.statePath}/config/config.json ${database}
+          rm -f "${cfg.statePath}/config/config.json"
+          ${pkgs.jq}/bin/jq -s '.[0] * .[1]' ${cfg.package}/config/config.json ${mattermostConfJSON} > "${cfg.statePath}/config/config.json"
        '' + lib.optionalString cfg.mutableConfig ''
          if ! test -e "${cfg.statePath}/config/.initial-created"; then
            rm -f ${cfg.statePath}/config/config.json
-            cp ${mattermostConfJSON} ${cfg.statePath}/config/config.json
-            touch ${cfg.statePath}/config/.initial-created
+            ${pkgs.jq}/bin/jq -s '.[0] * .[1]' ${cfg.package}/config/config.json ${mattermostConfJSON} > "${cfg.statePath}/config/config.json"
+            touch "${cfg.statePath}/config/.initial-created"
          fi
-        '' + lib.optionalString cfg.localDatabaseCreate ''
-          if ! test -e "${cfg.statePath}/.db-created"; then
-            ${pkgs.sudo}/bin/sudo -u ${config.services.postgresql.superUser} \
-              ${config.services.postgresql.package}/bin/psql postgres -c \
-                "CREATE ROLE ${cfg.localDatabaseUser} WITH LOGIN NOCREATEDB NOCREATEROLE ENCRYPTED PASSWORD '${cfg.localDatabasePassword}'"
-            ${pkgs.sudo}/bin/sudo -u ${config.services.postgresql.superUser} \
-              ${config.services.postgresql.package}/bin/createdb \
-                --owner ${cfg.localDatabaseUser} ${cfg.localDatabaseName}
-            touch ${cfg.statePath}/.db-created
-          fi
-        '' + ''
-          chown ${cfg.user}:${cfg.group} -R ${cfg.statePath}
-          chmod u+rw,g+r,o-rwx -R ${cfg.statePath}
+        '' + lib.optionalString (cfg.mutableConfig && cfg.preferNixConfig) ''
+          new_config="$(${pkgs.jq}/bin/jq -s '.[0] * .[1]' "${cfg.statePath}/config/config.json" ${mattermostConfJSON})"
+
+          rm -f "${cfg.statePath}/config/config.json"
+          echo "$new_config" > "${cfg.statePath}/config/config.json"
+        '' + lib.optionalString cfg.localDatabaseCreate (createDb {}) + ''
+          # Don't change permissions recursively on the data, current, and symlinked directories (see ln -sf command above).
+          # This dramatically decreases startup times for installations with a lot of files.
+          find . -maxdepth 1 -not -name data -not -name client -not -name templates -not -name i18n -not -name fonts -not -name bin -not -name . \
+            -exec chown "${cfg.user}:${cfg.group}" -R {} \; -exec chmod u+rw,g+r,o-rwx -R {} \;
+
+          chown "${cfg.user}:${cfg.group}" "${cfg.statePath}/data" .
+          chmod u+rw,g+r,o-rwx "${cfg.statePath}/data" .
        '';

        serviceConfig = {
          PermissionsStartOnly = true;
          User = cfg.user;
          Group = cfg.group;
-          ExecStart = "${pkgs.mattermost}/bin/mattermost" +
-            (lib.optionalString (!cfg.mutableConfig) " -c ${database}");
+          ExecStart = "${cfg.package}/bin/mattermost";
          WorkingDirectory = "${cfg.statePath}";
          Restart = "always";
          RestartSec = "10";
@ -224,7 +332,7 @@ in
        serviceConfig = {
          User = "nobody";
          Group = "nogroup";
-          ExecStart = "${pkgs.matterircd}/bin/matterircd ${concatStringsSep " " cfg.matterircd.parameters}";
+          ExecStart = "${cfg.matterircd.package}/bin/matterircd ${escapeShellArgs cfg.matterircd.parameters}";
          WorkingDirectory = "/tmp";
          PrivateTmp = true;
          Restart = "always";
--- a/nixos/modules/services/x11/desktop-managers/lumina.nix
+++ b/nixos/modules/services/x11/desktop-managers/lumina.nix
@ -38,11 +38,5 @@ in
      "/share"
    ];

-    security.wrappers.lumina-checkpass-wrapped = {
-      source = "${pkgs.lumina.lumina}/bin/lumina-checkpass";
-      owner = "root";
-      group = "root";
-    };
-
  };
 }
--- a/nixos/modules/tasks/network-interfaces-scripted.nix
+++ b/nixos/modules/tasks/network-interfaces-scripted.nix
@ -532,6 +532,33 @@ let
            '';
          });

+        createGreDevice = n: v: nameValuePair "${n}-netdev"
+          (let
+            deps = deviceDependency v.dev;
+          in
+          { description = "GRE Tunnel Interface ${n}";
+            wantedBy = [ "network-setup.service" (subsystemDevice n) ];
+            bindsTo = deps;
+            partOf = [ "network-setup.service" ];
+            after = [ "network-pre.target" ] ++ deps;
+            before = [ "network-setup.service" ];
+            serviceConfig.Type = "oneshot";
+            serviceConfig.RemainAfterExit = true;
+            path = [ pkgs.iproute2 ];
+            script = ''
+              # Remove Dead Interfaces
+              ip link show "${n}" >/dev/null 2>&1 && ip link delete "${n}"
+              ip link add name "${n}" type ${v.type} \
+                ${optionalString (v.remote != null) "remote \"${v.remote}\""} \
+                ${optionalString (v.local != null) "local \"${v.local}\""} \
+                ${optionalString (v.dev != null) "dev \"${v.dev}\""}
+              ip link set "${n}" up
+            '';
+            postStop = ''
+              ip link delete "${n}" || true
+            '';
+          });
+
        createVlanDevice = n: v: nameValuePair "${n}-netdev"
          (let
            deps = deviceDependency v.interface;
@ -570,6 +597,7 @@ let
         // mapAttrs' createMacvlanDevice cfg.macvlans
         // mapAttrs' createFouEncapsulation cfg.fooOverUDP
         // mapAttrs' createSitDevice cfg.sits
+         // mapAttrs' createGreDevice cfg.greTunnels
         // mapAttrs' createVlanDevice cfg.vlans
         // {
           network-setup = networkSetup;
--- a/nixos/modules/tasks/network-interfaces-systemd.nix
+++ b/nixos/modules/tasks/network-interfaces-systemd.nix
@ -18,6 +18,7 @@ let
    concatLists (map (bond: bond.interfaces) (attrValues cfg.bonds))
    ++ concatLists (map (bridge: bridge.interfaces) (attrValues cfg.bridges))
    ++ map (sit: sit.dev) (attrValues cfg.sits)
+    ++ map (gre: gre.dev) (attrValues cfg.greTunnels)
    ++ map (vlan: vlan.interface) (attrValues cfg.vlans)
    # add dependency to physical or independently created vswitch member interface
    # TODO: warn the user that any address configured on those interfaces will be useless
@ -245,6 +246,25 @@ in
          } ]);
        };
      })))
+      (mkMerge (flip mapAttrsToList cfg.greTunnels (name: gre: {
+        netdevs."40-${name}" = {
+          netdevConfig = {
+            Name = name;
+            Kind = gre.type;
+          };
+          tunnelConfig =
+            (optionalAttrs (gre.remote != null) {
+              Remote = gre.remote;
+            }) // (optionalAttrs (gre.local != null) {
+              Local = gre.local;
+            });
+        };
+        networks = mkIf (gre.dev != null) {
+          "40-${gre.dev}" = (mkMerge [ (genericNetwork (mkOverride 999)) {
+            tunnel = [ name ];
+          } ]);
+        };
+      })))
      (mkMerge (flip mapAttrsToList cfg.vlans (name: vlan: {
        netdevs."40-${name}" = {
          netdevConfig = {
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@ -10,6 +10,7 @@ let
  interfaces = attrValues cfg.interfaces;
  hasVirtuals = any (i: i.virtual) interfaces;
  hasSits = cfg.sits != { };
+  hasGres = cfg.greTunnels != { };
  hasBonds = cfg.bonds != { };
  hasFous = cfg.fooOverUDP != { }
    || filterAttrs (_: s: s.encapsulation != null) cfg.sits != { };
@ -997,6 +998,65 @@ in
      });
    };

+    networking.greTunnels = mkOption {
+      default = { };
+      example = literalExpression ''
+        {
+          greBridge = {
+            remote = "10.0.0.1";
+            local = "10.0.0.22";
+            dev = "enp4s0f0";
+            type = "tap";
+          };
+        }
+      '';
+      description = ''
+        This option allows you to define Generic Routing Encapsulation (GRE) tunnels.
+      '';
+      type = with types; attrsOf (submodule {
+        options = {
+
+          remote = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            example = "10.0.0.1";
+            description = ''
+              The address of the remote endpoint to forward traffic over.
+            '';
+          };
+
+          local = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            example = "10.0.0.22";
+            description = ''
+              The address of the local endpoint which the remote
+              side should send packets to.
+            '';
+          };
+
+          dev = mkOption {
+            type = types.nullOr types.str;
+            default = null;
+            example = "enp4s0f0";
+            description = ''
+              The underlying network device on which the tunnel resides.
+            '';
+          };
+
+          type = mkOption {
+            type = with types; enum [ "tun" "tap" ];
+            default = "tap";
+            example = "tap";
+            apply = v: if v == "tun" then "gre" else "gretap";
+            description = ''
+              Whether the tunnel routes layer 2 (tap) or layer 3 (tun) traffic.
+            '';
+          };
+        };
+      });
+    };
+
    networking.vlans = mkOption {
      default = { };
      example = literalExpression ''
@ -1229,6 +1289,7 @@ in
    boot.kernelModules = [ ]
      ++ optional hasVirtuals "tun"
      ++ optional hasSits "sit"
+      ++ optional hasGres "gre"
      ++ optional hasBonds "bonding"
      ++ optional hasFous "fou";

--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -261,6 +261,7 @@ in
  matomo = handleTest ./matomo.nix {};
  matrix-appservice-irc = handleTest ./matrix-appservice-irc.nix {};
  matrix-synapse = handleTest ./matrix-synapse.nix {};
+  mattermost = handleTest ./mattermost.nix {};
  mediawiki = handleTest ./mediawiki.nix {};
  meilisearch = handleTest ./meilisearch.nix {};
  memcached = handleTest ./memcached.nix {};
--- a/nixos/tests/mattermost.nix
+++ b/nixos/tests/mattermost.nix
@ -0,0 +1,124 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+let
+  host = "smoke.test";
+  port = "8065";
+  url = "http://${host}:${port}";
+  siteName = "NixOS Smoke Tests, Inc.";
+
+  makeMattermost = mattermostConfig:
+    { config, ... }: {
+      environment.systemPackages = [
+        pkgs.mattermost
+        pkgs.curl
+        pkgs.jq
+      ];
+      networking.hosts = {
+        "127.0.0.1" = [ host ];
+      };
+      services.mattermost = lib.recursiveUpdate {
+        enable = true;
+        inherit siteName;
+        listenAddress = "0.0.0.0:${port}";
+        siteUrl = url;
+        extraConfig = {
+          SupportSettings.AboutLink = "https://nixos.org";
+        };
+      } mattermostConfig;
+    };
+in
+{
+  name = "mattermost";
+
+  nodes = {
+    mutable = makeMattermost {
+      mutableConfig = true;
+      extraConfig.SupportSettings.HelpLink = "https://search.nixos.org";
+    };
+    mostlyMutable = makeMattermost {
+      mutableConfig = true;
+      preferNixConfig = true;
+      plugins = let
+        mattermostDemoPlugin = pkgs.fetchurl {
+          url = "https://github.com/mattermost/mattermost-plugin-demo/releases/download/v0.9.0/com.mattermost.demo-plugin-0.9.0.tar.gz";
+          sha256 = "1h4qi34gcxcx63z8wiqcf2aaywmvv8lys5g8gvsk13kkqhlmag25";
+        };
+      in [
+        mattermostDemoPlugin
+      ];
+    };
+    immutable = makeMattermost {
+      mutableConfig = false;
+      extraConfig.SupportSettings.HelpLink = "https://search.nixos.org";
+    };
+  };
+
+  testScript = let
+    expectConfig = jqExpression: pkgs.writeShellScript "expect-config" ''
+      set -euo pipefail
+      echo "Expecting config to match: "${lib.escapeShellArg jqExpression} >&2
+      curl ${lib.escapeShellArg url} >/dev/null
+      config="$(curl ${lib.escapeShellArg "${url}/api/v4/config/client?format=old"})"
+      echo "Config: $(echo "$config" | ${pkgs.jq}/bin/jq)" >&2
+      [[ "$(echo "$config" | ${pkgs.jq}/bin/jq -r ${lib.escapeShellArg ".SiteName == $siteName and .Version == ($mattermostName / $sep)[-1] and (${jqExpression})"} --arg siteName ${lib.escapeShellArg siteName} --arg mattermostName ${lib.escapeShellArg pkgs.mattermost.name} --arg sep '-')" = "true" ]]
+    '';
+
+    setConfig = jqExpression: pkgs.writeShellScript "set-config" ''
+      set -euo pipefail
+      mattermostConfig=/var/lib/mattermost/config/config.json
+      newConfig="$(${pkgs.jq}/bin/jq -r ${lib.escapeShellArg jqExpression} $mattermostConfig)"
+      rm -f $mattermostConfig
+      echo "$newConfig" > "$mattermostConfig"
+    '';
+  in
+  ''
+    start_all()
+
+    ## Mutable node tests ##
+    mutable.wait_for_unit("mattermost.service")
+    mutable.wait_for_open_port(8065)
+
+    # Get the initial config
+    mutable.succeed("${expectConfig ''.AboutLink == "https://nixos.org" and .HelpLink == "https://search.nixos.org"''}")
+
+    # Edit the config
+    mutable.succeed("${setConfig ''.SupportSettings.AboutLink = "https://mattermost.com"''}")
+    mutable.succeed("${setConfig ''.SupportSettings.HelpLink = "https://nixos.org/nixos/manual"''}")
+    mutable.systemctl("restart mattermost.service")
+    mutable.wait_for_open_port(8065)
+
+    # AboutLink and HelpLink should be changed
+    mutable.succeed("${expectConfig ''.AboutLink == "https://mattermost.com" and .HelpLink == "https://nixos.org/nixos/manual"''}")
+
+    ## Mostly mutable node tests ##
+    mostlyMutable.wait_for_unit("mattermost.service")
+    mostlyMutable.wait_for_open_port(8065)
+
+    # Get the initial config
+    mostlyMutable.succeed("${expectConfig ''.AboutLink == "https://nixos.org"''}")
+
+    # Edit the config
+    mostlyMutable.succeed("${setConfig ''.SupportSettings.AboutLink = "https://mattermost.com"''}")
+    mostlyMutable.succeed("${setConfig ''.SupportSettings.HelpLink = "https://nixos.org/nixos/manual"''}")
+    mostlyMutable.systemctl("restart mattermost.service")
+    mostlyMutable.wait_for_open_port(8065)
+
+    # AboutLink should be overridden by NixOS configuration; HelpLink should be what we set above
+    mostlyMutable.succeed("${expectConfig ''.AboutLink == "https://nixos.org" and .HelpLink == "https://nixos.org/nixos/manual"''}")
+
+    ## Immutable node tests ##
+    immutable.wait_for_unit("mattermost.service")
+    immutable.wait_for_open_port(8065)
+
+    # Get the initial config
+    immutable.succeed("${expectConfig ''.AboutLink == "https://nixos.org" and .HelpLink == "https://search.nixos.org"''}")
+
+    # Edit the config
+    immutable.succeed("${setConfig ''.SupportSettings.AboutLink = "https://mattermost.com"''}")
+    immutable.succeed("${setConfig ''.SupportSettings.HelpLink = "https://nixos.org/nixos/manual"''}")
+    immutable.systemctl("restart mattermost.service")
+    immutable.wait_for_open_port(8065)
+
+    # Our edits should be ignored on restart
+    immutable.succeed("${expectConfig ''.AboutLink == "https://nixos.org" and .HelpLink == "https://search.nixos.org"''}")
+  '';
+})
--- a/nixos/tests/networking.nix
+++ b/nixos/tests/networking.nix
@ -489,6 +489,77 @@ let
              client2.wait_until_succeeds("ping -c 1 fc00::2")
        '';
    };
+    gre = let
+      node = { pkgs, ... }: with pkgs.lib; {
+        networking = {
+          useNetworkd = networkd;
+          useDHCP = false;
+        };
+      };
+    in {
+      name = "GRE";
+      nodes.client1 = args@{ pkgs, ... }:
+        mkMerge [
+          (node args)
+          {
+            virtualisation.vlans = [ 1 2 ];
+            networking = {
+              greTunnels = {
+                greTunnel = {
+                  local = "192.168.2.1";
+                  remote = "192.168.2.2";
+                  dev = "eth2";
+                  type = "tap";
+                };
+              };
+              bridges.bridge.interfaces = [ "greTunnel" "eth1" ];
+              interfaces.eth1.ipv4.addresses = mkOverride 0 [];
+              interfaces.bridge.ipv4.addresses = mkOverride 0 [
+                { address = "192.168.1.1"; prefixLength = 24; }
+              ];
+            };
+          }
+        ];
+      nodes.client2 = args@{ pkgs, ... }:
+        mkMerge [
+          (node args)
+          {
+            virtualisation.vlans = [ 2 3 ];
+            networking = {
+              greTunnels = {
+                greTunnel = {
+                  local = "192.168.2.2";
+                  remote = "192.168.2.1";
+                  dev = "eth1";
+                  type = "tap";
+                };
+              };
+              bridges.bridge.interfaces = [ "greTunnel" "eth2" ];
+              interfaces.eth2.ipv4.addresses = mkOverride 0 [];
+              interfaces.bridge.ipv4.addresses = mkOverride 0 [
+                { address = "192.168.1.2"; prefixLength = 24; }
+              ];
+            };
+          }
+        ];
+      testScript = { ... }:
+        ''
+          start_all()
+
+          with subtest("Wait for networking to be configured"):
+              client1.wait_for_unit("network.target")
+              client2.wait_for_unit("network.target")
+
+              # Print diagnostic information
+              client1.succeed("ip addr >&2")
+              client2.succeed("ip addr >&2")
+
+          with subtest("Test GRE tunnel bridge over VLAN"):
+              client1.wait_until_succeeds("ping -c 1 192.168.1.2")
+
+              client2.wait_until_succeeds("ping -c 1 192.168.1.1")
+        '';
+    };
    vlan = let
      node = address: { pkgs, ... }: with pkgs.lib; {
        #virtualisation.vlans = [ 1 ];
--- a/pkgs/applications/audio/ft2-clone/default.nix
+++ b/pkgs/applications/audio/ft2-clone/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "ft2-clone";
-  version = "1.48";
+  version = "1.49";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "ft2-clone";
    rev = "v${version}";
-    sha256 = "sha256-ZE9uid/srHHuTRqzgbtHcfmM0VkVsdrK1CJ3Qwbvtao=";
+    sha256 = "sha256-DpEzilMERfbop7YYqNCcxSe1qfcz4n7Uqj/i5t5a6nQ=";
  };

  # Adapt the linux-only CMakeLists to darwin (more reliable than make-macos.sh)
--- a/pkgs/applications/audio/plexamp/default.nix
+++ b/pkgs/applications/audio/plexamp/default.nix
@ -2,12 +2,12 @@

 let
  pname = "plexamp";
-  version = "3.8.2";
+  version = "3.9.0";

  src = fetchurl {
    url = "https://plexamp.plex.tv/plexamp.plex.tv/desktop/Plexamp-${version}.AppImage";
    name="${pname}-${version}.AppImage";
-    sha512 = "JVzfWlrX21KHw4tSrGpCYqqoWFudnyFG4YnHKsnIUtxLDkjyQA8N2/OrDIR+SlK/b0RRs9KZ4lbqQMX8PXUHsg==";
+    sha512 = "2OaV8dONv7yBcQsfecgfedP2ypBN6svD9rgZLgUwSydyH2+rODNPne4O7z2Hahm7Y0Ae+NFxbpQ9lbNbX0vhsg==";
  };

  appimageContents = appimageTools.extractType2 {
@ -33,7 +33,7 @@ in appimageTools.wrapType2 {
  meta = with lib; {
    description = "A beautiful Plex music player for audiophiles, curators, and hipsters";
    homepage = "https://plexamp.com/";
-    changelog = "https://forums.plex.tv/t/plexamp-release-notes/221280/35";
+    changelog = "https://forums.plex.tv/t/plexamp-release-notes/221280/36";
    license = licenses.unfree;
    maintainers = with maintainers; [ killercup synthetica ];
    platforms = [ "x86_64-linux" ];
--- a/pkgs/applications/audio/qtractor/default.nix
+++ b/pkgs/applications/audio/qtractor/default.nix
@ -30,11 +30,11 @@

 mkDerivation rec {
  pname = "qtractor";
-  version = "0.9.23";
+  version = "0.9.24";

  src = fetchurl {
    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-GgDc7WM4nVGlq+8EcwxJ7MnSPYwAej51IMrN0glCTbQ=";
+    sha256 = "sha256-YTT7ko5HjKrZ8DKU3L06EI7bZeBtvPl21pqUf6EaeS4=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/sony-headphones-client/default.nix
+++ b/pkgs/applications/audio/sony-headphones-client/default.nix
@ -0,0 +1,44 @@
+{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, bluez, dbus, glew, glfw, imgui, makeDesktopItem, copyDesktopItems }:
+
+stdenv.mkDerivation rec {
+  pname = "SonyHeadphonesClient";
+  version = "1.2";
+
+  src = fetchFromGitHub {
+    owner = "Plutoberth";
+    repo = "SonyHeadphonesClient";
+    rev = "v${version}";
+    sha256 = "sha256-oejXrs9X+R6Jydro0XIw2XifzFA7asDhpobtaE3//Hc=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ cmake pkg-config copyDesktopItems ];
+  buildInputs = [ bluez dbus glew glfw imgui ];
+
+  sourceRoot = "./source/Client";
+
+  cmakeFlags = [ "-Wno-dev" ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 -t $out/bin SonyHeadphonesClient
+    runHook postInstall
+  '';
+
+  desktopItems = [ (makeDesktopItem {
+    name = "SonyHeadphonesClient";
+    exec = "SonyHeadphonesClient";
+    icon = "SonyHeadphonesClient";
+    desktopName = "Sony Headphones Client";
+    comment     = "A client recreating the functionality of the Sony Headphones app";
+    categories  = "Audio;Mixer;";
+  }) ];
+
+  meta = with lib; {
+    description = "A client recreating the functionality of the Sony Headphones app";
+    homepage    = "https://github.com/Plutoberth/SonyHeadphonesClient";
+    license     = licenses.mit;
+    maintainers = with maintainers; [ stunkymonkey ];
+    platforms   = platforms.linux;
+  };
+}
--- a/pkgs/applications/audio/wavegain/default.nix
+++ b/pkgs/applications/audio/wavegain/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub }:
+{ lib, stdenv, fetchFromGitHub, fetchpatch }:

 stdenv.mkDerivation {
  pname = "wavegain";
@ -11,6 +11,17 @@ stdenv.mkDerivation {
    sha256 = "0wghqnsbypmr4xcrhb568bfjdnxzzp8qgnws3jslzmzf34dpk5ls";
  };

+  patches = [
+    # Upstream fix for -fno-common toolchains.
+    (fetchpatch {
+      name = "fno-common.patch";
+      url = "https://github.com/MestreLion/wavegain/commit/ee5e0f9a0ce34c0cf2769ea6566685a54b938304.patch";
+      sha256 = "11yi0czdn5h5bsqp23cww6yn9lm60cij8i1pzfwcfhgyf6f8ym1n";
+    })
+  ];
+
+  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" ];
+
  installPhase = ''
    strip -s wavegain
    install -vD wavegain "$out/bin/wavegain"
--- a/pkgs/applications/blockchains/go-ethereum/default.nix
+++ b/pkgs/applications/blockchains/go-ethereum/default.nix
@ -18,8 +18,7 @@ in buildGoModule rec {
    sha256 = "sha256-0DQrcei3FM+X4BYokou7dPNVCcJTbY05YsTvzdtsas8=";
  };

-  runVend = true;
-  vendorSha256 = "sha256-i2FOAN1ng3WNOWaFowiSSuYR4LA1Bo3tjkvgcClBXSU=";
+  vendorSha256 = "sha256-zQOpWtQrdn+E1tRWmtEScQ7DDMzNCSr5H+5YL+Z1vug=";

  doCheck = false;

--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -251,12 +251,12 @@ in

  clion = buildClion rec {
    name = "clion-${version}";
-    version = "2021.3.1"; /* updated by script */
+    version = "2021.3.2"; /* updated by script */
    description  = "C/C++ IDE. New. Intelligent. Cross-platform";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
-      sha256 = "0nf1r02i51pplrazlyavc6xs6mi91spa92srfqpsgb78ar9vn027"; /* updated by script */
+      sha256 = "029xim3a6ijqdbzwxan189ydcy5b0ry2qqc70fipp8ic5z5iai3b"; /* updated by script */
    };
    wmClass = "jetbrains-clion";
    update-channel = "CLion RELEASE"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
@ -264,12 +264,12 @@ in

  datagrip = buildDataGrip rec {
    name = "datagrip-${version}";
-    version = "2021.3.2"; /* updated by script */
+    version = "2021.3.3"; /* updated by script */
    description = "Your Swiss Army Knife for Databases and SQL";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/datagrip/${name}.tar.gz";
-      sha256 = "0m0nc988w2a2p0l3a9cirnk2vbrsas4wb3fc4pwiml5bz5vwh255"; /* updated by script */
+      sha256 = "0wbr7hjbj9zvxn4j7nrp7sdzjk78hcg7ssz430y35x9isfiqv5py"; /* updated by script */
    };
    wmClass = "jetbrains-datagrip";
    update-channel = "DataGrip RELEASE";
@ -277,12 +277,12 @@ in

  goland = buildGoland rec {
    name = "goland-${version}";
-    version = "2021.3.1"; /* updated by script */
+    version = "2021.3.2"; /* updated by script */
    description = "Up and Coming Go IDE";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "1kl1sg2fjh8wpx47984vw6zrqf7nakbji606cl52brkxik7py0d3"; /* updated by script */
+      sha256 = "0csc52wwqggdxc61qkmbs84hdvyj3x60rcv5jrxcwp3bjq94kskw"; /* updated by script */
    };
    wmClass = "jetbrains-goland";
    update-channel = "GoLand RELEASE";
@ -290,12 +290,12 @@ in

  idea-community = buildIdea rec {
    name = "idea-community-${version}";
-    version = "2021.3"; /* updated by script */
+    version = "2021.3.1"; /* updated by script */
    description = "Integrated Development Environment (IDE) by Jetbrains, community edition";
    license = lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIC-${version}.tar.gz";
-      sha256 = "0xrhgqbsyd2plzkkmy00bwsa8dk4ijszmhmbyn6c9ygl01zhji6y"; /* updated by script */
+      sha256 = "19xxbjcn17n3fk1vdb31nihn9cv5q65wfxdan6dx7z0wq5c4x9zd"; /* updated by script */
    };
    wmClass = "jetbrains-idea-ce";
    update-channel = "IntelliJ IDEA RELEASE";
@ -303,12 +303,12 @@ in

  idea-ultimate = buildIdea rec {
    name = "idea-ultimate-${version}";
-    version = "2021.3"; /* updated by script */
+    version = "2021.3.1"; /* updated by script */
    description = "Integrated Development Environment (IDE) by Jetbrains, requires paid license";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/idea/ideaIU-${version}-no-jbr.tar.gz";
-      sha256 = "0riwww75aizprb01c1sccprbr00ky5wgy5cxxjxqgm8v72rfnihb"; /* updated by script */
+      sha256 = "0ys8f2h0qaj8s9ga94hg73vah552a6al4r1ypdp05f7j1m7lzajf"; /* updated by script */
    };
    wmClass = "jetbrains-idea";
    update-channel = "IntelliJ IDEA RELEASE";
@ -330,12 +330,12 @@ in

  phpstorm = buildPhpStorm rec {
    name = "phpstorm-${version}";
-    version = "2021.3"; /* updated by script */
+    version = "2021.3.1"; /* updated by script */
    description = "Professional IDE for Web and PHP developers";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webide/PhpStorm-${version}.tar.gz";
-      sha256 = "1h3ld3swvvx8hicm5lpf65mr7asiqy59hvqnigz71hbjgqnsb8g0"; /* updated by script */
+      sha256 = "011i3jgfnb2h64ikbm3wi1vfhzm50mwwy9nksl71nzllj3kz111x"; /* updated by script */
    };
    wmClass = "jetbrains-phpstorm";
    update-channel = "PhpStorm RELEASE";
@ -343,12 +343,12 @@ in

  pycharm-community = buildPycharm rec {
    name = "pycharm-community-${version}";
-    version = "2021.3"; /* updated by script */
+    version = "2021.3.1"; /* updated by script */
    description = "PyCharm Community Edition";
    license = lib.licenses.asl20;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0iypqilil6x9k1gi6bfjzccw7wp601grd9639yk50crg45wnzga4"; /* updated by script */
+      sha256 = "1xd88rd1w3ghkm6jq8ilhhjy972qfm57si581rnsjpz65rj6xpgm"; /* updated by script */
    };
    wmClass = "jetbrains-pycharm-ce";
    update-channel = "PyCharm RELEASE";
@ -356,12 +356,12 @@ in

  pycharm-professional = buildPycharm rec {
    name = "pycharm-professional-${version}";
-    version = "2021.3"; /* updated by script */
+    version = "2021.3.1"; /* updated by script */
    description = "PyCharm Professional Edition";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/python/${name}.tar.gz";
-      sha256 = "0z6dnigx616939azyngjy5r4gayazplkgq480k80ppmkw636yhl1"; /* updated by script */
+      sha256 = "0639mzjh1hw158gmf4qqld03371z60k3xyca21l1pnv3551svd6d"; /* updated by script */
    };
    wmClass = "jetbrains-pycharm";
    update-channel = "PyCharm RELEASE";
@ -382,12 +382,12 @@ in

  ruby-mine = buildRubyMine rec {
    name = "ruby-mine-${version}";
-    version = "2021.3"; /* updated by script */
+    version = "2021.3.1"; /* updated by script */
    description = "The Most Intelligent Ruby and Rails IDE";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/ruby/RubyMine-${version}.tar.gz";
-      sha256 = "1vmybxnwyv7wiv3clm857yvzlws0bcza01wx8jm0dbnrzq38dz4d"; /* updated by script */
+      sha256 = "1xax3738myxjzm0p8zm8aaa2nw0336h80nrm9dqby2j7dass2jnm"; /* updated by script */
    };
    wmClass = "jetbrains-rubymine";
    update-channel = "RubyMine RELEASE";
@ -395,12 +395,12 @@ in

  webstorm = buildWebStorm rec {
    name = "webstorm-${version}";
-    version = "2021.3"; /* updated by script */
+    version = "2021.3.1"; /* updated by script */
    description = "Professional IDE for Web and JavaScript development";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/webstorm/WebStorm-${version}.tar.gz";
-      sha256 = "1llz97r95xrf7yixgbfipg153qikkxziwwhv9dvvi29v7pi1k4ys"; /* updated by script */
+      sha256 = "1f918cj76b79x0d2hhv78mvmki5d1dps8nsx7i50wn2qzdml4kc6"; /* updated by script */
    };
    wmClass = "jetbrains-webstorm";
    update-channel = "WebStorm RELEASE";
--- a/pkgs/applications/graphics/ascii-image-converter/default.nix
+++ b/pkgs/applications/graphics/ascii-image-converter/default.nix
@ -11,8 +11,7 @@ buildGoModule rec {
    sha256 = "DitJnWIz1Dt9yXtyQp/z738IAmG4neYmfc49Wdjos7Q=";
  };

-  runVend = true;
-  vendorSha256 = "JKrBMhzBL1+jlMPudynjOc/ekFiUVaxltyLr4V8QZbg=";
+  vendorSha256 = "sha256-pKgukWKF4f/kLASjh8aKU7x9UBW/H+4C/02vxmh+qOU=";

  meta = with lib; {
    description = "Convert images into ASCII art on the console";
--- a/pkgs/applications/graphics/meshlab/default.nix
+++ b/pkgs/applications/graphics/meshlab/default.nix
@ -14,17 +14,21 @@
 , levmar
 , qhull
 , cmake
+, cgal_5
+, boost17x
+, mpfr
+, xercesc
 }:

 mkDerivation rec {
  pname = "meshlab";
-  version = "2020.12";
+  version = "2021.10";

  src = fetchFromGitHub {
    owner = "cnr-isti-vclab";
    repo = "meshlab";
    rev = "Meshlab-${version}";
-    sha256 = "QrnqXEVqI1ADUYWalZ0h/0+xS+gDZTinm0weT39onw0=";
+    sha256 = "14rrd8qrf91k89y6w2mn1r9zcfnwd0mir6g4dlgvr04i77hj4lk4";
    fetchSubmodules = true; # for vcglib
  };

@ -41,6 +45,10 @@ mkDerivation rec {
    gmp
    levmar
    qhull
+    cgal_5
+    boost17x
+    mpfr
+    xercesc
  ];

  nativeBuildInputs = [ cmake ];
@ -61,6 +69,7 @@ mkDerivation rec {
    # disable when available in nixpkgs
    "-DALLOW_BUNDLED_OPENCTM=ON"
    "-DALLOW_BUNDLED_SSYNTH=ON"
+    "-DALLOW_BUNDLED_BOOST=OFF"
    # some plugins are disabled unless these are on
    "-DALLOW_BUNDLED_NEWUOA=ON"
    "-DALLOW_BUNDLED_LEVMAR=ON"
--- a/pkgs/applications/misc/iptsd/default.nix
+++ b/pkgs/applications/misc/iptsd/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "iptsd";
-  version = "0.4";
+  version = "0.5";

  src = fetchFromGitHub {
    owner = "linux-surface";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-CoPgkt7n2kk7WlQHe0RjNlxfp2Nd8BbIE2gyf0bOBy4=";
+    sha256 = "sha256-A/0hA4gJwzrRPn57IKYvfcAnx1KXbQl0ZX2TE8mcQhc=";
  };

  nativeBuildInputs = [ meson ninja pkg-config ];
--- a/pkgs/applications/misc/librecad/default.nix
+++ b/pkgs/applications/misc/librecad/default.nix
@ -2,7 +2,7 @@
 , boost
 , fetchFromGitHub
 , installShellFiles
-, mkDerivationWith
+, mkDerivation
 , muparser
 , pkg-config
 , qmake
@ -10,10 +10,9 @@
 , qtsvg
 , qttools
 , runtimeShell
-, stdenv
 }:

-mkDerivationWith stdenv.mkDerivation rec {
+mkDerivation rec {
  pname = "librecad";
  version = "2.2.0-rc2";

--- a/pkgs/applications/misc/nwg-menu/default.nix
+++ b/pkgs/applications/misc/nwg-menu/default.nix
@ -14,9 +14,7 @@ buildGoModule rec {
    sha256 = "sha256-M948RGU9/PwUtFRmf1Po7KlrGxqRPiOZKfS1Vv3vqW8=";
  };

-  vendorSha256 = "sha256-AnYtqSe8mq10FQ071GEVh65MaWek5gYlR+9d8yL0RAc=";
-
-  runVend = true;
+  vendorSha256 = "sha256-HyrjquJ91ddkyS8JijHd9HjtfwSQykXCufa2wzl8RNk";

  doCheck = false;

--- a/pkgs/applications/misc/qcad/default.nix
+++ b/pkgs/applications/misc/qcad/default.nix
@ -1,29 +1,30 @@
-{ boost
+{ lib
+, stdenv
+, mkDerivation
 , fetchFromGitHub
-, libGLU
-, mkDerivationWith
-, muparser
+, installShellFiles
 , pkg-config
-, qtbase
 , qmake
+, qttools
+, boost
+, libGLU
+, muparser
+, qtbase
 , qtscript
 , qtsvg
 , qtxmlpatterns
-, qttools
-, lib
-, stdenv
-, installShellFiles
+, qtmacextras
 }:

-mkDerivationWith stdenv.mkDerivation rec {
+mkDerivation rec {
  pname = "qcad";
-  version = "3.26.4.10";
+  version = "3.27.1.0";

  src = fetchFromGitHub {
    owner = "qcad";
    repo = "qcad";
    rev = "v${version}";
-    sha256 = "sha256-dWpItV18lYjdwUsn2wwA//AUHU5ICGfmih2cJWihvn0=";
+    sha256 = "sha256-tydgSfS1MF322sgWULMEZ8P6YIaN1QoeJiia0wbsgjo=";
  };

  patches = [
@ -40,26 +41,56 @@ mkDerivationWith stdenv.mkDerivation rec {
    fi
  '';

+  nativeBuildInputs = [
+    installShellFiles
+    pkg-config
+    qmake
+    qttools
+  ];
+
+  buildInputs = [
+    boost
+    libGLU
+    muparser
+    qtbase
+    qtscript
+    qtsvg
+    qtxmlpatterns
+  ] ++ lib.optionals stdenv.isDarwin [
+    qtmacextras
+  ];
+
  qmakeFlags = [
    "MUPARSER_DIR=${muparser}"
    "INSTALLROOT=$(out)"
    "BOOST_DIR=${boost.dev}"
  ];

+  qtWrapperArgs =
+    lib.optionals stdenv.isLinux [ "--prefix LD_LIBRARY_PATH : ${placeholder "out"}/lib" ]
+    ++
+    lib.optionals stdenv.isDarwin [ "--prefix DYLD_LIBRARY_PATH : ${placeholder "out"}/lib" ];
+
  installPhase = ''
    runHook preInstall

-    install -Dm555 -t $out/bin release/qcad-bin
-    install -Dm555 -t $out/lib release/libspatialindexnavel.so
-    install -Dm555 -t $out/lib release/libqcadcore.so
-    install -Dm555 -t $out/lib release/libqcadentity.so
-    install -Dm555 -t $out/lib release/libqcadgrid.so
-    install -Dm555 -t $out/lib release/libqcadsnap.so
-    install -Dm555 -t $out/lib release/libqcadoperations.so
-    install -Dm555 -t $out/lib release/libqcadstemmer.so
-    install -Dm555 -t $out/lib release/libqcadspatialindex.so
-    install -Dm555 -t $out/lib release/libqcadgui.so
-    install -Dm555 -t $out/lib release/libqcadecmaapi.so
+  '' + lib.optionalString stdenv.isLinux ''
+    install -Dm555 release/qcad-bin $out/bin/qcad
+  '' + lib.optionalString stdenv.isDarwin ''
+    install -Dm555 release/QCAD.app/Contents/MacOS/QCAD $out/bin/qcad
+    mkdir -p $out/lib
+  '' +
+  ''
+    install -Dm555 -t $out/lib release/libspatialindexnavel${stdenv.hostPlatform.extensions.sharedLibrary}
+    install -Dm555 -t $out/lib release/libqcadcore${stdenv.hostPlatform.extensions.sharedLibrary}
+    install -Dm555 -t $out/lib release/libqcadentity${stdenv.hostPlatform.extensions.sharedLibrary}
+    install -Dm555 -t $out/lib release/libqcadgrid${stdenv.hostPlatform.extensions.sharedLibrary}
+    install -Dm555 -t $out/lib release/libqcadsnap${stdenv.hostPlatform.extensions.sharedLibrary}
+    install -Dm555 -t $out/lib release/libqcadoperations${stdenv.hostPlatform.extensions.sharedLibrary}
+    install -Dm555 -t $out/lib release/libqcadstemmer${stdenv.hostPlatform.extensions.sharedLibrary}
+    install -Dm555 -t $out/lib release/libqcadspatialindex${stdenv.hostPlatform.extensions.sharedLibrary}
+    install -Dm555 -t $out/lib release/libqcadgui${stdenv.hostPlatform.extensions.sharedLibrary}
+    install -Dm555 -t $out/lib release/libqcadecmaapi${stdenv.hostPlatform.extensions.sharedLibrary}

    install -Dm444 -t $out/share/applications qcad.desktop
    install -Dm644 -t $out/share/pixmaps      scripts/qcad_icon.png
@ -89,23 +120,6 @@ mkDerivationWith stdenv.mkDerivation rec {
    runHook postInstall
  '';

-  buildInputs = [
-    boost
-    muparser
-    libGLU
-    qtbase
-    qtscript
-    qtsvg
-    qtxmlpatterns
-  ];
-
-  nativeBuildInputs = [
-    pkg-config
-    qmake
-    qttools
-    installShellFiles
-  ];
-
  meta = with lib; {
    description = "2D CAD package based on Qt";
    homepage = "https://qcad.org";
--- a/pkgs/applications/misc/redshift/default.nix
+++ b/pkgs/applications/misc/redshift/default.nix
@ -64,7 +64,16 @@ let

      preConfigure = "./bootstrap";

-      postFixup = "wrapPythonPrograms";
+      dontWrapGApps = true;
+
+      preFixup = ''
+        makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+      '';
+
+      postFixup = ''
+        wrapPythonPrograms
+        wrapGApp $out/bin/${pname}
+      '';

      # the geoclue agent may inspect these paths and expect them to be
      # valid without having the correct $PATH set
@ -112,24 +121,6 @@ rec {
    };
  };

-  redshift-wlr = mkRedshift {
-    pname = "redshift-wlr";
-    # upstream rebases so this is the push date
-    version = "2019-08-24";
-
-    src = fetchFromGitHub {
-      owner = "minus7";
-      repo = "redshift";
-      rev = "7da875d34854a6a34612d5ce4bd8718c32bec804";
-      sha256 = "0rs9bxxrw4wscf4a8yl776a8g880m5gcm75q06yx2cn3lw2b7v22";
-    };
-
-    meta = redshift.meta // {
-      description = redshift.meta.description + "(with wlroots patches)";
-      homepage = "https://github.com/minus7/redshift";
-    };
-  };
-
  gammastep = mkRedshift rec {
    pname = "gammastep";
    version = "2.0.7";
--- a/pkgs/applications/misc/tsukae/default.nix
+++ b/pkgs/applications/misc/tsukae/default.nix
@ -11,9 +11,7 @@ buildGoModule rec {
    sha256 = "sha256-1y/WYLW6/HMGmuaX2wOlQbwYn0LcgQCMb4qw8BtCgxQ=";
  };

-  vendorSha256 = "sha256-mVhc9roT7rm9WMwck7jobjn9ykKQRgWJAqM75AmhMN0=";
-
-  runVend = true;
+  vendorSha256 = "sha256-Q0WOzyJGnTXTmj7ZPKyVSnWuWb4bbDjDpgftQ1Opf/I=";

  meta = with lib; {
    description = "Show off your most used shell commands.";
--- a/pkgs/applications/networking/browsers/vivaldi/default.nix
+++ b/pkgs/applications/networking/browsers/vivaldi/default.nix
@ -11,6 +11,7 @@
 , isSnapshot ? false
 , proprietaryCodecs ? false, vivaldi-ffmpeg-codecs ? null
 , enableWidevine ? false, vivaldi-widevine ? null
+, commandLineArgs ? ""
 }:

 let
@ -85,6 +86,7 @@ in stdenv.mkDerivation rec {
        "$out"/share/icons/hicolor/''${d}x''${d}/apps/vivaldi.png
    done
    wrapProgram "$out/bin/vivaldi" \
+      --add-flags ${lib.escapeShellArg commandLineArgs} \
      --suffix XDG_DATA_DIRS : ${gtk3}/share/gsettings-schemas/${gtk3.name}/ \
      ${lib.optionalString enableWidevine "--suffix LD_LIBRARY_PATH : ${libPath}"}
  '' + lib.optionalString enableWidevine ''
--- a/pkgs/applications/networking/cluster/kubergrunt/default.nix
+++ b/pkgs/applications/networking/cluster/kubergrunt/default.nix
@ -11,14 +11,12 @@ buildGoModule rec {
    sha256 = "1224ssqdz9ak0vylyfbr9c2w0yfdp4hw9jh99qmfi2j5nhw9kzcc";
  };

-  vendorSha256 = "1hbb3hn8mzz9h9p1rl35izz3l6c2rqsg8aq6dgpbpsf5krp3zs3v";
+  vendorSha256 = "sha256-95rteSEMOBQnAw0QKuj5Yyi8n3xXGl0Tm97WiyTGxVw=";

  # Disable tests since it requires network access and relies on the
  # presence of certain AWS infrastructure
  doCheck = false;

-  runVend = true;
-
  postInstall = ''
    # The binary is named kubergrunt
    mv $out/bin/cmd $out/bin/kubergrunt
--- a/pkgs/applications/networking/cluster/levant/default.nix
+++ b/pkgs/applications/networking/cluster/levant/default.nix
@ -11,9 +11,7 @@ buildGoModule rec {
    sha256 = "9M7a4i+DPKb1H9jOEVAvhvYxGwtj3dK/40n4GSy4Rqo=";
  };

-  vendorSha256 = "5JlrgmIfhX0rPR72sUkFcofw/iIbIaca359GN9C9dhU=";
-
-  runVend = true;
+  vendorSha256 = "sha256-m3WSk5RvCmeIgX6SwHpWHvokgs71cY6XCKtHJ4jnonc=";

  # The tests try to connect to a Nomad cluster.
  doCheck = false;
--- a/pkgs/applications/networking/cluster/linkerd/default.nix
+++ b/pkgs/applications/networking/cluster/linkerd/default.nix
@ -4,5 +4,5 @@
  channel = "stable";
  version = "2.11.1";
  sha256 = "09zwxcaqn537ls737js7rcsqarapw5k25gv41d844k73yvxm882c";
-  vendorSha256 = "sha256-c3EyVrblqtFuoP7+YdbyPN0DdN6TcQ5DTtFQ/frKM0Q=";
+  vendorSha256 = "sha256-RayboJdjkmCiUsUBab9ntIH+koOCgp3gmVqXZEUWK88=";
 }
--- a/pkgs/applications/networking/cluster/linkerd/edge.nix
+++ b/pkgs/applications/networking/cluster/linkerd/edge.nix
@ -4,5 +4,5 @@
  channel = "edge";
  version = "21.10.3";
  sha256 = "09k4c0dgn9vvgp6xb20x0vylk6bbd03srk3sra8vnpywwi591mcv";
-  vendorSha256 = "sha256-uGj1sMEa791ZKA7hpJ1A9vtwsmrZDGAYp6HQo6QNAYY=";
+  vendorSha256 = "sha256-J/+YFXHC6UTyhln2ZDEq/EyqMEP9XcNC4GRuJjGEY3g=";
 }
--- a/pkgs/applications/networking/cluster/linkerd/generic.nix
+++ b/pkgs/applications/networking/cluster/linkerd/generic.nix
@ -14,7 +14,6 @@ buildGoModule rec {
  };

  subPackages = [ "cli" ];
-  runVend = true;

  preBuild = ''
    env GOFLAGS="" go generate ./pkg/charts/static
--- a/pkgs/applications/networking/cluster/terraform-providers/teleport/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/teleport/default.nix
@ -1,17 +1,19 @@
-{ lib, fetchFromGitHub, buildGoModule }:
+{ lib, fetchFromGitHub, buildGoModule, teleport }:

 buildGoModule rec {
  pname = "terraform-provider-teleport";
-  version = "7.3.0";
+  version = "8.0.6";

  src = fetchFromGitHub {
    owner = "gravitational";
    repo = "teleport-plugins";
    rev = "v${version}";
-    sha256 = "19zn78nn64gc0nm7ycblzi4549a0asql07pfxvrphi6s9fjr5m3y";
+    sha256 = "1rhvpbw4dga256dp2cr5f912d2j7rh8pd1v88dlgq3mmw8n5c7vy";
  };
  vendorSha256 = null;

+  checkInputs = [ teleport ];
+
  sourceRoot = "source/terraform";

  # Terraform allow checking the provider versions, but this breaks
@ -23,7 +25,7 @@ buildGoModule rec {
  passthru.provider-source-address = "gravitational.com/teleport/teleport";

  meta = with lib; {
-    description = "Provider for managing resources in Teleport, a SSH CA management suite";
+    description = "Provider for managing resources in Teleport access plane";
    homepage = "https://github.com/gravitational/teleport-plugins";
    license = licenses.asl20;
    maintainers = with maintainers; [ justinas ];
--- a/pkgs/applications/networking/cluster/tfswitch/default.nix
+++ b/pkgs/applications/networking/cluster/tfswitch/default.nix
@ -10,14 +10,12 @@ buildGoModule rec {
    sha256 = "sha256-gJa8oVdgerDi0GdTSNus5rHLsFuzg8ZqVeKTMuPXu0o=";
  };

-  vendorSha256 = "sha256-tp2Bv/vcHCuB/HCZLfL/zOm/UfPt6XXGE7johrjL3cs=";
+  vendorSha256 = "sha256-z3UDrwlMHFFH56U3oylSWE3wqWOCA4RI2smafHHwYkQ=";

  # Disable tests since it requires network access and relies on the
  # presence of release.hashicorp.com
  doCheck = false;

-  runVend = true;
-
  postInstall = ''
    # The binary is named tfswitch
    mv $out/bin/terraform-switcher $out/bin/tfswitch
--- a/pkgs/applications/networking/cluster/werf/default.nix
+++ b/pkgs/applications/networking/cluster/werf/default.nix
@ -0,0 +1,53 @@
+{ lib
+, stdenv
+, buildGoModule
+, fetchFromGitHub
+, pkg-config
+, gpgme
+, glibc
+, lvm2
+, btrfs-progs
+}:
+
+buildGoModule rec {
+  pname = "werf";
+  version = "1.2.55";
+
+  src = fetchFromGitHub {
+    owner = "werf";
+    repo = "werf";
+    rev = "v${version}";
+    sha256 = "sha256-yLrCE0C8+LIXnBm4xG4q0vXtjTyau6mjkZ+/o/lbGhI=";
+  };
+  vendorSha256 = "sha256-xALB4QCIVpN0s1rR/fvHZFlFDf2trtG8yJKJLBRH4pw=";
+  proxyVendor = true;
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ gpgme ]
+    ++ lib.optionals stdenv.isLinux [ glibc.static lvm2 btrfs-progs ];
+
+  # Flags are derived from
+  # https://github.com/werf/werf/blob/main/scripts/build_release_v3.sh
+  ldflags = [ "-s" "-w" "-X github.com/werf/werf/pkg/werf.Version=v${version}" ]
+    ++ lib.optionals stdenv.isLinux [
+    "-linkmode external"
+    "-extldflags=-static"
+  ];
+  tags = [ "dfrunmount" "dfssh" "containers_image_openpgp" ]
+    ++ lib.optionals stdenv.isLinux [
+    "exclude_graphdriver_devicemapper"
+    "netgo"
+    "no_devmapper"
+    "osusergo"
+    "static_build"
+  ];
+
+  subPackages = [ "cmd/werf" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/werf/werf";
+    description = "GitOps delivery tool";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ azahi ];
+  };
+}
--- a/pkgs/applications/networking/ftp/filezilla/default.nix
+++ b/pkgs/applications/networking/ftp/filezilla/default.nix
@ -18,11 +18,11 @@

 stdenv.mkDerivation rec {
  pname = "filezilla";
-  version = "3.55.1";
+  version = "3.57.0";

  src = fetchurl {
    url = "https://download.filezilla-project.org/client/FileZilla_${version}_src.tar.bz2";
-    sha256 = "sha256-Z/jQ4R9T/SMgfTy/yULQPz4j7kOe5IoUohQ8mVD3dqU=";
+    sha256 = "sha256-gr9scHfKEwElSTVrRjlS8STuBIdvIeS6cgrMmBHImcc=";
  };

  # https://www.linuxquestions.org/questions/slackware-14/trouble-building-filezilla-3-47-2-1-current-4175671182/#post6099769
--- a/pkgs/applications/networking/instant-messengers/alfaview/default.nix
+++ b/pkgs/applications/networking/instant-messengers/alfaview/default.nix
@ -5,11 +5,11 @@

 stdenv.mkDerivation rec {
  pname = "alfaview";
-  version = "8.33.0";
+  version = "8.34.0";

  src = fetchurl {
    url = "https://production-alfaview-assets.alfaview.com/stable/linux/${pname}_${version}.deb";
-    sha256 = "sha256-L6vdPdWwNnN09hwzzw9woPRhGIsBKh7iY0cbI2oJX4Q=";
+    sha256 = "sha256-85bsu6l/B+lHkjFBXNQ9BEzOn1oYTsFgungG06p9nD0=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix
@ -4,11 +4,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "rocketchat-desktop";
-  version = "3.7.2";
+  version = "3.7.4";

  src = fetchurl {
    url = "https://github.com/RocketChat/Rocket.Chat.Electron/releases/download/${version}/rocketchat_${version}_amd64.deb";
-    sha256 = "sha256-sSSi8L5WXFAc9yRDZ2usWmh6F06/1RMbJInQ4/OORnI=";
+    sha256 = "sha256-yYUMVMSGUMAXbBm40jNCaFusWsWxoIgLDeAwNqSewX8=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@ -183,6 +183,6 @@ mkDerivation rec {
    platforms = platforms.linux;
    homepage = "https://desktop.telegram.org/";
    changelog = "https://github.com/telegramdesktop/tdesktop/releases/tag/v${version}";
-    maintainers = with maintainers; [ oxalica primeos vanilla ];
+    maintainers = with maintainers; [ oxalica vanilla ];
  };
 }
--- a/pkgs/applications/networking/nali/default.nix
+++ b/pkgs/applications/networking/nali/default.nix
@ -11,9 +11,8 @@ buildGoModule rec {
    sha256 = "sha256-iRLoUBA+Kzv1/LZQ8HCvR79K1riYErxEWhB0OmvFy2g=";
  };

-  vendorSha256 = "sha256-Kb2T+zDUuH+Rx8amYsTIhR5L3DIx5nGcDGqxHOn90NU=";
+  vendorSha256 = "sha256-0u6n53hL2+GvqbYpAKN54n7uiTHSsgyjedt20nT1yRc=";
  subPackages = [ "." ];
-  runVend = true;

  meta = with lib; {
    description = "An offline tool for querying IP geographic information and CDN provider";
--- a/pkgs/applications/networking/soju/default.nix
+++ b/pkgs/applications/networking/soju/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "soju";
-  version = "0.2.2";
+  version = "0.3.0";

  src = fetchFromSourcehut {
    owner = "~emersion";
    repo = "soju";
    rev = "v${version}";
-    sha256 = "sha256-ssq4fED7YIJkSHhxybBIqOr5qVEHGordBxuJOmilSOY=";
+    sha256 = "sha256-j7LwWBBJvNUeg0+P632HaGliVtrrCD0VNxkynaZzidQ=";
  };

-  vendorSha256 = "sha256-60b0jhyXQg9RG0mkvUOmJOEGv96FZq/Iwv1S9c6C35c=";
+  vendorSha256 = "sha256-fDfH2pQ5MtZDjiGx26vS5dBzxejVXPfflLX8N8VcJTA=";

  subPackages = [
    "cmd/soju"
--- a/pkgs/applications/networking/sync/onedrive/default.nix
+++ b/pkgs/applications/networking/sync/onedrive/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "onedrive";
-  version = "2.4.13";
+  version = "2.4.14";

  src = fetchFromGitHub {
    owner = "abraunegg";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-v1GSHwcP9EQaADIEKO14yotJBEEatbKugVJOCsTLr2w=";
+    sha256 = "sha256-zh9CSvuwZj9B8XPvV23xS0MqnsR+vhfdD8V+k6CjCxQ=";
  };

  nativeBuildInputs = [ autoreconfHook ldc installShellFiles pkg-config ];
--- a/pkgs/applications/office/kalendar/default.nix
+++ b/pkgs/applications/office/kalendar/default.nix
@ -30,6 +30,7 @@
 , calendarsupport

 , akonadi
+, akonadi-search
 , akonadi-contacts
 , akonadi-calendar-tools
 , kdepim-runtime
@ -78,11 +79,17 @@ mkDerivation rec {
    eventviews
    calendarsupport

+    akonadi-search
    akonadi-contacts
    akonadi-calendar-tools
+    kdepim-runtime
  ];

-  propagatedUserEnvPkgs = [ akonadi kdepim-runtime ];
+  propagatedUserEnvPkgs = [ akonadi kdepim-runtime akonadi-search ];
+  postFixup = ''
+    wrapProgram "$out/bin/kalendar" \
+      --prefix PATH : "${lib.makeBinPath [ akonadi kdepim-runtime akonadi-search ]}"
+  '';

  meta = with lib; {
    description = "A calendar application using Akonadi to sync with external services (Nextcloud, GMail, ...)";
--- a/pkgs/applications/office/qownnotes/default.nix
+++ b/pkgs/applications/office/qownnotes/default.nix
@ -5,13 +5,13 @@

 mkDerivation rec {
  pname = "qownnotes";
-  version = "21.12.4";
+  version = "21.12.8";

  src = fetchurl {
    url = "https://download.tuxfamily.org/${pname}/src/${pname}-${version}.tar.xz";
    # Fetch the checksum of current version with curl:
    # curl https://download.tuxfamily.org/qownnotes/src/qownnotes-<version>.tar.xz.sha256
-    sha256 = "sha256-vvqcXu2P39VYbx45lavyJ2HIxPCJbzSpJo4gYd88Ub4=";
+    sha256 = "sha256-iVcGJz4lxyn303ACYBUVm9cOYjVrETpyUapjAieMpqE=";
  };

  nativeBuildInputs = [ qmake qttools ];
--- a/pkgs/applications/science/logic/isabelle/default.nix
+++ b/pkgs/applications/science/logic/isabelle/default.nix
@ -1,24 +1,24 @@
-{ lib, stdenv, fetchurl, perl, perlPackages, makeWrapper, nettools, java, polyml, z3, rlwrap, makeDesktopItem }:
+{ lib, stdenv, fetchurl, perl, perlPackages, makeWrapper, nettools, java, polyml, z3, veriT, rlwrap, makeDesktopItem }:
 # nettools needed for hostname

 stdenv.mkDerivation rec {
  pname = "isabelle";
-  version = "2021";
+  version = "2021-1";

  dirname = "Isabelle${version}";

  src = if stdenv.isDarwin
    then fetchurl {
      url = "https://isabelle.in.tum.de/website-${dirname}/dist/${dirname}_macos.tar.gz";
-      sha256 = "1c2qm2ksmpyxyccyyn4lyj2wqj5m74nz2i0c5abrd1hj45zcnh1m";
+      sha256 = "0n1ls9vwf0ps1x8zpb7c1xz1wkasgvc34h5bz280hy2z6iqwmwbc";
    }
    else fetchurl {
      url = "https://isabelle.in.tum.de/website-${dirname}/dist/${dirname}_linux.tar.gz";
-      sha256 = "1isgc9w4q95638dcag9gxz1kmf97pkin3jz1dm2lhd64b2k12y2x";
+      sha256 = "0jfaqckhg388jh9b4msrpkv6wrd6xzlw18m0bngbby8k8ywalp9i";
    };

  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ perl polyml z3 ]
+  buildInputs = [ perl polyml z3 veriT ]
             ++ lib.optionals (!stdenv.isDarwin) [ nettools java ];

  sourceRoot = dirname;
@ -33,6 +33,10 @@ stdenv.mkDerivation rec {
      Z3_INSTALLED=yes
    EOF

+    cat >contrib/verit-*/etc/settings <<EOF
+      ISABELLE_VERIT=${veriT}/bin/veriT
+    EOF
+
    cat >contrib/polyml-*/etc/settings <<EOF
      ML_SYSTEM_64=true
      ML_SYSTEM=${polyml.name}
@ -52,7 +56,7 @@ stdenv.mkDerivation rec {

    echo ISABELLE_LINE_EDITOR=${rlwrap}/bin/rlwrap >>etc/settings

-    for comp in contrib/jdk* contrib/polyml-* contrib/z3-*; do
+    for comp in contrib/jdk* contrib/polyml-* contrib/z3-* contrib/verit-*; do
      rm -rf $comp/x86*
    done
    '' + (if ! stdenv.isLinux then "" else ''
@ -75,8 +79,6 @@ stdenv.mkDerivation rec {
    # desktop item
    mkdir -p "$out/share"
    cp -r "${desktopItem}/share/applications" "$out/share/applications"
-
-    wrapProgram $out/$dirname/src/HOL/Tools/ATP/scripts/remote_atp --set PERL5LIB ${perlPackages.makeFullPerlPath [ perlPackages.LWP ]}
  '';

  desktopItem = makeDesktopItem {
--- a/pkgs/applications/science/logic/verit/default.nix
+++ b/pkgs/applications/science/logic/verit/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation {
  pname = "veriT";
-  version = "2016";
+  version = "2021.06.2";

  src = fetchurl {
-    url = "http://www.verit-solver.org/distrib/veriT-stable2016.tar.gz";
-    sha256 = "0gvp4diz0qjg0y5ry0p1z7dkdkxw8l7jb8cdhvcnhl06jx977v4b";
+    url = "https://verit.loria.fr/download/2021.06.2/verit-2021.06.2-rmx.tar.gz";
+    sha256 = "1yjvvxnsix0rhilc81ycx1s85dymq366c6zh1hwwd8qxp7k1zca2";
  };

  nativeBuildInputs = [ autoreconfHook flex bison ];
@ -23,7 +23,7 @@ stdenv.mkDerivation {

  meta = with lib; {
    description = "An open, trustable and efficient SMT-solver";
-    homepage = "http://www.verit-solver.org/";
+    homepage = "https://verit.loria.fr/";
    license = licenses.bsd3;
    platforms = platforms.unix;
    maintainers = [ maintainers.gebner ];
--- a/pkgs/applications/science/machine-learning/finalfusion-utils/default.nix
+++ b/pkgs/applications/science/machine-learning/finalfusion-utils/default.nix
@ -6,21 +6,22 @@
 , blas
 , gfortran
 , lapack
+, openssl
 , Security
 }:

 rustPlatform.buildRustPackage rec {
  pname = "finalfusion-utils";
-  version = "0.13.0";
+  version = "0.13.2";

  src = fetchFromGitHub {
    owner = "finalfusion";
    repo = pname;
    rev = version;
-    sha256 = "sha256-ME0qDSFD8G492+7ex7VQWh9P76a+tOCo+SJ9n9ZIYUI=";
+    sha256 = "sha256-Wv3K2G542e1bKuJB+dZi0SW4dbopvs7SBohv+zgi5MI=";
  };

-  cargoSha256 = "sha256-/rLv2/bcVsmWw+ZfyumDcj0ptHPQBCCYR9O/lVlV+G0=";
+  cargoSha256 = "sha256-oI7bq/yEXP7aMLWGKAecyq1lqq7ZbHtwxX2ldZMFY8I=";

  nativeBuildInputs = [ installShellFiles ];

@ -28,6 +29,7 @@ rustPlatform.buildRustPackage rec {
    blas
    gfortran.cc.lib
    lapack
+    openssl
  ] ++ lib.optionals stdenv.isDarwin [
    Security
  ];
--- a/pkgs/applications/science/robotics/inav-configurator/default.nix
+++ b/pkgs/applications/science/robotics/inav-configurator/default.nix
@ -0,0 +1,57 @@
+{ lib, stdenv, fetchurl, makeDesktopItem, copyDesktopItems, nwjs, wrapGAppsHook, gsettings-desktop-schemas, gtk3 }:
+
+stdenv.mkDerivation rec {
+  pname = "inav-configurator";
+  version = "3.0.2";
+
+  src = fetchurl {
+    url = "https://github.com/iNavFlight/inav-configurator/releases/download/${version}/INAV-Configurator_linux64_${version}.tar.gz";
+    sha256 = "0v6dcg634wpp9q4ya3mj00j3pg25g62aq209iq2dsvj0a03afbp2";
+  };
+
+  icon = fetchurl {
+    url = "https://raw.githubusercontent.com/iNavFlight/inav-configurator/bf3fc89e6df51ecb83a386cd000eebf16859879e/images/inav_icon_128.png";
+    sha256 = "1i844dzzc5s5cr4vfpi6k2kdn8jiqq2n6c0fjqvsp4wdidwjahzw";
+  };
+
+  nativeBuildInputs = [ copyDesktopItems wrapGAppsHook ];
+
+  buildInputs = [ gsettings-desktop-schemas gtk3 ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin \
+             $out/opt/${pname}
+
+    cp -r inav-configurator $out/opt/inav-configurator/
+    install -m 444 -D $icon $out/share/icons/hicolor/128x128/apps/${pname}.png
+
+    chmod +x $out/opt/inav-configurator/inav-configurator
+    makeWrapper ${nwjs}/bin/nw $out/bin/${pname} --add-flags $out/opt/inav-configurator/inav-configurator
+
+    runHook postInstall
+  '';
+
+  desktopItems = makeDesktopItem {
+    name = pname;
+    exec = pname;
+    icon = pname;
+    comment = "iNavFlight configuration tool";
+    desktopName = "iNav Configurator";
+    genericName = "Flight controller configuration tool";
+  };
+
+  meta = with lib; {
+    description = "The iNav flight control system configuration tool";
+    longDescription = ''
+      A crossplatform configuration tool for the iNav flight control system.
+      Various types of aircraft are supported by the tool and by iNav, e.g.
+      quadcopters, hexacopters, octocopters and fixed-wing aircraft.
+    '';
+    homepage = "https://github.com/iNavFlight/inav/wiki";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ tilcreator wucke13 ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/version-management/git-and-tools/glab/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/glab/default.nix
@ -11,8 +11,7 @@ buildGoModule rec {
    sha256 = "sha256-naCCJ9s63UPDxRWbVjVikXtGUlM4Lp7vyDHlESEtXeI=";
  };

-  vendorSha256 = "sha256-iiHDxiP6Dg7MK5jhSwly5oEhFZ8ByCx5WEyrbzL/u4w=";
-  runVend = true;
+  vendorSha256 = "sha256-rciT4UcsLu/vI0PqdTlMjbYXVumzo3ASsopkgiHGM60=";

  ldflags = [
    "-X main.version=${version}"
--- a/pkgs/applications/version-management/reposurgeon/default.nix
+++ b/pkgs/applications/version-management/reposurgeon/default.nix
@ -11,12 +11,10 @@ buildGoModule rec {
    sha256 = "sha256-FuL5pvIM468hEm6rUBKGW6+WlYv4DPHNnpwpRGzMwlY=";
  };

-  vendorSha256 = "sha256-KpdXI2Znhe0iCp0DjSZXzUYDZIz2KBRv1/SpaRTFMAc=";
+  vendorSha256 = "sha256-QpgRCnsOOZujE405dCe+PYg/zNkqnrfZFfbBFo7adjY=";

  subPackages = [ "." ];

-  runVend = true;
-
  nativeBuildInputs = [ asciidoctor ruby ];

  postBuild = ''
--- a/pkgs/applications/video/vdr/default.nix
+++ b/pkgs/applications/video/vdr/default.nix
@ -5,12 +5,12 @@
 }: stdenv.mkDerivation rec {

  pname = "vdr";
-  version = "2.5.6";
+  version = "2.6.0";

  src = fetchgit {
    url = "git://git.tvdr.de/vdr.git";
    rev = version;
-    sha256 = "sha256-hgP8EIGwEPj30fijZzcujnvutG+acU4qqqvgY6FB/z4=";
+    sha256 = "sha256-TZm9pN9xtqkKhETsUhIIalK+4xQpFV3TXyWychSoyRk=";
  };

  enableParallelBuilding = true;
--- a/pkgs/applications/virtualization/looking-glass-client/default.nix
+++ b/pkgs/applications/virtualization/looking-glass-client/default.nix
@ -1,8 +1,7 @@
-
-{ stdenv, lib, fetchFromGitHub, fetchpatch, makeDesktopItem, cmake, pkg-config
-, SDL, SDL2_ttf, freefont_ttf, spice-protocol, nettle, libbfd, fontconfig
-, libXi, libXScrnSaver, libXinerama
-, wayland, wayland-protocols
+{ stdenv, lib, fetchFromGitHub, makeDesktopItem, cmake, pkg-config
+, freefont_ttf, spice-protocol, nettle, libbfd, fontconfig, libffi, expat
+, libxkbcommon, libGL, libXext, libXrandr, libXi, libXScrnSaver, libXinerama
+, libXcursor, libXpresent, wayland, wayland-protocols
 }:

 let
@ -17,29 +16,43 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "looking-glass-client";
-  version = "B4";
+  version = "B5.0.1";

  src = fetchFromGitHub {
    owner = "gnif";
    repo = "LookingGlass";
    rev = version;
-    sha256 = "0fwmz0l1dcfwklgvxmv0galgj2q3nss90kc3jwgf6n80x27rsnhf";
+    sha256 = "sha256-UzZQU5SzJ2mo9QBweQB0VJSnKfzgTG5QaKpIQN/6LCE=";
    fetchSubmodules = true;
  };

  nativeBuildInputs = [ cmake pkg-config ];

  buildInputs = [
-    SDL SDL2_ttf freefont_ttf spice-protocol
-    libbfd nettle fontconfig
-    libXi libXScrnSaver libXinerama
-    wayland wayland-protocols
+    libGL
+    freefont_ttf
+    spice-protocol
+    expat
+    libbfd
+    nettle
+    fontconfig
+    libffi
+    libxkbcommon
+    libXi
+    libXScrnSaver
+    libXinerama
+    libXcursor
+    libXpresent
+    libXext
+    libXrandr
+    wayland
+    wayland-protocols
  ];

  NIX_CFLAGS_COMPILE = "-mavx"; # Fix some sort of AVX compiler problem.

  postUnpack = ''
-    echo $version > source/VERSION
+    echo ${src.rev} > source/VERSION
    export sourceRoot="source/client"
  '';

--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, fetchpatch, python, zlib, pkg-config, glib
+{ lib, stdenv, fetchurl, fetchpatch, python3, python3Packages, zlib, pkg-config, glib, buildPackages
 , perl, pixman, vde2, alsa-lib, texinfo, flex
 , bison, lzo, snappy, libaio, libtasn1, gnutls, nettle, curl, ninja, meson, sigtool
 , makeWrapper, runtimeShell
@ -51,7 +51,9 @@ stdenv.mkDerivation rec {
    sha256 = "15iw7982g6vc4jy1l9kk1z9sl5bm1bdbwr74y7nvwjs1nffhig7f";
  };

-  nativeBuildInputs = [ makeWrapper python python.pkgs.sphinx python.pkgs.sphinx_rtd_theme pkg-config flex bison meson ninja ]
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  nativeBuildInputs = [ makeWrapper pkg-config flex bison meson ninja perl python3 python3Packages.sphinx python3Packages.sphinx_rtd_theme ]
    ++ lib.optionals gtkSupport [ wrapGAppsHook ]
    ++ lib.optionals stdenv.isDarwin [ sigtool ];

@ -190,6 +192,8 @@ stdenv.mkDerivation rec {
    # Always use our Meson, not the bundled version, which doesn't
    # have our patches and will be subtly broken because of that.
    "--meson=meson"
+    "--cross-prefix=${stdenv.cc.targetPrefix}"
+    "--cpu=${stdenv.hostPlatform.uname.processor}"
  ] ++ lib.optional numaSupport "--enable-numa"
    ++ lib.optional seccompSupport "--enable-seccomp"
    ++ lib.optional smartcardSupport "--enable-smartcard"
--- a/pkgs/applications/virtualization/spike/default.nix
+++ b/pkgs/applications/virtualization/spike/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchgit, dtc, fetchpatch }:
+{ lib, stdenv, fetchgit, dtc, fetchpatch, pkgsCross }:

 stdenv.mkDerivation rec {
  pname = "spike";
@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
  doInstallCheck = true;
  installCheckPhase =
    let
-      riscvPkgs = import ../../../.. { crossSystem = lib.systems.examples.riscv64-embedded; };
+      riscvPkgs = pkgsCross.riscv64-embedded;
    in
    ''
      runHook preInstallCheck
--- a/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@ -3,14 +3,14 @@
 let
  generator = pkgsBuildBuild.buildGoModule rec {
    pname = "v2ray-domain-list-community";
-    version = "20211119143108";
+    version = "20211228022859";
    src = fetchFromGitHub {
      owner = "v2fly";
      repo = "domain-list-community";
      rev = version;
-      sha256 = "sha256-CJMINkutaUI/Eka0OJTjeG3weTMYaNKdB2BWOxFgI3s=";
+      sha256 = "sha256-wDz4msCaX6BPzxrg5GeZSrMuxsCx8uimhaHghWdDp8s=";
    };
-    vendorSha256 = "sha256-JuLU9v1ukVfAEtz07tGk66st1+sO4SBz83BlK3IPQwU=";
+    vendorSha256 = "sha256-p0EPYOw3vuqHiVSrZR7SA7vE0DWA7xyupWM+JznjF+o=";
    meta = with lib; {
      description = "community managed domain list";
      homepage = "https://github.com/v2fly/domain-list-community";
--- a/pkgs/data/themes/dracula-theme/default.nix
+++ b/pkgs/data/themes/dracula-theme/default.nix
@ -2,7 +2,7 @@

 let
  themeName = "Dracula";
-  version = "2.0";
+  version = "3.0";
 in
 stdenv.mkDerivation {
  pname = "dracula-theme";
@ -12,7 +12,7 @@ stdenv.mkDerivation {
    owner = "dracula";
    repo = "gtk";
    rev = "v${version}";
-    sha256 = "10j706gnhdplhykdisp64vzzxpzgn48b5f1fkndcp340x7hf2mf3";
+    sha256 = "sha256-7DUT/DfvCSo9GiJzqhqvegNCARB0eGtPQ6oUQG/Uja0=";
  };

  propagatedUserEnvPkgs = [
@ -30,6 +30,11 @@ stdenv.mkDerivation {
    cp -a kde/aurorae/* $out/share/aurorae/themes/
    mkdir -p $out/share/sddm/themes
    cp -a kde/sddm/* $out/share/sddm/themes/
+
+    mkdir -p $out/share/icons/Dracula-cursors
+    mv kde/cursors/Dracula-cursors/index.theme $out/share/icons/Dracula-cursors/cursor.theme
+    mv kde/cursors/Dracula-cursors/cursors $out/share/icons/Dracula-cursors/cursors
+
    runHook postInstall
  '';

--- a/pkgs/desktops/gnome/extensions/collisions.json
+++ b/pkgs/desktops/gnome/extensions/collisions.json
@ -101,6 +101,10 @@
      "workspace-indicator@gnome-shell-extensions.gcampax.github.com",
      "horizontal-workspace-indicator@tty2.io"
    ],
+    "lock-keys": [
+      "lockkeys@vaina.lt",
+      "lockkeys@fawtytoo"
+    ],
    "disable-unredirect-fullscreen-windows": [
      "unredirect@vaina.lt",
      "unredirect@aunetx"
--- a/pkgs/desktops/gnome/extensions/extensionRenames.nix
+++ b/pkgs/desktops/gnome/extensions/extensionRenames.nix
@ -12,6 +12,9 @@
  "floatingDock@sun.wxg@gmail.com" = "floating-dock-2";
  "floating-dock@nandoferreira_prof@hotmail.com" = "floating-dock";

+  "lockkeys@vaina.lt" = "lock-keys";
+  "lockkeys@fawtytoo" = "lock-keys-2";
+
  "workspace-indicator@gnome-shell-extensions.gcampax.github.com" = "workspace-indicator";
  "horizontal-workspace-indicator@tty2.io" = "workspace-indicator-2";

@ -24,9 +27,6 @@

  # ####### GNOME 40 #######

-  "lockkeys@vaina.lt" = "lock-keys";
-  "lockkeys@fawtytoo" = "lock-keys-2";
-
  "system-monitor@paradoxxx.zero.gmail.com" = "system-monitor"; # manually packaged
  "System_Monitor@bghome.gmail.com" = "system-monitor-2";

--- a/pkgs/desktops/gnome/extensions/extensions.json
+++ b/pkgs/desktops/gnome/extensions/extensions.json
--- a/pkgs/desktops/lumina/lumina/avoid-absolute-path-on-sessdir.patch
+++ b/pkgs/desktops/lumina/lumina/avoid-absolute-path-on-sessdir.patch
@ -1,11 +0,0 @@
-diff -Naur lumina-1.0.0-Release-p1-OLD/src-qt5/OS-detect.pri lumina-1.0.0-Release-p1-PATCH/src-qt5/OS-detect.pri
--- lumina-1.0.0-Release-p1-OLD/src-qt5/OS-detect.pri	2016-08-09 12:04:30.000000000 -0300
-+++ lumina-1.0.0-Release-p1-PATCH/src-qt5/OS-detect.pri	2016-08-13 17:32:18.272137900 -0300
-@@ -55,7 +55,6 @@
-     #Use the defaults for everything else
- 
-   }else : linux-*{
-    L_SESSDIR=/usr/share/xsessions
-     OS=Linux
-     LIBS += -L/usr/local/lib -L/usr/lib -L/lib
- 
--- a/pkgs/desktops/lumina/lumina/default.nix
+++ b/pkgs/desktops/lumina/lumina/default.nix
@ -2,8 +2,8 @@
 , mkDerivation
 , fetchFromGitHub
 , fluxbox
+, hicolor-icon-theme
 , libarchive
-, linux-pam
 , numlockx
 , qmake
 , qtbase
@ -18,13 +18,13 @@

 mkDerivation rec {
  pname = "lumina";
-  version = "1.6.1";
+  version = "1.6.2";

  src = fetchFromGitHub {
    owner = "lumina-desktop";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0wc8frhw1yv07n05r33c4zilq5lgn5gw07a9n37g6nyn5sgrbp4f";
+    sha256 = "1llr65gilcf0k88f9mbwzlalqwdnjy4nv2jq7w154z0xmd6iarfq";
  };

  nativeBuildInputs = [
@ -35,8 +35,8 @@ mkDerivation rec {

  buildInputs = [
    fluxbox # window manager for Lumina DE
+    hicolor-icon-theme
    libarchive # make `bsdtar` available for lumina-archiver
-    linux-pam
    numlockx # required for changing state of numlock at login
    qtbase
    qtmultimedia
@ -50,6 +50,8 @@ mkDerivation rec {
    xscreensaver
  ];

+  dontDropIconThemeCache = true;
+
  patches = [
    ./LuminaOS-NixOS.cpp.patch
  ];
@ -65,10 +67,6 @@ mkDerivation rec {
    substituteInPlace src-qt5/OS-detect.pri \
      --replace L_SESSDIR=/usr/share/xsessions '#L_SESSDIR=/usr/share/xsessions'

-    # Do not set special permission
-    substituteInPlace src-qt5/core/lumina-checkpass/lumina-checkpass.pro \
-      --replace "chmod 4555" "chmod 555"
-
    # Fix plugin dir
    substituteInPlace src-qt5/core/lumina-theme-engine/lthemeengine.pri \
      --replace "\$\$[QT_INSTALL_PLUGINS]" "$out/$qtPluginPrefix"
@ -81,9 +79,14 @@ mkDerivation rec {
    substituteInPlace src-qt5/desktop-utils/lumina-archiver/TarBackend.cpp \
      --replace '"bsdtar"' '"${lib.getBin libarchive}/bin/bsdtar"'

-    # Fix desktop files
-    for i in $(grep -lir 'OnlyShowIn=Lumina' src-qt5); do
-      substituteInPlace $i --replace 'OnlyShowIn=Lumina' 'OnlyShowIn=X-Lumina'
+    # Fix installation path of lumina-sudo
+    substituteInPlace src-qt5/desktop-utils/lumina-sudo/lumina-sudo.pro \
+      --replace "/usr/bin" "$out/bin"
+  '';
+
+  postInstall = ''
+    for theme in lumina-icons material-design-{dark,light}; do
+      gtk-update-icon-cache $out/share/icons/$theme
    done
  '';

--- a/pkgs/development/compilers/rust/clippy.nix
+++ b/pkgs/development/compilers/rust/clippy.nix
@ -20,6 +20,10 @@ rustPlatform.buildRustPackage {
  #   (/private/tmp/nix-build-clippy-1.36.0.drv-0/rustc-1.36.0-src/src/librustc_llvm)
  doCheck = false;

+  preBuild = ''
+    export CARGO_TARGET_DIR="$(pwd)/target"
+  '';
+
  preFixup = lib.optionalString stdenv.isDarwin ''
    install_name_tool -add_rpath "${rustc}/lib" $out/bin/clippy-driver
  '';
--- a/pkgs/development/libraries/bullet/default.nix
+++ b/pkgs/development/libraries/bullet/default.nix
@ -11,13 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "bullet";
-  version = "3.17";
+  version = "3.21";

  src = fetchFromGitHub {
    owner = "bulletphysics";
    repo = "bullet3";
    rev = version;
-    sha256 = "sha256-uQ4X8F8nmagbcFh0KexrmnhHIXFSB3A1CCnjPVeHL3Q=";
+    sha256 = "sha256-krzqZ2TPycyWjJzYJ69rb6Qgymlio5HGw2nPCjDZPGk=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/embree/default.nix
+++ b/pkgs/development/libraries/embree/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "embree";
-  version = "3.13.1";
+  version = "3.13.2";

  src = fetchFromGitHub {
    owner = "embree";
    repo = "embree";
    rev = "v${version}";
-    sha256 = "sha256-6BL/NnveIMg+xD8Zsc3sidL0iw0YbJITgd8Zf4Mh28I=";
+    sha256 = "sha256-bnd7p8Yu0YGkhUrg3yy32rk7kmHGB4YxMx1qWzIx5vw=";
  };

  postPatch = ''
--- a/pkgs/development/libraries/gsound/default.nix
+++ b/pkgs/development/libraries/gsound/default.nix
@ -9,9 +9,16 @@ stdenv.mkDerivation rec {
    sha256 = "06l80xgykj7x1kqkjvcq06pwj2rmca458zvs053qc55x3sg06bfa";
  };

+  strictDeps = true;
+  depsBuildBuild = [ pkg-config ];
  nativeBuildInputs = [ pkg-config meson ninja gobject-introspection libtool vala ];
  buildInputs = [ glib libcanberra ];

+  mesonFlags = [
+    "-Dintrospection=${lib.boolToString (stdenv.buildPlatform == stdenv.hostPlatform)}"
+    "-Denable_vala=${lib.boolToString (stdenv.buildPlatform == stdenv.hostPlatform)}"
+  ];
+
  passthru = {
    updateScript = gnome.updateScript {
      packageName = pname;
--- a/pkgs/development/libraries/gvm-libs/default.nix
+++ b/pkgs/development/libraries/gvm-libs/default.nix
@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "gvm-libs";
-  version = "21.4.2";
+  version = "21.4.3";

  src = fetchFromGitHub {
    owner = "greenbone";
    repo = pname;
    rev = "v${version}";
-    sha256 = "14v7z8ynd20s4pkhp2nc19n6gbmbh8yrn39yi2fbfm7gj28b52sx";
+    sha256 = "sha256-1NVLGyUDUnOy3GYDtVyhGTvWOYoWp95EbkgTlFWuxE8=";
  };

  nativeBuildInputs = [
@ -50,6 +50,10 @@ stdenv.mkDerivation rec {
    zlib
  ];

+  cmakeFlags = [
+    "-DGVM_RUN_DIR=$out/run/gvm"
+  ];
+
  meta = with lib; {
    description = "Libraries module for the Greenbone Vulnerability Management Solution";
    homepage = "https://github.com/greenbone/gvm-libs";
--- a/pkgs/development/libraries/jsoncpp/default.nix
+++ b/pkgs/development/libraries/jsoncpp/default.nix
@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
    "-DBUILD_STATIC_LIBS=OFF"
    "-DBUILD_OBJECT_LIBS=OFF"
    "-DJSONCPP_WITH_CMAKE_PACKAGE=ON"
-  ];
+  ] ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) "-DJSONCPP_WITH_TESTS=OFF";

  meta = with lib; {
    homepage = "https://github.com/open-source-parsers/jsoncpp";
--- a/pkgs/development/libraries/libcouchbase/default.nix
+++ b/pkgs/development/libraries/libcouchbase/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libcouchbase";
-  version = "3.2.3";
+  version = "3.2.4";

  src = fetchFromGitHub {
    owner = "couchbase";
    repo = "libcouchbase";
    rev = version;
-    sha256 = "sha256-pCqSsmddgNtQJnOVIHz5ft0gJN5T7T3ehHtjuexhBxI=";
+    sha256 = "sha256-7gHqnhNog0CN92YyvypbHWWUnCDuvGP4oiJjtP9GkIY=";
  };

  cmakeFlags = [ "-DLCB_NO_MOCK=ON" ];
--- a/pkgs/development/libraries/libx86emu/default.nix
+++ b/pkgs/development/libraries/libx86emu/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libx86emu";
-  version = "3.1";
+  version = "3.5";

  src = fetchFromGitHub {
    owner = "wfeldt";
    repo = "libx86emu";
    rev = version;
-    sha256 = "104xqc6nj9rpi7knl3dfqvasf087hlz2n5yndb1iycw35a6j509b";
+    sha256 = "sha256-dKT/Ey+vardXu/+coaC69TTUXjJLsLBKgCx9VY8f0oY=";
  };

  nativeBuildInputs = [ perl ];
--- a/pkgs/development/libraries/libzim/default.nix
+++ b/pkgs/development/libraries/libzim/default.nix
@ -0,0 +1,48 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, icu
+, meson
+, ninja
+, pkg-config
+, xz
+, zstd
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libzim";
+  version = "7.0.0";
+
+  src = fetchFromGitHub {
+    owner = "openzim";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-OQVGopAInAI7KCEVr3BxaKD6np2QcFCaDjgNWjT202U=";
+  };
+
+  nativeBuildInputs = [
+    ninja
+    meson
+    pkg-config
+  ];
+
+  buildInputs = [
+    icu
+    xz
+    zstd
+  ];
+
+  mesonFlags = [
+    # Tests are located at https://github.com/openzim/zim-testing-suite
+    # "...some tests need up to 16GB of memory..."
+    "-Dtest_data_dir=none"
+    "-Dwith_xapian=false"
+  ];
+
+  meta = with lib; {
+    description = "Reference implementation of the ZIM specification";
+    homepage = "https://github.com/openzim/libzim";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/libraries/nco/default.nix
+++ b/pkgs/development/libraries/nco/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "nco";
-  version = "5.0.3";
+  version = "5.0.4";

  src = fetchFromGitHub {
    owner = "nco";
    repo = "nco";
    rev = version;
-    sha256 = "sha256-KrFRBlD3z/sjKIvxmE0s/xCILQmESecilnlUGzDDICw=";
+    sha256 = "sha256-hE3TSfZoKqiUEcLO+Q3xAjhyDPNqoq7+FGlKNpm8hjY=";
  };

  nativeBuildInputs = [ flex which antlr2 ];
--- a/pkgs/development/libraries/openexr/3.nix
+++ b/pkgs/development/libraries/openexr/3.nix
@ -8,7 +8,7 @@

 stdenv.mkDerivation rec {
  pname = "openexr";
-  version = "3.1.2";
+  version = "3.1.3";

  outputs = [ "bin" "dev" "out" "doc" ];

@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
    owner = "AcademySoftwareFoundation";
    repo = "openexr";
    rev = "v${version}";
-    sha256 = "0vyclrrikphwkkpyjg8kzh3qzflzk3d6xsidgqllgfdgllr9wmgv";
+    sha256 = "sha256-Bi6yTcZBWTsWWMm3A7FVYblvSXKLSkHmhGvpNYGiOzE=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/openimagedenoise/default.nix
+++ b/pkgs/development/libraries/openimagedenoise/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "openimagedenoise";
-  version = "1.4.1";
+  version = "1.4.2";

  # The release tarballs include pretrained weights, which would otherwise need to be fetched with git-lfs
  src = fetchzip {
    url = "https://github.com/OpenImageDenoise/oidn/releases/download/v${version}/oidn-${version}.src.tar.gz";
-    sha256 = "sha256-TQ7cL0/6pnSTuW21DESA5I3S/C1BHStrWK9yaPoim6E=";
+    sha256 = "sha256-+7o7b64ORCLn8z0KbnUKhlgPs9mlyDCUiNKJEbusGxw=";
  };

  nativeBuildInputs = [ cmake python3 ispc ];
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@ -25,6 +25,8 @@
 , webrtc-audio-processing
 , ncurses
 , readline81 # meson can't find <7 as those versions don't have a .pc file
+, lilv
+, openssl
 , makeFontsConf
 , callPackage
 , nixosTests
@ -64,7 +66,7 @@ let

  self = stdenv.mkDerivation rec {
    pname = "pipewire";
-    version = "0.3.40";
+    version = "0.3.42";

    outputs = [
      "out"
@ -82,7 +84,7 @@ let
      owner = "pipewire";
      repo = "pipewire";
      rev = version;
-      sha256 = "sha256-eY6uQa4+sC6yUWhF4IpAgRoppwhHO4s5fIMXOkS0z7A=";
+      sha256 = "sha256-Iyd5snOt+iCT7W0+FlfvhMUZo/gF+zr9JX4HIGVdHto=";
    };

    patches = [
@ -117,7 +119,9 @@ let
      libjack2
      libusb1
      libsndfile
+      lilv
      ncurses
+      openssl
      readline81
      udev
      vulkan-headers
--- a/pkgs/development/libraries/sqlcipher/default.nix
+++ b/pkgs/development/libraries/sqlcipher/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "sqlcipher";
-  version = "4.4.3";
+  version = "4.5.0";

  src = fetchFromGitHub {
    owner = "sqlcipher";
    repo = "sqlcipher";
    rev = "v${version}";
-    sha256 = "sha256-E23PTNnVZbBQtHL0YjUwHNVUA76XS8rlARBOVvX6zZw=";
+    sha256 = "sha256-MFuFyKvOOrDrq9cDPQlNK6/YHSkaRX4qbw/44m5CRh4=";
  };

  nativeBuildInputs = [ installShellFiles tcl ];
--- a/pkgs/development/libraries/wolfssl/default.nix
+++ b/pkgs/development/libraries/wolfssl/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "wolfssl";
-  version = "5.0.0";
+  version = "5.1.0";

  src = fetchFromGitHub {
    owner = "wolfSSL";
    repo = "wolfssl";
    rev = "v${version}-stable";
-    sha256 = "sha256-rv9D+P42RMH1O4YLQbZIEkD6KQfs8KgYjhnHeA9vQqE=";
+    sha256 = "sha256-PkuYXDL04LbUiY+O/4EilZn2+hTbwbRXPDE3B5d/4pQ=";
  };

  # Almost same as Debian but for now using --enable-all --enable-reproducible-build instead of --enable-distro to ensure options.h gets installed
--- a/pkgs/development/mobile/androidenv/compose-android-packages.nix
+++ b/pkgs/development/mobile/androidenv/compose-android-packages.nix
@ -6,7 +6,7 @@
 , platformToolsVersion ? "31.0.3"
 , buildToolsVersions ? [ "31.0.0" ]
 , includeEmulator ? false
-, emulatorVersion ? "30.6.3"
+, emulatorVersion ? "30.9.0"
 , platformVersions ? []
 , includeSources ? false
 , includeSystemImages ? false
--- a/pkgs/development/python-modules/asyncio-dgram/default.nix
+++ b/pkgs/development/python-modules/asyncio-dgram/default.nix
@ -1,33 +1,41 @@
-{ stdenv
-, lib
+{ lib
+, stdenv
 , buildPythonPackage
 , fetchFromGitHub
-, pytestCheckHook
 , pytest-asyncio
+, pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "asyncio-dgram";
-  version = "2.1.0";
+  version = "2.1.1";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.5";

  src = fetchFromGitHub {
    owner = "jsbronder";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1ibyphncb3d8vrs3yk8j6l1smmnibizx9k1vir2njhi09r57h9mx";
+    sha256 = "sha256-3K9VpX6JWCgz+Lx+5ZKqXG53B/uJCtI0x4pHy2pJdZg=";
  };

+  checkInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
  # OSError: AF_UNIX path too long
  doCheck = !stdenv.isDarwin;

-  checkInputs = [
-    pytestCheckHook
-    pytest-asyncio
+  disabledTests = [
+    "test_protocol_pause_resume"
  ];

-  disabledTests = [ "test_protocol_pause_resume" ];
-
-  pythonImportsCheck = [ "asyncio_dgram" ];
+  pythonImportsCheck = [
+    "asyncio_dgram"
+  ];

  meta = with lib; {
    description = "Python support for higher level Datagram";
--- a/pkgs/development/python-modules/black/default.nix
+++ b/pkgs/development/python-modules/black/default.nix
@ -10,7 +10,6 @@
 , pathspec
 , parameterized
 , platformdirs
-, regex
 , tomli
 , typed-ast
 , typing-extensions
@ -20,13 +19,13 @@

 buildPythonPackage rec {
  pname = "black";
-  version = "21.10b0";
+  version = "21.12b0";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-qZUiKQkuMl/l89rlbYH2ObI/cTHrhAeBlH5LKIYDDzM=";
+    hash = "sha256-d7gPaTpWni5SeVhFljTxjfmwuiYluk4MLV2lvkLm8rM=";
  };

  nativeBuildInputs = [ setuptools-scm ];
@ -68,7 +67,6 @@ buildPythonPackage rec {
    mypy-extensions
    pathspec
    platformdirs
-    regex
    tomli
    typed-ast # required for tests and python2 extra
    uvloop
--- a/pkgs/development/python-modules/cachey/default.nix
+++ b/pkgs/development/python-modules/cachey/default.nix
@ -0,0 +1,30 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, typing-extensions
+, heapdict
+, pytestCheckHook
+, pythonOlder
+}: buildPythonPackage rec {
+  pname = "cachey";
+  version = "0.2.1";
+  format = "setuptools";
+  disabled = pythonOlder "3.6";
+  src = fetchFromGitHub {
+    owner = "dask";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-5USmuufrrWtmgibpfkjo9NtgN30hdl8plJfythmxM4s=";
+  };
+  propagatedBuildInputs = [ typing-extensions heapdict ];
+  checkInputs = [ pytestCheckHook ];
+  pythonImportsCheck = [
+    "cachey"
+  ];
+  meta = with lib; {
+    description = "Caching based on computation time and storage space";
+    homepage = "https://github.com/dask/cachey/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ SomeoneSerge ];
+  };
+}
--- a/pkgs/development/python-modules/chex/default.nix
+++ b/pkgs/development/python-modules/chex/default.nix
@ -0,0 +1,50 @@
+{ absl-py
+, buildPythonPackage
+, dm-tree
+, fetchFromGitHub
+, jax
+, jaxlib
+, lib
+, numpy
+, pytestCheckHook
+, toolz
+}:
+
+buildPythonPackage rec {
+  pname = "chex";
+  # As of 2021-12-29, the latest official version has broken tests with jax 0.2.26:
+  # `AttributeError: module 'jax.interpreters.xla' has no attribute 'xb'`
+  version = "unstable-2021-12-16";
+  format = "setuptools";
+
+  src = fetchFromGitHub {
+    owner = "deepmind";
+    repo = pname;
+    rev = "5adc10e0b4218f8ec775567fca38b68bbad42a3a";
+    sha256 = "00xib6zv9pwid2q7wcr109qj3fa3g3b852skz8444kw7r0qxy7z3";
+  };
+
+  propagatedBuildInputs = [
+    absl-py
+    dm-tree
+    jax
+    numpy
+    toolz
+  ];
+
+  pythonImportsCheck = [
+    "chex"
+  ];
+
+  checkInputs = [
+    jaxlib
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    description = "Chex is a library of utilities for helping to write reliable JAX code.";
+    homepage = "https://github.com/deepmind/chex";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ndl ];
+  };
+}
--- a/pkgs/development/python-modules/dm-tree/cmake.patch
+++ b/pkgs/development/python-modules/dm-tree/cmake.patch
@ -0,0 +1,141 @@
+diff --git a/tree/CMakeLists.txt b/tree/CMakeLists.txt
+index 8f9946c..b9d6e9b 100644
+--- a/tree/CMakeLists.txt
+++ b/tree/CMakeLists.txt
+@@ -50,70 +50,80 @@ if(APPLE)
+   set (CMAKE_FIND_FRAMEWORK LAST)
+ endif()
+ 
+-# Fetch pybind to be able to use pybind11_add_module symbol.
+-set(PYBIND_VER v2.6.2)
+-include(FetchContent)
+-FetchContent_Declare(
+-  pybind11
+-  GIT_REPOSITORY https://github.com/pybind/pybind11
+-  GIT_TAG        ${PYBIND_VER}
+-)
+-if(NOT pybind11_POPULATED)
+-    FetchContent_Populate(pybind11)
+-    add_subdirectory(${pybind11_SOURCE_DIR} ${pybind11_BINARY_DIR})
+-    include_directories(${pybind11_INCLUDE_DIR})
+-endif()
+-
+-# Needed to disable Abseil tests.
+-set (BUILD_TESTING OFF)
+-
+-# Include abseil-cpp.
+-set(ABSEIL_VER 20210324.2)
+-include(ExternalProject)
+-set(ABSEIL_CMAKE_ARGS
+-    "-DCMAKE_INSTALL_PREFIX=${CMAKE_SOURCE_DIR}/abseil-cpp"
+-    "-DCMAKE_CXX_STANDARD=${CMAKE_CXX_STANDARD}"
+-    "-DCMAKE_CXX_COMPILER=${CMAKE_CXX_COMPILER}"
+-    "-DCMAKE_CXX_FLAGS=${CMAKE_CXX_FLAGS}"
+-    "-DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}"
+-    "-DCMAKE_POSITION_INDEPENDENT_CODE=${CMAKE_POSITION_INDEPENDENT_CODE}"
+-    "-DLIBRARY_OUTPUT_PATH=${CMAKE_SOURCE_DIR}/abseil-cpp/lib")
+-if(DEFINED CMAKE_OSX_ARCHITECTURES)
+-    set(ABSEIL_CMAKE_ARGS
+-        ${ABSEIL_CMAKE_ARGS}
+-        "-DCMAKE_OSX_ARCHITECTURES=${CMAKE_OSX_ARCHITECTURES}")
+find_package(pybind11 CONFIG)
+
+if (NOT pybind11_FOUND)
+  # Fetch pybind to be able to use pybind11_add_module symbol.
+  set(PYBIND_VER v2.6.2)
+  include(FetchContent)
+  FetchContent_Declare(
+    pybind11
+    GIT_REPOSITORY https://github.com/pybind/pybind11
+    GIT_TAG        ${PYBIND_VER}
+  )
+  if(NOT pybind11_POPULATED)
+      FetchContent_Populate(pybind11)
+      add_subdirectory(${pybind11_SOURCE_DIR} ${pybind11_BINARY_DIR})
+      include_directories(${pybind11_INCLUDE_DIR})
+  endif()
+ endif()
+-ExternalProject_Add(abseil-cpp
+-  GIT_REPOSITORY    https://github.com/abseil/abseil-cpp.git
+-  GIT_TAG           ${ABSEIL_VER}
+-  PREFIX            ${CMAKE_SOURCE_DIR}/abseil-cpp
+-  CMAKE_ARGS        ${ABSEIL_CMAKE_ARGS}
+-)
+-ExternalProject_Get_Property(abseil-cpp install_dir)
+-set(abseil_install_dir ${install_dir})
+-include_directories (${abseil_install_dir}/include)
+-
+ 
+ # Define pybind11 tree module.
+ pybind11_add_module(_tree tree.h tree.cc)
+-add_dependencies(_tree abseil-cpp)
+ 
+-if (WIN32 OR MSVC)
+-    set(ABSEIL_LIB_PREF "absl")
+-    set(LIB_SUFF "lib")
+find_package(absl)
+
+if (NOT absl_FOUND)
+  # Needed to disable Abseil tests.
+  set (BUILD_TESTING OFF)
+
+  # Include abseil-cpp.
+  set(ABSEIL_VER 20210324.2)
+  include(ExternalProject)
+  set(ABSEIL_CMAKE_ARGS
+      "-DCMAKE_INSTALL_PREFIX=${CMAKE_SOURCE_DIR}/abseil-cpp"
+      "-DCMAKE_CXX_STANDARD=${CMAKE_CXX_STANDARD}"
+      "-DCMAKE_CXX_COMPILER=${CMAKE_CXX_COMPILER}"
+      "-DCMAKE_CXX_FLAGS=${CMAKE_CXX_FLAGS}"
+      "-DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}"
+      "-DCMAKE_POSITION_INDEPENDENT_CODE=${CMAKE_POSITION_INDEPENDENT_CODE}"
+      "-DLIBRARY_OUTPUT_PATH=${CMAKE_SOURCE_DIR}/abseil-cpp/lib")
+  if(DEFINED CMAKE_OSX_ARCHITECTURES)
+      set(ABSEIL_CMAKE_ARGS
+          ${ABSEIL_CMAKE_ARGS}
+          "-DCMAKE_OSX_ARCHITECTURES=${CMAKE_OSX_ARCHITECTURES}")
+  endif()
+  ExternalProject_Add(abseil-cpp
+    GIT_REPOSITORY    https://github.com/abseil/abseil-cpp.git
+    GIT_TAG           ${ABSEIL_VER}
+    PREFIX            ${CMAKE_SOURCE_DIR}/abseil-cpp
+    CMAKE_ARGS        ${ABSEIL_CMAKE_ARGS}
+  )
+  ExternalProject_Get_Property(abseil-cpp install_dir)
+  set(abseil_install_dir ${install_dir})
+  include_directories (${abseil_install_dir}/include)
+
+  add_dependencies(_tree abseil-cpp)
+
+  if (WIN32 OR MSVC)
+      set(ABSEIL_LIB_PREF "absl")
+      set(LIB_SUFF "lib")
+  else()
+      set(ABSEIL_LIB_PREF "libabsl")
+      set(LIB_SUFF "a")
+  endif()
+
+  # Link abseil static libs.
+  # We don't use find_library here to force cmake to build abseil before linking.
+  set(ABSEIL_LIBS int128 raw_hash_set raw_logging_internal strings throw_delegate)
+  foreach(ABSEIL_LIB IN LISTS ABSEIL_LIBS)
+    target_link_libraries(_tree PRIVATE
+        "${abseil_install_dir}/lib/${ABSEIL_LIB_PREF}_${ABSEIL_LIB}.${LIB_SUFF}")
+  endforeach()
+ else()
+-    set(ABSEIL_LIB_PREF "libabsl")
+-    set(LIB_SUFF "a")
+  target_link_libraries(_tree PRIVATE absl::int128 absl::raw_hash_set absl::raw_logging_internal absl::strings absl::throw_delegate)
+ endif()
+ 
+-# Link abseil static libs.
+-# We don't use find_library here to force cmake to build abseil before linking.
+-set(ABSEIL_LIBS int128 raw_hash_set raw_logging_internal strings throw_delegate)
+-foreach(ABSEIL_LIB IN LISTS ABSEIL_LIBS)
+-  target_link_libraries(_tree PRIVATE
+-      "${abseil_install_dir}/lib/${ABSEIL_LIB_PREF}_${ABSEIL_LIB}.${LIB_SUFF}")
+-endforeach()
+-
+ # Make the module private to tree package.
+ set_target_properties(_tree PROPERTIES OUTPUT_NAME tree/_tree)
+ 
--- a/pkgs/development/python-modules/dm-tree/default.nix
+++ b/pkgs/development/python-modules/dm-tree/default.nix
@ -1,47 +1,56 @@
-{ autoPatchelfHook
+{ abseil-cpp
+, absl-py
+, attrs
 , buildPythonPackage
-, fetchPypi
-, isPy39
+, cmake
+, fetchFromGitHub
 , lib
-, six
-, stdenv
+, numpy
+, pybind11
+, wrapt
 }:

 buildPythonPackage rec {
  pname = "dm-tree";
-  version = "0.1.6";
-  format = "wheel";
+  # As of 2021-12-29, the latest stable version still builds with Bazel.
+  version = "unstable-2021-12-20";

-  # At the time of writing (8/19/21), there are releases for 3.6-3.9. Supporting
-  # all of them is a pain, so we focus on 3.9, the current nixpkgs python3
-  # version.
-  disabled = !isPy39;
-
-  src = fetchPypi {
-    inherit version format;
-    sha256 = "1f71dy5xa5ywa5chbdhpdf8k0w1v9cvpn3qyk8nnjm79j90la9c4";
-    pname = "dm_tree";
-    dist = "cp39";
-    python = "cp39";
-    abi = "cp39";
-    platform = "manylinux_2_24_x86_64";
+  src = fetchFromGitHub {
+    owner = "deepmind";
+    repo = "tree";
+    rev = "b452e5c2743e7489b4ba7f16ecd51c516d7cd8e3";
+    sha256 = "1r187xwpvnnj98lyasngcv3lbxz0ziihpl5dbnjbfbjr0kh6z0j9";
  };

-  # Prebuilt wheels are dynamically linked against things that nix can't find.
-  # Run `autoPatchelfHook` to automagically fix them.
-  nativeBuildInputs = [ autoPatchelfHook ];
-  # Dynamic link dependencies
-  buildInputs = [ stdenv.cc.cc ];
+  patches = [
+    ./cmake.patch
+  ];

-  propagatedBuildInputs = [ six ];
+  dontUseCmakeConfigure = true;
+
+  nativeBuildInputs = [
+    cmake
+    pybind11
+  ];
+
+  buildInputs = [
+    abseil-cpp
+    pybind11
+  ];
+
+  checkInputs = [
+    absl-py
+    attrs
+    numpy
+    wrapt
+  ];

  pythonImportsCheck = [ "tree" ];

  meta = with lib; {
    description = "Tree is a library for working with nested data structures.";
-    homepage    = "https://github.com/deepmind/tree";
-    license     = licenses.asl20;
-    maintainers = with maintainers; [ samuela ];
-    platforms = [ "x86_64-linux" ];
+    homepage = "https://github.com/deepmind/tree";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ samuela ndl ];
  };
 }
--- a/pkgs/development/python-modules/docstring-parser/default.nix
+++ b/pkgs/development/python-modules/docstring-parser/default.nix
@ -0,0 +1,27 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools
+, setuptools-scm
+, wheel
+, pytest
+}: buildPythonPackage rec {
+  pname = "docstring-parser";
+  version = "0.12";
+  src = fetchFromGitHub {
+    owner = "rr-";
+    repo = "docstring_parser";
+    rev = "${version}";
+    sha256 = "sha256-hQuPJQrGvDs4dJrMLSR4sSnqy45xrF2ufinBG+azuCg=";
+  };
+  nativeBuildInputs = [ setuptools-scm ];
+  propagatedBuildInputs = [ pytest setuptools wheel ];
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  meta = with lib; {
+    description = "Parse Python docstrings in various flavors. ";
+    homepage = "https://github.com/rr-/docstring_parser";
+    license = licenses.mit;
+    maintainers = with maintainers; [ SomeoneSerge ];
+  };
+}
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@ -14,25 +14,23 @@
 , python-jose
 , sqlalchemy
 , trio
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "fastapi";
-  version = "0.70.0";
+  version = "0.70.1";
  format = "flit";

+  disabled = pythonOlder "3.6";
+
  src = fetchFromGitHub {
    owner = "tiangolo";
-    repo = "fastapi";
+    repo = pname;
    rev = version;
-    sha256 = "sha256-mLI+w9PeewnwUMuUnXj6J2r/3shinjlwXMnhNcQlhrM=";
+    sha256 = "sha256-iwjxcAe8h38PPTTDGCxIJSB7zCS0FA0gOcKUjPpk3yg=";
  };

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "starlette ==" "starlette >="
-  '';
-
  propagatedBuildInputs = [
    starlette
    pydantic
@ -52,16 +50,22 @@ buildPythonPackage rec {
    trio
  ];

-  # disabled tests require orjson which requires rust nightly
-
-  # ignoring deprecation warnings to avoid test failure from
-  # tests/test_tutorial/test_testing/test_tutorial001.py
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace "starlette ==" "starlette >="
+  '';

  pytestFlagsArray = [
-    "--ignore=tests/test_default_response_class.py"
+    # ignoring deprecation warnings to avoid test failure from
+    # tests/test_tutorial/test_testing/test_tutorial001.py
    "-W ignore::DeprecationWarning"
  ];

+  disabledTestPaths = [
+    # Disabled tests require orjson which requires rust nightly
+    "tests/test_default_response_class.py"
+  ];
+
  disabledTests = [
    "test_get_custom_response"

@ -70,9 +74,13 @@ buildPythonPackage rec {
    "test_websocket_no_credentials"
  ];

+  pythonImportsCheck = [
+    "fastapi"
+  ];
+
  meta = with lib; {
+    description = "Web framework for building APIs";
    homepage = "https://github.com/tiangolo/fastapi";
-    description = "FastAPI framework, high performance, easy to learn, fast to code, ready for production";
    license = licenses.mit;
    maintainers = with maintainers; [ wd15 ];
  };
--- a/pkgs/development/python-modules/flask-paginate/default.nix
+++ b/pkgs/development/python-modules/flask-paginate/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "flask-paginate";
-  version = "2021.10.29";
+  version = "2021.12.28";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "660ba1451e4cb168d3a42ed63914fe507bb5c0b30c26a6286b923077bba2362b";
+    sha256 = "c722a25067d722483e24cde16ed987a822292ca758a213299e445694d2b5b587";
  };

  propagatedBuildInputs = [ flask ];
--- a/pkgs/development/python-modules/flux-led/default.nix
+++ b/pkgs/development/python-modules/flux-led/default.nix
@ -8,7 +8,7 @@

 buildPythonPackage rec {
  pname = "flux-led";
-  version = "0.27.20";
+  version = "0.27.28";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -17,7 +17,7 @@ buildPythonPackage rec {
    owner = "Danielhiversen";
    repo = "flux_led";
    rev = version;
-    sha256 = "sha256-bkVhM6Em0kyIhfSCFtotZR5Ob4i8IWBL1oSc+BTVFuw=";
+    sha256 = "sha256-lm560jTafxMVNH4tXx7xov1bQMEYp3FFzJEK5K+ung0=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/jmp/default.nix
+++ b/pkgs/development/python-modules/jmp/default.nix
@ -0,0 +1,42 @@
+{ buildPythonPackage
+, fetchFromGitHub
+, jax
+, jaxlib
+, lib
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  pname = "jmp";
+  # As of 2022-01-01, the latest stable version (0.0.2) fails tests with recent JAX versions,
+  # IIUC it's fixed in https://github.com/deepmind/jmp/commit/4969392f618d7733b265677143d8c81e44085867
+  version = "unstable-2021-10-03";
+
+  src = fetchFromGitHub {
+    owner = "deepmind";
+    repo = pname;
+    rev = "4b94370b8de29b79d6f840b09d1990b91c1afddd";
+    sha256 = "0hh4cmp93wjyidj48gh07vhx2kjvpwd23xvy79bsjn5qaaf6q4cm";
+  };
+
+  # Wheel requires only `numpy`, but the import needs both `jax` and `jaxlib`.
+  propagatedBuildInputs = [
+    jax
+    jaxlib
+  ];
+
+  pythonImportsCheck = [
+    "jmp"
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  meta = with lib; {
+    description = "This library implements support for mixed precision training in JAX.";
+    homepage = "https://github.com/deepmind/jmp";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ndl ];
+  };
+}
--- a/pkgs/development/python-modules/json-schema-for-humans/default.nix
+++ b/pkgs/development/python-modules/json-schema-for-humans/default.nix
@ -19,7 +19,7 @@

 buildPythonPackage rec {
  pname = "json-schema-for-humans";
-  version = "0.39.1";
+  version = "0.39.3";
  format = "pyproject";

  disabled = pythonOlder "3.6";
@ -28,7 +28,7 @@ buildPythonPackage rec {
    owner = "coveooss";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-JoD4XEfIUsAbITWa0LMYgNP6WzrblI4HUIgLpx5gn18=";
+    sha256 = "sha256-rg50AE30R1OErtOKppnkhg8MTuhEY6gdBgc7ipEkONA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/line_profiler/default.nix
+++ b/pkgs/development/python-modules/line_profiler/default.nix
@ -7,15 +7,19 @@
 , python
 , scikit-build
 , cmake
+, pythonOlder
 }:

 buildPythonPackage rec {
-  pname = "line_profiler";
-  version = "3.3.1";
+  pname = "line-profiler";
+  version = "3.4.0";
+
+  disabled = pythonOlder "3.6" || isPyPy;

  src = fetchPypi {
-    inherit pname version;
-    sha256 = "6e2fb792ca022f900f374f9659fd3e7c530cd4df7d3b7e84be889093b487639f";
+    pname = "line_profiler";
+    inherit version;
+    sha256 = "b6b0a8100a2829358e31ef7c6f427b1dcf2b1d8e5d38b55b219719ecf758aee5";
  };

  nativeBuildInputs = [
@ -24,30 +28,32 @@ buildPythonPackage rec {
    scikit-build
  ];

-  dontUseCmakeConfigure = true;
-
  propagatedBuildInputs = [
    ipython
  ];

-  disabled = isPyPy;
-
-  preBuild = ''
-    rm -f _line_profiler.c
-  '';
-
  checkInputs = [
    ipython
  ];

+  dontUseCmakeConfigure = true;
+
+  preBuild = ''
+    rm -f _line_profiler.c
+  '';
+
  checkPhase = ''
    PYTHONPATH=$out/${python.sitePackages}:$PYTHONPATH cd tests && ${python.interpreter} -m unittest discover -s .
  '';

-  meta = {
+  pythonImportsCheck = [
+    "line_profiler"
+  ];
+
+  meta = with lib; {
    description = "Line-by-line profiler";
-    homepage = "https://github.com/rkern/line_profiler";
-    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fridh ];
+    homepage = "https://github.com/pyutils/line_profiler";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ fridh ];
  };
 }
--- a/pkgs/development/python-modules/magicgui/default.nix
+++ b/pkgs/development/python-modules/magicgui/default.nix
@ -0,0 +1,33 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools-scm
+, pytestCheckHook
+, pytest-mypy-plugins
+, typing-extensions
+, qtpy
+, pyside2
+, psygnal
+, docstring-parser
+}: buildPythonPackage rec {
+  pname = "magicgui";
+  version = "0.3.0";
+  src = fetchFromGitHub {
+    owner = "napari";
+    repo = "magicgui";
+    rev = "v${version}";
+    sha256 = "sha256-DvL1szk2RoCrpisjp0BVNL6qFZtYc2oYDenX59Cxbug=";
+  };
+  nativeBuildInputs = [ setuptools-scm ];
+  propagatedBuildInputs = [ typing-extensions qtpy pyside2 psygnal docstring-parser ];
+  checkInputs = [ pytestCheckHook pytest-mypy-plugins ];
+  doCheck = false; # Reports "Fatal Python error"
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  meta = with lib; {
+    description = "Build GUIs from python functions, using magic.  (napari/magicgui)";
+    homepage = "https://github.com/napari/magicgui";
+    license = licenses.mit;
+    maintainers = with maintainers; [ SomeoneSerge ];
+  };
+}
--- a/pkgs/development/python-modules/napari-console/default.nix
+++ b/pkgs/development/python-modules/napari-console/default.nix
@ -0,0 +1,33 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools-scm
+, pytestCheckHook
+, pytest
+, ipython
+, ipykernel
+, qtconsole
+, napari-plugin-engine
+, imageio
+}: buildPythonPackage rec {
+  pname = "napari-console";
+  version = "0.0.4";
+  src = fetchFromGitHub {
+    owner = "napari";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-aVdYOzkZ+dqB680oDjNCg6quXU+QgUZI09E/MSTagyA=";
+  };
+  nativeBuildInputs = [ setuptools-scm ];
+  # setup.py somehow requires pytest
+  propagatedBuildInputs = [ pytest ipython ipykernel napari-plugin-engine imageio qtconsole ];
+  chechInputs = [ pytestCheckHook ];
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  meta = with lib; {
+    description = "A plugin that adds a console to napari";
+    homepage = "https://github.com/napari/napari-console";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ SomeoneSerge ];
+  };
+}
--- a/pkgs/development/python-modules/napari-plugin-engine/default.nix
+++ b/pkgs/development/python-modules/napari-plugin-engine/default.nix
@ -0,0 +1,26 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools-scm
+, pytestCheckHook
+}: buildPythonPackage rec {
+  pname = "napari-plugin-engine";
+  version = "0.2.0";
+  src = fetchFromGitHub {
+    owner = "napari";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-cKpCAEYYRq3UPje7REjzhEe1J9mmrtXs8TBnxWukcNE=";
+  };
+  nativeBuildInputs = [ setuptools-scm ];
+  checkInputs = [ pytestCheckHook ];
+  doCheck = false;
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  meta = with lib; {
+    description = "A fork of pluggy for napari - plugin management package";
+    homepage = "https://github.com/napari/napari-plugin-engine";
+    license = licenses.mit;
+    maintainers = with maintainers; [ SomeoneSerge ];
+  };
+}
--- a/pkgs/development/python-modules/napari-svg/default.nix
+++ b/pkgs/development/python-modules/napari-svg/default.nix
@ -0,0 +1,30 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools-scm
+, pytestCheckHook
+, vispy
+, napari-plugin-engine
+, imageio
+}: buildPythonPackage rec {
+  pname = "napari-svg";
+  version = "0.1.5";
+  src = fetchFromGitHub {
+    owner = "napari";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-20NLi6JTugP+hxqF2AnhSkuvhkGGbeG+tT3M2SZbtRc=";
+  };
+  nativeBuildInputs = [ setuptools-scm ];
+  propagatedBuildInputs = [ vispy napari-plugin-engine imageio ];
+  checkInputs = [ pytestCheckHook ];
+  doCheck = false; # Circular dependency: napari
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  meta = with lib; {
+    description = "A plugin for writing svg files from napari";
+    homepage = "https://github.com/napari/napari-svg";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ SomeoneSerge ];
+  };
+}
--- a/pkgs/development/python-modules/napari/default.nix
+++ b/pkgs/development/python-modules/napari/default.nix
@ -0,0 +1,75 @@
+{ lib
+, mkDerivationWith
+, buildPythonPackage
+, fetchFromGitHub
+, setuptools-scm
+, superqt
+, typing-extensions
+, tifffile
+, napari-plugin-engine
+, pint
+, pyyaml
+, numpydoc
+, dask
+, magicgui
+, docstring-parser
+, appdirs
+, imageio
+, pyopengl
+, cachey
+, napari-svg
+, psutil
+, napari-console
+, wrapt
+, pydantic
+, tqdm
+, jsonschema
+, scipy
+, wrapQtAppsHook
+}: mkDerivationWith buildPythonPackage rec {
+  pname = "napari";
+  version = "0.4.12";
+  src = fetchFromGitHub {
+    owner = "napari";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-0QSI0mgDjF70/X58fE7uWwlBUCGY5gsvbCm4oJkp2Yk=";
+  };
+  nativeBuildInputs = [ setuptools-scm wrapQtAppsHook ];
+  propagatedBuildInputs = [
+    napari-plugin-engine
+    cachey
+    napari-svg
+    napari-console
+    superqt
+    magicgui
+    typing-extensions
+    tifffile
+    pint
+    pyyaml
+    numpydoc
+    dask
+    docstring-parser
+    appdirs
+    imageio
+    pyopengl
+    psutil
+    wrapt
+    pydantic
+    tqdm
+    jsonschema
+    scipy
+  ];
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;
+  dontUseSetuptoolsCheck = true;
+  postFixup = ''
+    wrapQtApp $out/bin/napari
+  '';
+
+  meta = with lib; {
+    description = "A fast, interactive, multi-dimensional image viewer for python";
+    homepage = "https://github.com/napari/napari";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ SomeoneSerge ];
+  };
+}
--- a/pkgs/development/python-modules/ormar/default.nix
+++ b/pkgs/development/python-modules/ormar/default.nix
@ -0,0 +1,80 @@
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitHub
+, poetry-core
+, databases
+, pydantic
+, sqlalchemy
+, asyncpg
+, psycopg2
+, aiomysql
+, aiosqlite
+, cryptography
+, orjson
+, typing-extensions
+, importlib-metadata
+, aiopg
+, mysqlclient
+, pymysql
+, pytestCheckHook
+, pytest-asyncio
+, fastapi
+}:
+
+buildPythonPackage rec {
+  pname = "ormar";
+  version = "0.10.23";
+  format = "pyproject";
+  disabled = pythonOlder "3.7";
+  src = fetchFromGitHub {
+    owner = "collerek";
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-ILJvJyd56lqlKq7+mUz26LvusYb5AOOfoA7OgNq2fT0=";
+  };
+
+  nativeBuildInputs = [
+    poetry-core
+  ];
+
+  propagatedBuildInputs = [
+    databases
+    pydantic
+    sqlalchemy
+    asyncpg
+    psycopg2
+    aiomysql
+    aiosqlite
+    cryptography
+
+    orjson
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    typing-extensions
+    importlib-metadata
+  ];
+
+  checkInputs = [
+    aiomysql
+    aiosqlite
+    aiopg
+    asyncpg
+
+    psycopg2
+    mysqlclient
+    pymysql
+
+    pytestCheckHook
+    pytest-asyncio
+    fastapi
+  ];
+
+  pythonImportsCheck = [ "ormar" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/collerek/ormar";
+    description = "A simple async ORM with fastapi in mind and pydantic validation.";
+    license = licenses.mit;
+    maintainers = with maintainers; [ andreasfelix ];
+  };
+}
--- a/pkgs/development/python-modules/p1monitor/default.nix
+++ b/pkgs/development/python-modules/p1monitor/default.nix
@ -9,7 +9,7 @@

 buildPythonPackage rec {
  pname = "p1monitor";
-  version = "1.0.0";
+  version = "1.1.0";
  format = "pyproject";

  disabled = pythonOlder "3.8";
@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "klaasnicolaas";
    repo = "python-p1monitor";
    rev = "v${version}";
-    sha256 = "1xfr097hmjppp6cfdvfjypxmr1sb9dasq1s3np2vd5d93w0p5123";
+    sha256 = "1ciaclgq4aknldjqlqa08jcab28sbqrjxy5nqqwlnb2wlprg5ijz";
  };

  nativeBuildInputs = [
--- a/Show More
+++ b/Show More