Merge master into haskell-updates

2022-01-05 00:08:41 +00:00 · 2022-01-05 00:08:41 +00:00 · ba204700bc
commit ba204700bc
parent eb9951e70a a4bd74abde
153 changed files with 1371 additions and 667 deletions
--- a/.github/workflows/update-terraform-providers.yml
+++ b/.github/workflows/update-terraform-providers.yml
@ -0,0 +1,47 @@
+name: "Update terraform-providers"
+
+on:
+  schedule:
+    - cron: "14 3 * * 1"
+  workflow_dispatch:
+
+jobs:
+  tf-providers:
+    if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: cachix/install-nix-action@v16
+      - name: setup
+        id: setup
+        run: |
+          echo ::set-output name=title::"terraform-providers: update $(date -u +"%Y-%m-%d")"
+      - name: update terraform-providers
+        run: |
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config user.name "github-actions[bot]"
+          pushd pkgs/applications/networking/cluster/terraform-providers
+          ./update-all-providers
+          git commit -m "${{ steps.setup.outputs.title }}" providers.json
+          popd
+      - name: create PR
+        uses: peter-evans/create-pull-request@v3
+        with:
+          body: |
+            Automatic update of terraform providers.
+
+            Created by [update-terraform-providers](https://github.com/NixOS/nixpkgs/blob/master/.github/workflows/update-terraform-providers.yml) action.
+
+            Check that all providers build with `@ofborg build terraform-full`
+          branch: terraform-providers-update
+          delete-branch: false
+          labels: "2.status: work-in-progress"
+          title: ${{ steps.setup.outputs.title }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: comment on failure
+        uses: peter-evans/create-or-update-comment@v1
+        if: ${{ failure() }}
+        with:
+          issue-number: 153416
+          body: |
+            Automatic update of terraform providers [failed](https://github.com/NixOS/nixpkgs/actions/runs/${{ github.run_id }}).
--- a/doc/languages-frameworks/beam.section.md
+++ b/doc/languages-frameworks/beam.section.md
@ -74,7 +74,7 @@ there are 3 steps, frontend dependencies (javascript), backend dependencies (eli

 ##### mixRelease - Frontend dependencies (javascript) {#mix-release-javascript-deps}

-for phoenix projects, inside of nixpkgs you can either use yarn2nix (mkYarnModule) or node2nix. An example with yarn2nix can be found [here](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/web-apps/plausible/default.nix#L39). An example with node2nix will follow. To package something outside of nixpkgs, you have alternatives like [npmlock2nix](https://github.com/nix-community/npmlock2nix) or [nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage)
+For phoenix projects, inside of nixpkgs you can either use yarn2nix (mkYarnModule) or node2nix. An example with yarn2nix can be found [here](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/web-apps/plausible/default.nix#L39). An example with node2nix will follow. To package something outside of nixpkgs, you have alternatives like [npmlock2nix](https://github.com/nix-community/npmlock2nix) or [nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage)

 ##### mixRelease - backend dependencies (mix) {#mix-release-mix-deps}

@ -82,13 +82,13 @@ There are 2 ways to package backend dependencies. With mix2nix and with a fixed-

 ###### mix2nix {#mix2nix}

-mix2nix is a cli tool available in nixpkgs. it will generate a nix expression from a mix.lock file. It is quite standard in the 2nix tool series.
+`mix2nix` is a cli tool available in nixpkgs. it will generate a nix expression from a mix.lock file. It is quite standard in the 2nix tool series.

 Note that currently mix2nix can't handle git dependencies inside the mix.lock file. If you have git dependencies, you can either add them manually (see [example](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/pleroma/default.nix#L20)) or use the FOD method.

 The advantage of using mix2nix is that nix will know your whole dependency graph. On a dependency update, this won't trigger a full rebuild and download of all the dependencies, where FOD will do so.

-practical steps:
+Practical steps:

 - run `mix2nix > mix_deps.nix` in the upstream repo.
 - pass `mixNixDeps = with pkgs; import ./mix_deps.nix { inherit lib beamPackages; };` as an argument to mixRelease.
--- a/lib/options.nix
+++ b/lib/options.nix
@ -177,7 +177,7 @@ rec {
        docOption = rec {
          loc = opt.loc;
          name = showOption opt.loc;
-          description = opt.description or (lib.warn "Option `${name}' has no description." "This option has no description.");
+          description = opt.description or null;
          declarations = filter (x: x != unknownModule) opt.declarations;
          internal = opt.internal or false;
          visible =
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -952,6 +952,12 @@
    githubId = 59696216;
    name = "Arnold Farkas";
  };
+  arnoutkroeze = {
+    email = "nixpkgs@arnoutkroeze.nl";
+    github = "arnoutkroeze";
+    githubId = 37151054;
+    name = "Arnout Kroeze";
+  };
  arobyn = {
    email = "shados@shados.net";
    github = "shados";
@ -3320,12 +3326,6 @@
    github = "edlimerkaj";
    githubId = 71988351;
  };
-  edibopp = {
-    email = "eduard.bopp@aepsil0n.de";
-    github = "edibopp";
-    githubId = 3098430;
-    name = "Eduard Bopp";
-  };
  emantor = {
    email = "rouven+nixos@czerwinskis.de";
    github = "emantor";
@ -7821,6 +7821,12 @@
    githubId = 38543128;
    name = "Miles Breslin";
  };
+  milibopp = {
+    email = "contact@ebopp.de";
+    github = "milibopp";
+    githubId = 3098430;
+    name = "Emilia Bopp";
+  };
  millerjason = {
    email = "mailings-github@millerjason.com";
    github = "millerjason";
@ -11611,6 +11617,12 @@
    githubId = 2389333;
    name = "Andy Tockman";
  };
+  techknowlogick = {
+    email = "techknowlogick@gitea.io";
+    github = "techknowlogick";
+    githubId = 164197;
+    name = "techknowlogick";
+  };
  Technical27 = {
    email = "38222826+Technical27@users.noreply.github.com";
    github = "Technical27";
@ -12665,6 +12677,12 @@
    email = "tim.williams.public@gmail.com";
    name = "Tim Philip Williams";
  };
+  willcohen = {
+    email = "willcohen@users.noreply.github.com";
+    github = "willcohen";
+    githubId = 5185341;
+    name = "Will Cohen";
+  };
  winden = {
    email = "windenntw@gmail.com";
    name = "Antonio Vargas Gonzalez";
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@ -1,4 +1,13 @@
-{ pkgs, options, config, version, revision, extraSources ? [] }:
+{ pkgs
+, options
+, config
+, version
+, revision
+, extraSources ? []
+, baseOptionsJSON ? null
+, warningsAreErrors ? true
+, prefix ? ../../..
+}:

 with pkgs;

@ -11,11 +20,11 @@ let
  #
  # E.g. if some `options` came from modules in ${pkgs.customModules}/nix,
  # you'd need to include `extraSources = [ pkgs.customModules ]`
-  prefixesToStrip = map (p: "${toString p}/") ([ ../../.. ] ++ extraSources);
+  prefixesToStrip = map (p: "${toString p}/") ([ prefix ] ++ extraSources);
  stripAnyPrefixes = lib.flip (lib.foldr lib.removePrefix) prefixesToStrip;

  optionsDoc = buildPackages.nixosOptionsDoc {
-    inherit options revision;
+    inherit options revision baseOptionsJSON warningsAreErrors;
    transformOptions = opt: opt // {
      # Clean up declaration sites to not refer to the NixOS source tree.
      declarations = map stripAnyPrefixes opt.declarations;
@ -161,7 +170,7 @@ let
 in rec {
  inherit generatedSources;

-  inherit (optionsDoc) optionsJSON optionsDocBook;
+  inherit (optionsDoc) optionsJSON optionsNix optionsDocBook;

  # Generate the NixOS manual.
  manualHTML = runCommand "nixos-manual-html"
--- a/nixos/doc/manual/development/meta-attributes.section.md
+++ b/nixos/doc/manual/development/meta-attributes.section.md
@ -5,7 +5,7 @@ extra information. Module meta attributes are defined in the `meta.nix`
 special module.

 `meta` is a top level attribute like `options` and `config`. Available
-meta-attributes are `maintainers` and `doc`.
+meta-attributes are `maintainers`, `doc`, and `buildDocsInSandbox`.

 Each of the meta-attributes must be defined at most once per module
 file.
@ -24,6 +24,7 @@ file.
  meta = {
    maintainers = with lib.maintainers; [ ericsagnes ];
    doc = ./default.xml;
+    buildDocsInSandbox = true;
  };
 }
 ```
@ -38,3 +39,28 @@ file.
    ```ShellSession
    $ nix-build nixos/release.nix -A manual.x86_64-linux
    ```
+
+-  `buildDocsInSandbox` indicates whether the option documentation for the
+   module can be built in a derivation sandbox. This option is currently only
+   honored for modules shipped by nixpkgs. User modules and modules taken from
+   `NIXOS_EXTRA_MODULE_PATH` are always built outside of the sandbox, as has
+   been the case in previous releases.
+
+   Building NixOS option documentation in a sandbox allows caching of the built
+   documentation, which greatly decreases the amount of time needed to evaluate
+   a system configuration that has NixOS documentation enabled. The sandbox also
+   restricts which attributes may be referenced by documentation attributes
+   (such as option descriptions) to the `options` and `lib` module arguments and
+   the `pkgs.formats` attribute of the `pkgs` argument, `config` and the rest of
+   `pkgs` are disallowed and will cause doc build failures when used. This
+   restriction is necessary because we cannot reproduce the full nixpkgs
+   instantiation with configuration and overlays from a system configuration
+   inside the sandbox. The `options` argument only includes options of modules
+   that are also built inside the sandbox, referencing an option of a module
+   that isn't built in the sandbox is also forbidden.
+
+   The default is `true` and should usually not be changed; set it to `false`
+   only if the module requires access to `pkgs` in its documentation (e.g.
+   because it loads information from a linked package to build an option type)
+   or if its documentation depends on other modules that also aren't sandboxed
+   (e.g. by using types defined in the other module).
--- a/nixos/doc/manual/from_md/development/meta-attributes.section.xml
+++ b/nixos/doc/manual/from_md/development/meta-attributes.section.xml
@ -8,8 +8,8 @@
  <para>
    <literal>meta</literal> is a top level attribute like
    <literal>options</literal> and <literal>config</literal>. Available
-    meta-attributes are <literal>maintainers</literal> and
-    <literal>doc</literal>.
+    meta-attributes are <literal>maintainers</literal>,
+    <literal>doc</literal>, and <literal>buildDocsInSandbox</literal>.
  </para>
  <para>
    Each of the meta-attributes must be defined at most once per module
@ -29,6 +29,7 @@
  meta = {
    maintainers = with lib.maintainers; [ ericsagnes ];
    doc = ./default.xml;
+    buildDocsInSandbox = true;
  };
 }
 </programlisting>
@ -51,5 +52,44 @@
 $ nix-build nixos/release.nix -A manual.x86_64-linux
 </programlisting>
    </listitem>
+    <listitem>
+      <para>
+        <literal>buildDocsInSandbox</literal> indicates whether the
+        option documentation for the module can be built in a derivation
+        sandbox. This option is currently only honored for modules
+        shipped by nixpkgs. User modules and modules taken from
+        <literal>NIXOS_EXTRA_MODULE_PATH</literal> are always built
+        outside of the sandbox, as has been the case in previous
+        releases.
+      </para>
+      <para>
+        Building NixOS option documentation in a sandbox allows caching
+        of the built documentation, which greatly decreases the amount
+        of time needed to evaluate a system configuration that has NixOS
+        documentation enabled. The sandbox also restricts which
+        attributes may be referenced by documentation attributes (such
+        as option descriptions) to the <literal>options</literal> and
+        <literal>lib</literal> module arguments and the
+        <literal>pkgs.formats</literal> attribute of the
+        <literal>pkgs</literal> argument, <literal>config</literal> and
+        the rest of <literal>pkgs</literal> are disallowed and will
+        cause doc build failures when used. This restriction is
+        necessary because we cannot reproduce the full nixpkgs
+        instantiation with configuration and overlays from a system
+        configuration inside the sandbox. The <literal>options</literal>
+        argument only includes options of modules that are also built
+        inside the sandbox, referencing an option of a module that isn’t
+        built in the sandbox is also forbidden.
+      </para>
+      <para>
+        The default is <literal>true</literal> and should usually not be
+        changed; set it to <literal>false</literal> only if the module
+        requires access to <literal>pkgs</literal> in its documentation
+        (e.g. because it loads information from a linked package to
+        build an option type) or if its documentation depends on other
+        modules that also aren’t sandboxed (e.g. by using types defined
+        in the other module).
+      </para>
+    </listitem>
  </itemizedlist>
 </section>
--- a/nixos/lib/eval-cacheable-options.nix
+++ b/nixos/lib/eval-cacheable-options.nix
@ -0,0 +1,53 @@
+{ libPath
+, pkgsLibPath
+, nixosPath
+, modules
+, stateVersion
+, release
+}:
+
+let
+  lib = import libPath;
+  modulesPath = "${nixosPath}/modules";
+  # dummy pkgs set that contains no packages, only `pkgs.lib` from the full set.
+  # not having `pkgs.lib` causes all users of `pkgs.formats` to fail.
+  pkgs = import pkgsLibPath {
+    inherit lib;
+    pkgs = null;
+  };
+  utils = import "${nixosPath}/lib/utils.nix" {
+    inherit config lib;
+    pkgs = null;
+  };
+  # this is used both as a module and as specialArgs.
+  # as a module it sets the _module special values, as specialArgs it makes `config`
+  # unusable. this causes documentation attributes depending on `config` to fail.
+  config = {
+    _module.check = false;
+    _module.args = {};
+    system.stateVersion = stateVersion;
+  };
+  eval = lib.evalModules {
+    modules = (map (m: "${modulesPath}/${m}") modules) ++ [
+      config
+    ];
+    specialArgs = {
+      inherit config pkgs utils;
+    };
+  };
+  docs = import "${nixosPath}/doc/manual" {
+    pkgs = pkgs // {
+      inherit lib;
+      # duplicate of the declaration in all-packages.nix
+      buildPackages.nixosOptionsDoc = attrs:
+        (import "${nixosPath}/lib/make-options-doc")
+          ({ inherit pkgs lib; } // attrs);
+    };
+    config = config.config;
+    options = eval.options;
+    version = release;
+    revision = "release-${release}";
+    prefix = modulesPath;
+  };
+in
+  docs.optionsNix
--- a/nixos/lib/make-options-doc/default.nix
+++ b/nixos/lib/make-options-doc/default.nix
@ -21,6 +21,13 @@
 , options
 , transformOptions ? lib.id  # function for additional tranformations of the options
 , revision ? "" # Specify revision for the options
+# a set of options the docs we are generating will be merged into, as if by recursiveUpdate.
+# used to split the options doc build into a static part (nixos/modules) and a dynamic part
+# (non-nixos modules imported via configuration.nix, other module sources).
+, baseOptionsJSON ? null
+# instead of printing warnings for eg options with missing descriptions (which may be lost
+# by nix build unless -L is given), emit errors instead and fail the build
+, warningsAreErrors ? true
 }:

 let
@ -51,10 +58,15 @@ let
  # ../../../lib/options.nix influences.
  #
  # Each element of `relatedPackages` can be either
-  # - a string:  that will be interpreted as an attribute name from `pkgs`,
-  # - a list:    that will be interpreted as an attribute path from `pkgs`,
-  # - an attrset: that can specify `name`, `path`, `package`, `comment`
+  # - a string:  that will be interpreted as an attribute name from `pkgs` and turned into a link
+  #              to search.nixos.org,
+  # - a list:    that will be interpreted as an attribute path from `pkgs` and turned into a link
+  #              to search.nixos.org,
+  # - an attrset: that can specify `name`, `path`, `comment`
  #   (either of `name`, `path` is required, the rest are optional).
+  #
+  # NOTE: No checks against `pkgs` are made to ensure that the referenced package actually exists.
+  # Such checks are not compatible with option docs caching.
  genRelatedPackages = packages: optName:
    let
      unpack = p: if lib.isString p then { name = p; }
@ -64,16 +76,16 @@ let
        let
          title = args.title or null;
          name = args.name or (lib.concatStringsSep "." args.path);
-          path = args.path or [ args.name ];
-          package = args.package or (lib.attrByPath path (throw "Invalid package attribute path `${toString path}' found while evaluating `relatedPackages' of option `${optName}'") pkgs);
-        in "<listitem>"
-        + "<para><literal>${lib.optionalString (title != null) "${title} aka "}pkgs.${name} (${package.meta.name})</literal>"
-        + lib.optionalString (!package.meta.available) " <emphasis>[UNAVAILABLE]</emphasis>"
-        + ": ${package.meta.description or "???"}.</para>"
-        + lib.optionalString (args ? comment) "\n<para>${args.comment}</para>"
-        # Lots of `longDescription's break DocBook, so we just wrap them into <programlisting>
-        + lib.optionalString (package.meta ? longDescription) "\n<programlisting>${package.meta.longDescription}</programlisting>"
-        + "</listitem>";
+        in ''
+          <listitem>
+            <para>
+              <link xlink:href="https://search.nixos.org/packages?show=${name}&amp;sort=relevance&amp;query=${name}">
+                <literal>${lib.optionalString (title != null) "${title} aka "}pkgs.${name}</literal>
+              </link>
+            </para>
+            ${lib.optionalString (args ? comment) "<para>${args.comment}</para>"}
+          </listitem>
+        '';
    in "<itemizedlist>${lib.concatStringsSep "\n" (map (p: describe (unpack p)) packages)}</itemizedlist>";

  # Remove invisible and internal options.
@ -99,13 +111,24 @@ in rec {
  optionsJSON = pkgs.runCommand "options.json"
    { meta.description = "List of NixOS options in JSON format";
      buildInputs = [ pkgs.brotli ];
+      options = builtins.toFile "options.json"
+        (builtins.unsafeDiscardStringContext (builtins.toJSON optionsNix));
    }
    ''
      # Export list of options in different format.
      dst=$out/share/doc/nixos
      mkdir -p $dst

-      cp ${builtins.toFile "options.json" (builtins.unsafeDiscardStringContext (builtins.toJSON optionsNix))} $dst/options.json
+      ${
+        if baseOptionsJSON == null
+          then "cp $options $dst/options.json"
+          else ''
+            ${pkgs.python3Minimal}/bin/python ${./mergeJSON.py} \
+              ${lib.optionalString warningsAreErrors "--warnings-are-errors"} \
+              ${baseOptionsJSON} $options \
+              > $dst/options.json
+          ''
+      }

      brotli -9 < $dst/options.json > $dst/options.json.br

--- a/nixos/lib/make-options-doc/mergeJSON.py
+++ b/nixos/lib/make-options-doc/mergeJSON.py
@ -0,0 +1,86 @@
+import collections
+import json
+import sys
+from typing import Any, Dict, List
+
+JSON = Dict[str, Any]
+
+class Key:
+    def __init__(self, path: List[str]):
+        self.path = path
+    def __hash__(self):
+        result = 0
+        for id in self.path:
+            result ^= hash(id)
+        return result
+    def __eq__(self, other):
+        return type(self) is type(other) and self.path == other.path
+
+Option = collections.namedtuple('Option', ['name', 'value'])
+
+# pivot a dict of options keyed by their display name to a dict keyed by their path
+def pivot(options: Dict[str, JSON]) -> Dict[Key, Option]:
+    result: Dict[Key, Option] = dict()
+    for (name, opt) in options.items():
+        result[Key(opt['loc'])] = Option(name, opt)
+    return result
+
+# pivot back to indexed-by-full-name
+# like the docbook build we'll just fail if multiple options with differing locs
+# render to the same option name.
+def unpivot(options: Dict[Key, Option]) -> Dict[str, JSON]:
+    result: Dict[str, Dict] = dict()
+    for (key, opt) in options.items():
+        if opt.name in result:
+            raise RuntimeError(
+                'multiple options with colliding ids found',
+                opt.name,
+                result[opt.name]['loc'],
+                opt.value['loc'],
+            )
+        result[opt.name] = opt.value
+    return result
+
+warningsAreErrors = sys.argv[1] == "--warnings-are-errors"
+optOffset = 1 if warningsAreErrors else 0
+options = pivot(json.load(open(sys.argv[1 + optOffset], 'r')))
+overrides = pivot(json.load(open(sys.argv[2 + optOffset], 'r')))
+
+# fix up declaration paths in lazy options, since we don't eval them from a full nixpkgs dir
+for (k, v) in options.items():
+    v.value['declarations'] = list(map(lambda s: f'nixos/modules/{s}', v.value['declarations']))
+
+# merge both descriptions
+for (k, v) in overrides.items():
+    cur = options.setdefault(k, v).value
+    for (ok, ov) in v.value.items():
+        if ok == 'declarations':
+            decls = cur[ok]
+            for d in ov:
+                if d not in decls:
+                    decls += [d]
+        elif ok == "type":
+            # ignore types of placeholder options
+            if ov != "_unspecified" or cur[ok] == "_unspecified":
+                cur[ok] = ov
+        elif ov is not None or cur.get(ok, None) is None:
+            cur[ok] = ov
+
+# check that every option has a description
+hasWarnings = False
+for (k, v) in options.items():
+    if v.value.get('description', None) is None:
+        severity = "error" if warningsAreErrors else "warning"
+        hasWarnings = True
+        print(f"\x1b[1;31m{severity}: option {v.name} has no description\x1b[0m", file=sys.stderr)
+        v.value['description'] = "This option has no description."
+if hasWarnings and warningsAreErrors:
+    print(
+        "\x1b[1;31m" +
+        "Treating warnings as errors. Set documentation.nixos.options.warningsAreErrors " +
+        "to false to ignore these warnings." +
+        "\x1b[0m",
+        file=sys.stderr)
+    sys.exit(1)
+
+json.dump(unpivot(options), fp=sys.stdout)
--- a/nixos/modules/i18n/input-method/fcitx.nix
+++ b/nixos/modules/i18n/input-method/fcitx.nix
@ -40,4 +40,7 @@ in
    };
    services.xserver.displayManager.sessionCommands = "${fcitxPackage}/bin/fcitx";
  };
+
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/i18n/input-method/ibus.nix
+++ b/nixos/modules/i18n/input-method/ibus.nix
@ -80,4 +80,7 @@ in
      ibusPackage
    ];
  };
+
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/i18n/input-method/kime.nix
+++ b/nixos/modules/i18n/input-method/kime.nix
@ -45,5 +45,7 @@ in

    environment.etc."xdg/kime/config.yaml".text = replaceStrings [ "\\\\" ] [ "\\" ] (builtins.toJSON cfg.config);
  };
-}

+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
+}
--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@ -1,19 +1,35 @@
-{ config, lib, pkgs, extendModules, noUserModules, ... }:
+{ config, options, lib, pkgs, utils, modules, baseModules, extraModules, modulesPath, ... }:

 with lib;

 let

  cfg = config.documentation;
+  allOpts = options;

  /* Modules for which to show options even when not imported. */
  extraDocModules = [ ../virtualisation/qemu-vm.nix ];

-  /* For the purpose of generating docs, evaluate options with each derivation
-    in `pkgs` (recursively) replaced by a fake with path "\${pkgs.attribute.path}".
-    It isn't perfect, but it seems to cover a vast majority of use cases.
-    Caveat: even if the package is reached by a different means,
-    the path above will be shown and not e.g. `${config.services.foo.package}`. */
+  canCacheDocs = m:
+    let
+      f = import m;
+      instance = f (mapAttrs (n: _: abort "evaluating ${n} for `meta` failed") (functionArgs f));
+    in
+      cfg.nixos.options.splitBuild
+        && builtins.isPath m
+        && isFunction f
+        && instance ? options
+        && instance.meta.buildDocsInSandbox or true;
+
+  docModules =
+    let
+      p = partition canCacheDocs (baseModules ++ extraDocModules);
+    in
+      {
+        lazy = p.right;
+        eager = p.wrong ++ optionals cfg.nixos.includeAllModules (extraModules ++ modules);
+      };
+
  manual = import ../../doc/manual rec {
    inherit pkgs config;
    version = config.system.nixos.release;
@ -21,10 +37,17 @@ let
    extraSources = cfg.nixos.extraModuleSources;
    options =
      let
-        extendNixOS = if cfg.nixos.includeAllModules then extendModules else noUserModules.extendModules;
-        scrubbedEval = extendNixOS {
-          modules = extraDocModules;
-          specialArgs.pkgs = scrubDerivations "pkgs" pkgs;
+        scrubbedEval = evalModules {
+          modules = [ {
+            _module.check = false;
+          } ] ++ docModules.eager;
+          specialArgs = {
+            pkgs = scrubDerivations "pkgs" pkgs;
+            # allow access to arbitrary options for eager modules, eg for getting
+            # option types from lazy modules
+            options = allOpts;
+            inherit modulesPath utils;
+          };
        };
        scrubDerivations = namePrefix: pkgSet: mapAttrs
          (name: value:
@ -36,6 +59,53 @@ let
          )
          pkgSet;
      in scrubbedEval.options;
+    baseOptionsJSON =
+      let
+        filter =
+          builtins.filterSource
+            (n: t:
+              (t == "directory" -> baseNameOf n != "tests")
+              && (t == "file" -> hasSuffix ".nix" n)
+            );
+        pull = dir:
+          if isStorePath pkgs.path
+          then "${builtins.storePath pkgs.path}/${dir}"
+          else filter "${toString pkgs.path}/${dir}";
+      in
+        pkgs.runCommand "lazy-options.json" {
+          libPath = pull "lib";
+          pkgsLibPath = pull "pkgs/pkgs-lib";
+          nixosPath = pull "nixos";
+          modules = map (p: ''"${removePrefix "${modulesPath}/" (toString p)}"'') docModules.lazy;
+        } ''
+          export NIX_STORE_DIR=$TMPDIR/store
+          export NIX_STATE_DIR=$TMPDIR/state
+          ${pkgs.nix}/bin/nix-instantiate \
+            --show-trace \
+            --eval --json --strict \
+            --argstr libPath "$libPath" \
+            --argstr pkgsLibPath "$pkgsLibPath" \
+            --argstr nixosPath "$nixosPath" \
+            --arg modules "[ $modules ]" \
+            --argstr stateVersion "${options.system.stateVersion.default}" \
+            --argstr release "${config.system.nixos.release}" \
+            $nixosPath/lib/eval-cacheable-options.nix > $out \
+            || {
+              echo -en "\e[1;31m"
+              echo 'Cacheable portion of option doc build failed.'
+              echo 'Usually this means that an option attribute that ends up in documentation (eg' \
+                '`default` or `description`) depends on the restricted module arguments' \
+                '`config` or `pkgs`.'
+              echo
+              echo 'Rebuild your configuration with `--show-trace` to find the offending' \
+                'location. Remove the references to restricted arguments (eg by escaping' \
+                'their antiquotations or adding a `defaultText`) or disable the sandboxed' \
+                'build for the failing module by setting `meta.buildDocsInSandbox = false`.'
+              echo -en "\e[0m"
+              exit 1
+            } >&2
+        '';
+    inherit (cfg.nixos.options) warningsAreErrors;
  };


@ -178,6 +248,25 @@ in
        '';
      };

+      nixos.options.splitBuild = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether to split the option docs build into a cacheable and an uncacheable part.
+          Splitting the build can substantially decrease the amount of time needed to build
+          the manual, but some user modules may be incompatible with this splitting.
+        '';
+      };
+
+      nixos.options.warningsAreErrors = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Treat warning emitted during the option documentation build (eg for missing option
+          descriptions) as errors.
+        '';
+      };
+
      nixos.includeAllModules = mkOption {
        type = types.bool;
        default = false;
--- a/nixos/modules/misc/meta.nix
+++ b/nixos/modules/misc/meta.nix
@ -54,6 +54,21 @@ in
        '';
      };

+      buildDocsInSandbox = mkOption {
+        type = types.bool // {
+          merge = loc: defs: defs;
+        };
+        internal = true;
+        default = true;
+        description = ''
+          Whether to include this module in the split options doc build.
+          Disable if the module references `config`, `pkgs` or other module
+          arguments that cannot be evaluated as constants.
+
+          This option should be defined at most once per module.
+        '';
+      };
+
    };
  };

--- a/nixos/modules/misc/nixpkgs.nix
+++ b/nixos/modules/misc/nixpkgs.nix
@ -248,4 +248,7 @@ in
      )
    ];
  };
+
+  # needs a full nixpkgs path to import nixpkgs
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@ -119,4 +119,6 @@ in

  };

+  # uses version info nixpkgs, which requires a full nixpkgs path
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/programs/gnupg.nix
+++ b/nixos/modules/programs/gnupg.nix
@ -149,4 +149,6 @@ in
    ];
  };

+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/backup/sanoid.nix
+++ b/nixos/modules/services/backup/sanoid.nix
@ -51,7 +51,10 @@ let
  datasetOptions = rec {
    use_template = mkOption {
      description = "Names of the templates to use for this dataset.";
-      type = types.listOf (types.enum (attrNames cfg.templates));
+      type = types.listOf (types.str // {
+        check = (types.enum (attrNames cfg.templates)).check;
+        description = "configured template name";
+      });
      default = [ ];
    };
    useTemplate = use_template;
--- a/nixos/modules/services/cluster/kubernetes/controller-manager.nix
+++ b/nixos/modules/services/cluster/kubernetes/controller-manager.nix
@ -6,6 +6,7 @@ let
  top = config.services.kubernetes;
  otop = options.services.kubernetes;
  cfg = top.controllerManager;
+  klib = options.services.kubernetes.lib.default;
 in
 {
  imports = [
@ -56,7 +57,7 @@ in
      type = int;
    };

-    kubeconfig = top.lib.mkKubeConfigOptions "Kubernetes controller manager";
+    kubeconfig = klib.mkKubeConfigOptions "Kubernetes controller manager";

    leaderElect = mkOption {
      description = "Whether to start leader election before executing main loop.";
@ -129,7 +130,7 @@ in
            "--cluster-cidr=${cfg.clusterCidr}"} \
          ${optionalString (cfg.featureGates != [])
            "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.featureGates}"} \
-          --kubeconfig=${top.lib.mkKubeConfig "kube-controller-manager" cfg.kubeconfig} \
+          --kubeconfig=${klib.mkKubeConfig "kube-controller-manager" cfg.kubeconfig} \
          --leader-elect=${boolToString cfg.leaderElect} \
          ${optionalString (cfg.rootCaFile!=null)
            "--root-ca-file=${cfg.rootCaFile}"} \
@ -156,7 +157,7 @@ in
      path = top.path;
    };

-    services.kubernetes.pki.certs = with top.lib; {
+    services.kubernetes.pki.certs = with klib; {
      controllerManager = mkCert {
        name = "kube-controller-manager";
        CN = "kube-controller-manager";
--- a/nixos/modules/services/cluster/kubernetes/default.nix
+++ b/nixos/modules/services/cluster/kubernetes/default.nix
@ -193,12 +193,17 @@ in {
        inherit mkKubeConfigOptions;
      };
      type = types.attrs;
+      readOnly = true;
+      internal = true;
    };

    secretsPath = mkOption {
      description = "Default location for kubernetes secrets. Not a store location.";
      type = types.path;
      default = cfg.dataDir + "/secrets";
+      defaultText = literalExpression ''
+        config.${opt.dataDir} + "/secrets"
+      '';
    };
  };

--- a/nixos/modules/services/cluster/kubernetes/kubelet.nix
+++ b/nixos/modules/services/cluster/kubernetes/kubelet.nix
@ -6,6 +6,7 @@ let
  top = config.services.kubernetes;
  otop = options.services.kubernetes;
  cfg = top.kubelet;
+  klib = options.services.kubernetes.lib.default;

  cniConfig =
    if cfg.cni.config != [] && cfg.cni.configDir != null then
@ -27,7 +28,7 @@ let
    config.Cmd = ["/bin/pause"];
  };

-  kubeconfig = top.lib.mkKubeConfig "kubelet" cfg.kubeconfig;
+  kubeconfig = klib.mkKubeConfig "kubelet" cfg.kubeconfig;

  manifestPath = "kubernetes/manifests";

@ -177,7 +178,7 @@ in
      type = str;
    };

-    kubeconfig = top.lib.mkKubeConfigOptions "Kubelet";
+    kubeconfig = klib.mkKubeConfigOptions "Kubelet";

    manifests = mkOption {
      description = "List of manifests to bootstrap with kubelet (only pods can be created as manifest entry)";
@ -358,7 +359,7 @@ in
      services.kubernetes.kubelet.hostname = with config.networking;
        mkDefault (hostName + optionalString (domain != null) ".${domain}");

-      services.kubernetes.pki.certs = with top.lib; {
+      services.kubernetes.pki.certs = with klib; {
        kubelet = mkCert {
          name = "kubelet";
          CN = top.kubelet.hostname;
--- a/nixos/modules/services/cluster/kubernetes/pki.nix
+++ b/nixos/modules/services/cluster/kubernetes/pki.nix
@ -1,10 +1,11 @@
-{ config, lib, pkgs, ... }:
+{ config, options, lib, pkgs, ... }:

 with lib;

 let
  top = config.services.kubernetes;
  cfg = top.pki;
+  klib = options.services.kubernetes.lib;

  csrCA = pkgs.writeText "kube-pki-cacert-csr.json" (builtins.toJSON {
    key = {
@ -29,7 +30,7 @@ let
  cfsslAPITokenLength = 32;

  clusterAdminKubeconfig = with cfg.certs.clusterAdmin;
-    top.lib.mkKubeConfig "cluster-admin" {
+    klib.mkKubeConfig "cluster-admin" {
        server = top.apiserverAddress;
        certFile = cert;
        keyFile = key;
@ -250,7 +251,7 @@ in
      # - it would be better with a more Nix-oriented way of managing addons
      systemd.services.kube-addon-manager = mkIf top.addonManager.enable (mkMerge [{
        environment.KUBECONFIG = with cfg.certs.addonManager;
-          top.lib.mkKubeConfig "addon-manager" {
+          klib.mkKubeConfig "addon-manager" {
            server = top.apiserverAddress;
            certFile = cert;
            keyFile = key;
@ -343,7 +344,7 @@ in
      '';

      services.flannel = with cfg.certs.flannelClient; {
-        kubeconfig = top.lib.mkKubeConfig "flannel" {
+        kubeconfig = klib.mkKubeConfig "flannel" {
          server = top.apiserverAddress;
          certFile = cert;
          keyFile = key;
--- a/nixos/modules/services/cluster/kubernetes/proxy.nix
+++ b/nixos/modules/services/cluster/kubernetes/proxy.nix
@ -6,6 +6,7 @@ let
  top = config.services.kubernetes;
  otop = options.services.kubernetes;
  cfg = top.proxy;
+  klib = options.services.kubernetes.lib.default;
 in
 {
  imports = [
@ -43,7 +44,7 @@ in
      type = str;
    };

-    kubeconfig = top.lib.mkKubeConfigOptions "Kubernetes proxy";
+    kubeconfig = klib.mkKubeConfigOptions "Kubernetes proxy";

    verbosity = mkOption {
      description = ''
@ -72,7 +73,7 @@ in
          ${optionalString (cfg.featureGates != [])
            "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.featureGates}"} \
          --hostname-override=${cfg.hostname} \
-          --kubeconfig=${top.lib.mkKubeConfig "kube-proxy" cfg.kubeconfig} \
+          --kubeconfig=${klib.mkKubeConfig "kube-proxy" cfg.kubeconfig} \
          ${optionalString (cfg.verbosity != null) "--v=${toString cfg.verbosity}"} \
          ${cfg.extraOpts}
        '';
@ -88,7 +89,7 @@ in
    services.kubernetes.proxy.hostname = with config.networking; mkDefault hostName;

    services.kubernetes.pki.certs = {
-      kubeProxyClient = top.lib.mkCert {
+      kubeProxyClient = klib.mkCert {
        name = "kube-proxy-client";
        CN = "system:kube-proxy";
        action = "systemctl restart kube-proxy.service";
--- a/nixos/modules/services/cluster/kubernetes/scheduler.nix
+++ b/nixos/modules/services/cluster/kubernetes/scheduler.nix
@ -6,6 +6,7 @@ let
  top = config.services.kubernetes;
  otop = options.services.kubernetes;
  cfg = top.scheduler;
+  klib = options.services.kubernetes.lib.default;
 in
 {
  ###### interface
@ -32,7 +33,7 @@ in
      type = listOf str;
    };

-    kubeconfig = top.lib.mkKubeConfigOptions "Kubernetes scheduler";
+    kubeconfig = klib.mkKubeConfigOptions "Kubernetes scheduler";

    leaderElect = mkOption {
      description = "Whether to start leader election before executing main loop.";
@ -69,7 +70,7 @@ in
          --address=${cfg.address} \
          ${optionalString (cfg.featureGates != [])
            "--feature-gates=${concatMapStringsSep "," (feature: "${feature}=true") cfg.featureGates}"} \
-          --kubeconfig=${top.lib.mkKubeConfig "kube-scheduler" cfg.kubeconfig} \
+          --kubeconfig=${klib.mkKubeConfig "kube-scheduler" cfg.kubeconfig} \
          --leader-elect=${boolToString cfg.leaderElect} \
          --port=${toString cfg.port} \
          ${optionalString (cfg.verbosity != null) "--v=${toString cfg.verbosity}"} \
@ -87,7 +88,7 @@ in
    };

    services.kubernetes.pki.certs = {
-      schedulerClient = top.lib.mkCert {
+      schedulerClient = klib.mkCert {
        name = "kube-scheduler-client";
        CN = "system:kube-scheduler";
        action = "systemctl restart kube-scheduler.service";
--- a/nixos/modules/services/databases/couchdb.nix
+++ b/nixos/modules/services/databases/couchdb.nix
@ -1,9 +1,10 @@
-{ config, lib, pkgs, ... }:
+{ config, options, lib, pkgs, ... }:

 with lib;

 let
  cfg = config.services.couchdb;
+  opt = options.services.couchdb;
  configFile = pkgs.writeText "couchdb.ini" (
    ''
      [couchdb]
@ -153,6 +154,7 @@ in {
      argsFile = mkOption {
        type = types.path;
        default = "${cfg.package}/etc/vm.args";
+        defaultText = literalExpression ''"config.${opt.package}/etc/vm.args"'';
        description = ''
          vm.args configuration. Overrides Couchdb's Erlang VM parameters file.
        '';
--- a/nixos/modules/services/desktops/gvfs.nix
+++ b/nixos/modules/services/desktops/gvfs.nix
@ -54,7 +54,7 @@ in

    systemd.packages = [ cfg.package ];

-    services.udev.packages = [ pkgs.libmtp ];
+    services.udev.packages = [ pkgs.libmtp.out ];

    # Needed for unwrapped applications
    environment.variables.GIO_EXTRA_MODULES = [ "${cfg.package}/lib/gio/modules" ];
--- a/nixos/modules/services/desktops/pipewire/pipewire-media-session.nix
+++ b/nixos/modules/services/desktops/pipewire/pipewire-media-session.nix
@ -29,6 +29,8 @@ in {

  meta = {
    maintainers = teams.freedesktop.members;
+    # uses attributes of the linked package
+    buildDocsInSandbox = false;
  };

  ###### interface
--- a/nixos/modules/services/desktops/pipewire/pipewire.nix
+++ b/nixos/modules/services/desktops/pipewire/pipewire.nix
@ -40,6 +40,8 @@ in {

  meta = {
    maintainers = teams.freedesktop.members;
+    # uses attributes of the linked package
+    buildDocsInSandbox = false;
  };

  ###### interface
--- a/nixos/modules/services/misc/matrix-appservice-irc.nix
+++ b/nixos/modules/services/misc/matrix-appservice-irc.nix
@ -226,4 +226,7 @@ in {
      isSystemUser = true;
    };
  };
+
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/misc/sourcehut/default.nix
+++ b/nixos/modules/services/misc/sourcehut/default.nix
@ -678,7 +678,7 @@ in
                rev = "ff96a0fa5635770390b184ae74debea75c3fd534";
                ref = "nixos-unstable";
            };
-            image_from_nixpkgs = (import ("${pkgs.sourcehut.buildsrht}/lib/images/nixos/image.nix") {
+            image_from_nixpkgs = (import ("''${pkgs.sourcehut.buildsrht}/lib/images/nixos/image.nix") {
              pkgs = (import pkgs_unstable {});
            });
          in
@ -696,6 +696,7 @@ in
      package = mkOption {
        type = types.package;
        default = pkgs.git;
+        defaultText = literalExpression "pkgs.git";
        example = literalExpression "pkgs.gitFull";
        description = ''
          Git package for git.sr.ht. This can help silence collisions.
@ -712,6 +713,7 @@ in
      package = mkOption {
        type = types.package;
        default = pkgs.mercurial;
+        defaultText = literalExpression "pkgs.mercurial";
        description = ''
          Mercurial package for hg.sr.ht. This can help silence collisions.
        '';
--- a/nixos/modules/services/monitoring/prometheus/default.nix
+++ b/nixos/modules/services/monitoring/prometheus/default.nix
@ -251,6 +251,13 @@ let

  promTypes.scrape_config = types.submodule {
    options = {
+      authorization = mkOption {
+        type = types.attrs;
+        default = {};
+        description = ''
+          Sets the `Authorization` header on every scrape request with the configured credentials.
+        '';
+      };
      job_name = mkOption {
        type = types.str;
        description = ''
--- a/nixos/modules/services/networking/dnscrypt-proxy2.nix
+++ b/nixos/modules/services/networking/dnscrypt-proxy2.nix
@ -118,4 +118,7 @@ in
      };
    };
  };
+
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/networking/kea.nix
+++ b/nixos/modules/services/networking/kea.nix
@ -378,4 +378,6 @@ in
  ]);

  meta.maintainers = with maintainers; [ hexa ];
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/networking/searx.nix
+++ b/nixos/modules/services/networking/searx.nix
@ -228,5 +228,4 @@ in
  };

  meta.maintainers = with maintainers; [ rnhmjoj ];
-
 }
--- a/nixos/modules/services/networking/xrdp.nix
+++ b/nixos/modules/services/networking/xrdp.nix
@ -100,6 +100,7 @@ in
      confDir = mkOption {
        type = types.path;
        default = confDir;
+        defaultText = literalDocBook "generated from configuration";
        description = "The location of the config files for xrdp.";
      };
    };
--- a/nixos/modules/services/security/aesmd.nix
+++ b/nixos/modules/services/security/aesmd.nix
@ -1,7 +1,8 @@
-{ config, pkgs, lib, ... }:
+{ config, options, pkgs, lib, ... }:
 with lib;
 let
  cfg = config.services.aesmd;
+  opt = options.services.aesmd;

  sgx-psw = pkgs.sgx-psw.override { inherit (cfg) debug; };

@ -43,6 +44,9 @@ in
        options.proxyType = mkOption {
          type = with types; nullOr (enum [ "default" "direct" "manual" ]);
          default = if (cfg.settings.proxy != null) then "manual" else null;
+          defaultText = literalExpression ''
+            if (config.${opt.settings}.proxy != null) then "manual" else null
+          '';
          example = "default";
          description = ''
            Type of proxy to use. The <literal>default</literal> uses the system's default proxy.
--- a/nixos/modules/services/security/vaultwarden/default.nix
+++ b/nixos/modules/services/security/vaultwarden/default.nix
@ -179,4 +179,7 @@ in {
      wantedBy = [ "multi-user.target" ];
    };
  };
+
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/web-apps/dex.nix
+++ b/nixos/modules/services/web-apps/dex.nix
@ -112,4 +112,7 @@ in
      };
    };
  };
+
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/web-apps/gerrit.nix
+++ b/nixos/modules/services/web-apps/gerrit.nix
@ -237,4 +237,6 @@ in
  };

  meta.maintainers = with lib.maintainers; [ edef zimbatm ];
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/web-apps/jirafeau.nix
+++ b/nixos/modules/services/web-apps/jirafeau.nix
@ -167,4 +167,7 @@ in
      "d ${cfg.dataDir}/async/ 0750 ${user} ${group} - -"
    ];
  };
+
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/web-apps/powerdns-admin.nix
+++ b/nixos/modules/services/web-apps/powerdns-admin.nix
@ -146,4 +146,7 @@ in
      group = "powerdnsadmin";
    };
  };
+
+  # uses attributes of the linked package
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@ -865,4 +865,6 @@ in

  };

+  # uses relatedPackages
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@ -317,4 +317,6 @@ in

  };

+  # uses extendModules to generate a type
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@ -999,4 +999,7 @@ in
      ];

  };
+
+  # uses types of services/x11/xserver.nix
+  meta.buildDocsInSandbox = false;
 }
--- a/nixos/modules/virtualisation/xen-dom0.nix
+++ b/nixos/modules/virtualisation/xen-dom0.nix
@ -450,5 +450,4 @@ in
    };

  };
-
 }
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -281,13 +281,6 @@ in
  mosquitto = handleTest ./mosquitto.nix {};
  mpd = handleTest ./mpd.nix {};
  mpv = handleTest ./mpv.nix {};
-  mtp = let
-    olderQemu = (import (fetchTarball {
-      url = "https://github.com/nixos/nixpkgs/archive/e1fc1a80a071c90ab65fb6eafae5520579163783.tar.gz";
-      sha256 = "19a0qrx31lp2r8cgk9hv4p6j6six6l82qisxr68y7wb7drw7dhkz";
-    }) { inherit system; }).qemu_test;
-    myPkgs = import ../.. { inherit system; overlays = [ (self: super: { qemu_test = olderQemu; }) ]; };
-  in handleTest ./mtp.nix { pkgs = myPkgs; };
  mumble = handleTest ./mumble.nix {};
  musescore = handleTest ./musescore.nix {};
  munin = handleTest ./munin.nix {};
--- a/nixos/tests/mtp.nix
+++ b/nixos/tests/mtp.nix
@ -1,108 +0,0 @@
-import ./make-test-python.nix ({ pkgs, ... }: {
-  name = "mtp";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ matthewcroughan nixinator ];
-  };
-
-  nodes =
-  {
-    client = { config, pkgs, ... }: {
-      # DBUS runs only once a user session is created, which means a user has to
-      # login. Here, we log in as root. Once logged in, the gvfs-daemon service runs
-      # as UID 0 in User-0.service
-      services.getty.autologinUser = "root";
-
-      # XDG_RUNTIME_DIR is needed for running systemd-user services such as
-      # gvfs-daemon as root.
-      environment.variables.XDG_RUNTIME_DIR = "/run/user/0";
-
-      environment.systemPackages = with pkgs; [ usbutils glib jmtpfs tree ];
-      services.gvfs.enable = true;
-
-      # Creates a usb-mtp device inside the VM, which is mapped to the host's
-      # /tmp folder, it is able to write files to this location, but only has
-      # permissions to read its own creations.
-      virtualisation.qemu.options = [
-        "-usb"
-        "-device usb-mtp,rootdir=/tmp,readonly=false"
-      ];
-    };
-  };
-
-
-  testScript = { nodes, ... }:
-    let
-      # Creates a list of QEMU MTP devices matching USB ID (46f4:0004). This
-      # value can be sourced in a shell script. This is so we can loop over the
-      # devices we find, as this test may want to use more than one MTP device
-      # in future.
-      mtpDevices = pkgs.writeScript "mtpDevices.sh" ''
-        export mtpDevices=$(lsusb -d 46f4:0004 | awk {'print $2","$4'} | sed 's/[:-]/ /g')
-      '';
-      # Qemu is only capable of creating an MTP device with Picture Transfer
-      # Protocol. This means that gvfs must use gphoto2:// rather than mtp://
-      # when mounting.
-      # https://github.com/qemu/qemu/blob/970bc16f60937bcfd334f14c614bd4407c247961/hw/usb/dev-mtp.c#L278
-      gvfs = rec {
-        mountAllMtpDevices = pkgs.writeScript "mountAllMtpDevices.sh" ''
-          set -e
-          source ${mtpDevices}
-          for i in $mtpDevices
-          do
-            gio mount "gphoto2://[usb:$i]/"
-          done
-        '';
-        unmountAllMtpDevices = pkgs.writeScript "unmountAllMtpDevices.sh" ''
-          set -e
-          source ${mtpDevices}
-          for i in $mtpDevices
-          do
-            gio mount -u "gphoto2://[usb:$i]/"
-          done
-        '';
-        # gvfsTest:
-        # 1. Creates a 10M test file
-        # 2. Copies it to the device using GIO tools
-        # 3. Checks for corruption with `diff`
-        # 4. Removes the file, then unmounts the disks.
-        gvfsTest = pkgs.writeScript "gvfsTest.sh" ''
-          set -e
-          source ${mtpDevices}
-          ${mountAllMtpDevices}
-          dd if=/dev/urandom of=testFile10M bs=1M count=10
-          for i in $mtpDevices
-          do
-            gio copy ./testFile10M gphoto2://[usb:$i]/
-            ls -lah /run/user/0/gvfs/*/testFile10M
-            gio remove gphoto2://[usb:$i]/testFile10M
-          done
-          ${unmountAllMtpDevices}
-        '';
-      };
-      jmtpfs = {
-        # jmtpfsTest:
-        # 1. Mounts the device on a dir named `phone` using jmtpfs
-        # 2. Puts the current Nixpkgs libmtp version into a file
-        # 3. Checks for corruption with `diff`
-        # 4. Prints the directory tree
-        jmtpfsTest = pkgs.writeScript "jmtpfsTest.sh" ''
-          mkdir phone
-          jmtpfs phone
-          echo "${pkgs.libmtp.version}" > phone/tmp/testFile
-          echo "${pkgs.libmtp.version}" > testFile
-          diff phone/tmp/testFile testFile
-          tree phone
-        '';
-      };
-    in
-    # Using >&2 allows the results of the scripts to be printed to the terminal
-    # when building this test with Nix. Scripts would otherwise complete
-    # silently.
-    ''
-    start_all()
-    client.wait_for_unit("multi-user.target")
-    client.wait_for_unit("dbus.service")
-    client.succeed("${gvfs.gvfsTest} >&2")
-    client.succeed("${jmtpfs.jmtpfsTest} >&2")
-  '';
-})
--- a/nixos/tests/sudo.nix
+++ b/nixos/tests/sudo.nix
@ -73,7 +73,7 @@ in
            machine.fail('su - test1 -c "sudo -n -u root true"')

        with subtest("users in group 'foobar' should be able to use sudo with password"):
-            machine.succeed("sudo -u test2 echo ${password} | sudo -S -u root true")
+            machine.succeed('su - test2 -c "echo ${password} | sudo -S -u root true"')

        with subtest("users in group 'barfoo' should be able to use sudo without password"):
            machine.succeed("sudo -u test3 sudo -n -u root true")
--- a/pkgs/applications/audio/gnome-podcasts/default.nix
+++ b/pkgs/applications/audio/gnome-podcasts/default.nix
@ -21,20 +21,20 @@

 stdenv.mkDerivation rec {
  pname = "gnome-podcasts";
-  version = "0.5.0";
+  version = "0.5.1";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "podcasts";
    rev = version;
-    hash = "sha256-Jk++/QrQt/fjOz2OaEIr1Imq2DmqTjcormCebjO4/Kk=";
+    sha256 = "00vy1qkkpn76jdpybsq9qp8s6fh1ih10j73p2x43sl97m5g8944h";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    hash = "sha256-jlXpeVabc1h2GU1j9Ff6GZJec+JgFyOdJzsOtdkrEWI=";
+    sha256 = "0y34b5rnr75h7dxbx93mafrmwsh187wq5js7fmkb1m1yyybj1v1x";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/mopidy/default.nix
+++ b/pkgs/applications/audio/mopidy/default.nix
@ -21,6 +21,8 @@ lib.makeScope newScope (self: with self; {

  mopidy-mpris = callPackage ./mpris.nix { };

+  mopidy-muse = callPackage ./muse.nix { };
+
  mopidy-musicbox-webclient = callPackage ./musicbox-webclient.nix { };

  mopidy-podcast = callPackage ./podcast.nix { };
--- a/pkgs/applications/audio/mopidy/muse.nix
+++ b/pkgs/applications/audio/mopidy/muse.nix
@ -0,0 +1,29 @@
+{ lib, pythonPackages, mopidy }:
+
+pythonPackages.buildPythonApplication rec {
+  pname = "mopidy-muse";
+  version = "0.0.27";
+
+  src = pythonPackages.fetchPypi {
+    inherit version;
+    pname = "Mopidy-Muse";
+    sha256 = "0jx9dkgxr07avzz9zskzhqy98zsxkdrf7iid2ax5vygwf8qsx8ks";
+  };
+
+  propagatedBuildInputs = [
+    mopidy
+    pythonPackages.pykka
+  ];
+
+  pythonImportsCheck = [ "mopidy_muse" ];
+
+  # has no tests
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Mopidy web client with Snapcast support";
+    homepage = "https://github.com/cristianpb/muse";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ hexa ];
+  };
+}
--- a/pkgs/applications/audio/paprefs/default.nix
+++ b/pkgs/applications/audio/paprefs/default.nix
@ -13,11 +13,11 @@

 stdenv.mkDerivation rec {
  pname = "paprefs";
-  version = "1.1";
+  version = "1.2";

  src = fetchurl {
    url = "https://freedesktop.org/software/pulseaudio/paprefs/paprefs-${version}.tar.xz";
-    sha256 = "189z5p20hk0xv9vwvym293503j4pwl03xqk9hl7cl6dwgv0l7wkf";
+    sha256 = "sha256-s/IeQNw5NtFeP/yRD7DAfBS4jowodxW0VqlIwXY49jM=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/snapcast/default.nix
+++ b/pkgs/applications/audio/snapcast/default.nix
@ -37,13 +37,13 @@ in

 stdenv.mkDerivation rec {
  pname = "snapcast";
-  version = "0.25.0";
+  version = "0.26.0";

  src = fetchFromGitHub {
    owner  = "badaix";
    repo   = "snapcast";
    rev    = "v${version}";
-    sha256 = "064pcpr5dsv9hncqkrnxriva4xjv1vcxhvc69h1an8x8vn4dwgmf";
+    sha256 = "sha256-CCifn9OEFM//Hk1PJj8T3MXIV8pXCTdBBXPsHuZwLyQ=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/applications/blockchains/electrs/default.nix
+++ b/pkgs/applications/blockchains/electrs/default.nix
@ -12,16 +12,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "electrs";
-  version = "0.9.3";
+  version = "0.9.4";

  src = fetchFromGitHub {
    owner = "romanz";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-sTQ/dX1uXJkEmrNZ47qjBlrexO50y0NGNhw71rHc9bw=";
+    hash = "sha256-37KTcLFVzuXlLpz9INXbasUdzuY+T34ef8EtfczQ+D8=";
  };

-  cargoHash = "sha256-1ZQt8LaqgxNxFfgCVCK0GVwbcVfX3v9iz7tHvzgyI0g=";
+  cargoHash = "sha256-aOSCpvejMUfSZCDwShqMPEc3vXw9ri2QvTaCuHODTwA=";

  # needed for librocksdb-sys
  nativeBuildInputs = [ llvmPackages.clang ];
--- a/pkgs/applications/editors/helix/default.nix
+++ b/pkgs/applications/editors/helix/default.nix
@ -2,17 +2,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "helix";
-  version = "0.5.0";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "helix-editor";
    repo = pname;
    rev = "v${version}";
    fetchSubmodules = true;
-    sha256 = "sha256-NoVg/8oJIgMQtxlCSjrLnYCG8shigYqZzWAQwmiqxgA=";
+    sha256 = "sha256-d/USOtcPLjdgzN7TBCouBRmoSDH5LZD4R5Qq7lUrWZw=";
  };

-  cargoSha256 = "sha256-kqPI8WpGpr0VL7CbBTSsjKl3xqJrv/6Qjr6UFnIgaVo=";
+  cargoSha256 = "sha256-/EATU7HsGNB35YOBp8sofbPd1nl4d3Ggj1ay3QuHkCI=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/applications/graphics/pinta/default.nix
+++ b/pkgs/applications/graphics/pinta/default.nix
@ -1,91 +1,87 @@
 { lib
+, buildDotnetModule
+, dotnetCorePackages
 , fetchFromGitHub
-, buildDotnetPackage
-, dotnetPackages
-, gtksharp
-, gettext
+, gtk3
+, installShellFiles
+, librsvg
+, makeDesktopItem
+, wrapGAppsHook
 }:

-let
-  mono-addins = dotnetPackages.MonoAddins;
-in
-buildDotnetPackage rec {
+buildDotnetModule rec {
  pname = "Pinta";
-  version = "1.7.1";
+  version = "2.0";

-  outputFiles = [ "bin/*" ];
-  buildInputs = [ gtksharp mono-addins gettext ];
-  xBuildFiles = [ "Pinta.sln" ];
+  nativeBuildInputs = [
+    installShellFiles
+    wrapGAppsHook
+  ];
+
+  runtimeDeps = [ gtk3 ];
+
+  dotnet-sdk = dotnetCorePackages.sdk_6_0;
+  dotnet-runtime = dotnetCorePackages.runtime_6_0;
+
+  # How-to update deps:
+  # $ nix-build -A pinta.fetch-deps
+  # $ ./result
+  # $ cp /tmp/Pinta-deps.nix ./pkgs/applications/graphics/pinta/default.nix
+  # TODO: create update script
+  nugetDeps = ./deps.nix;
+
+  projectFile = "Pinta";

  src = fetchFromGitHub {
    owner = "PintaProject";
    repo = "Pinta";
    rev = version;
-    sha256 = "sha256-yRp/dpJ9T4DieqHTj3vhyuASPGe4vjHw0rSXFrTNZVc=";
+    sha256 = "sha256-wqqNPyy5h/hTDm2u5MDZx1ds5qWAxy1/BY/fX4PeA88=";
  };

-  # Remove version information from nodes <Reference Include="... Version=... ">
-  postPatch = with lib; let
-    csprojFiles = [
-      "Pinta/Pinta.csproj"
-      "Pinta.Core/Pinta.Core.csproj"
-      "Pinta.Effects/Pinta.Effects.csproj"
-      "Pinta.Gui.Widgets/Pinta.Gui.Widgets.csproj"
-      "Pinta.Resources/Pinta.Resources.csproj"
-      "Pinta.Tools/Pinta.Tools.csproj"
-    ];
-    versionedNames = [
-      "Mono\\.Addins"
-      "Mono\\.Posix"
-      "Mono\\.Addins\\.Gui"
-      "Mono\\.Addins\\.Setup"
-    ];
-
-    stripVersion = name: file:
-      let
-        match = ''<Reference Include="${name}([ ,][^"]*)?"'';
-        replace = ''<Reference Include="${name}"'';
-      in
-      "sed -i -re 's/${match}/${replace}/g' ${file}\n";
-
-    # Map all possible pairs of two lists
-    map2 = f: listA: listB: concatMap (a: map (f a) listB) listA;
-    concatMap2Strings = f: listA: listB: concatStrings (map2 f listA listB);
-  in
-  concatMap2Strings stripVersion versionedNames csprojFiles
-  + ''
-    # For some reason there is no Microsoft.Common.tasks file
-    # in ''${mono}/lib/mono/3.5 .
-    substituteInPlace Pinta.Install.proj \
-      --replace 'ToolsVersion="3.5"' 'ToolsVersion="4.0"' \
-      --replace "/usr/local" "$out"
+  # FIXME: this should be propagated by wrapGAppsHook already, however for some
+  # reason it is not working. Maybe a bug in buildDotnetModule?
+  preInstall = ''
+    gappsWrapperArgs+=(
+      --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}"
+      --set GDK_PIXBUF_MODULE_FILE ${librsvg}/lib/gdk-pixbuf-2.0/2.10.0/loaders.cache
+    )
  '';

-  makeWrapperArgs = [
-    "--prefix MONO_GAC_PREFIX : ${gtksharp}"
-    "--prefix LD_LIBRARY_PATH : ${gtksharp}/lib"
-    "--prefix LD_LIBRARY_PATH : ${gtksharp.gtk.out}/lib"
-  ];
-
  postInstall = ''
-    # Do automake's job manually
-    substitute xdg/pinta.desktop.in xdg/pinta.desktop \
+    # Rename the binary
+    mv $out/bin/Pinta $out/bin/pinta
+
+    # Copy desktop icons
+    for size in 16x16 22x22 24x24 32x32 96x96 scalable; do
+      mkdir -p $out/share/icons/hicolor/$size/apps
+      cp xdg/$size/* $out/share/icons/hicolor/$size/apps/
+    done
+
+    # Copy runtime icons
+    cp -r Pinta.Resources/icons/hicolor/16x16/* $out/share/icons/hicolor/16x16/
+
+    # Install manpage
+    installManPage xdg/pinta.1
+
+    # Fix and copy desktop file
+    # TODO: fix this propely by using the autoreconf+pkg-config build system
+    # from upstream
+    mkdir -p $out/share/applications
+    substitute xdg/pinta.desktop.in $out/share/applications/Pinta.desktop \
      --replace _Name Name \
      --replace _Comment Comment \
      --replace _GenericName GenericName \
-      --replace _X-GNOME-FullName X-GNOME-FullName
-    substitute xdg/pinta.appdata.xml.in xdg/pinta.appdata.xml \
-      --replace _p p
-
-    xbuild /target:CompileTranslations Pinta.Install.proj
-    xbuild /target:Install Pinta.Install.proj
+      --replace _X-GNOME-FullName X-GNOME-FullName \
+      --replace _Keywords Keywords
  '';

  meta = {
    homepage = "https://www.pinta-project.com/";
    description = "Drawing/editing program modeled after Paint.NET";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ ];
+    maintainers = with lib.maintainers; [ thiagokokada ];
    platforms = with lib.platforms; linux;
+    mainProgram = "pinta";
  };
 }
--- a/pkgs/applications/graphics/pinta/deps.nix
+++ b/pkgs/applications/graphics/pinta/deps.nix
@ -0,0 +1,12 @@
+{ fetchNuGet }: [
+  (fetchNuGet { pname = "AtkSharp"; version = "3.24.24.34"; sha256 = "1jn1vgi9xm0jp7769k6sbdi8d273kigjrsh93i6s4c03hqxv7cqs"; })
+  (fetchNuGet { pname = "CairoSharp"; version = "3.24.24.34"; sha256 = "0pydn1k0cam1gclg9sc1sbnmbyzh28qlc5qanyxcylwghink3kgz"; })
+  (fetchNuGet { pname = "GdkSharp"; version = "3.24.24.34"; sha256 = "0r0x0yib7chwsyrbpvicrfwldwqx5lyqq4p86zaxpmzd6zdaj0x5"; })
+  (fetchNuGet { pname = "GioSharp"; version = "3.24.24.34"; sha256 = "02hxvgjd4w9jpzbkk7qf9q9bkvyp5hfzwxfqp10vg5lpl9yl3xpx"; })
+  (fetchNuGet { pname = "GLibSharp"; version = "3.24.24.34"; sha256 = "0kvp033fgdwc8p2abfp5z9pzq66cvwbnjfvr4v4bkpy5s5h181kq"; })
+  (fetchNuGet { pname = "GtkSharp"; version = "3.24.24.34"; sha256 = "0028hzmmqyfx87qqmaf9cgb5psn7gkbmqvixcid67x1d6mzxjicb"; })
+  (fetchNuGet { pname = "NGettext"; version = "0.6.7"; sha256 = "1lnq1lgd80xqn80qwq5ipfjnd7nl1ghinjc3krnd546r0c7hwqky"; })
+  (fetchNuGet { pname = "PangoSharp"; version = "3.24.24.34"; sha256 = "1r0h14cklglfpv1lhv93cxmzi2w7d5s03gzpq3j5dmrz43flg9zw"; })
+  (fetchNuGet { pname = "ParagonClipper"; version = "6.4.2"; sha256 = "0pam44f7iayqjz8nh1x29gxdd4dj00i7m5883cpa64i192pgl94c"; })
+  (fetchNuGet { pname = "SharpZipLib"; version = "1.3.3"; sha256 = "1gij11wfj1mqm10631cjpnhzw882bnzx699jzwhdqakxm1610q8x"; })
+]
--- a/pkgs/applications/misc/free42/default.nix
+++ b/pkgs/applications/misc/free42/default.nix
@ -10,17 +10,24 @@

 stdenv.mkDerivation rec {
  pname = "free42";
-  version = "3.0.8";
+  version = "3.0.9";

  src = fetchFromGitHub {
    owner = "thomasokken";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-nZCuFumAyeUxRmmtd6/qvXk3LVZgbDhlsDygXMWDfp0=";
+    hash = "sha256-ZSwqgHsfe9apyYZ1fkvDMnQxdNb9E8U1l9jvC9t693w=";
  };

-  nativeBuildInputs = [ copyDesktopItems pkg-config ];
-  buildInputs = [ gtk3 alsa-lib ];
+  nativeBuildInputs = [
+    copyDesktopItems
+    pkg-config
+  ];
+
+  buildInputs = [
+    alsa-lib
+    gtk3
+  ];

  postPatch = ''
    sed -i -e "s|/bin/ls|ls|" gtk/Makefile
@ -30,23 +37,24 @@ stdenv.mkDerivation rec {

  buildPhase = ''
    runHook preBuild
+
    make -C gtk cleaner
    make --jobs=$NIX_BUILD_CORES -C gtk
    make -C gtk clean
    make --jobs=$NIX_BUILD_CORES -C gtk BCD_MATH=1
+
    runHook postBuild
  '';

-  preInstall = ''
+  installPhase = ''
+    runHook preInstall
+
    install --directory $out/bin \
                        $out/share/doc/${pname} \
                        $out/share/${pname}/skins \
                        $out/share/icons/hicolor/48x48/apps \
                        $out/share/icons/hicolor/128x128/apps
-  '';

-  installPhase = ''
-    runHook preInstall
    install -m755 gtk/free42dec gtk/free42bin $out/bin
    install -m644 gtk/README $out/share/doc/${pname}/README-GTK
    install -m644 README $out/share/doc/${pname}/README
@ -54,6 +62,7 @@ stdenv.mkDerivation rec {
    install -m644 gtk/icon-48x48.xpm $out/share/icons/hicolor/48x48/apps
    install -m644 gtk/icon-128x128.xpm $out/share/icons/hicolor/128x128/apps
    install -m644 skins/* $out/share/${pname}/skins
+
    runHook postInstall
  '';

--- a/pkgs/applications/misc/mdzk/default.nix
+++ b/pkgs/applications/misc/mdzk/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "mdzk";
-  version = "0.4.3";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "mdzk-rs";
    repo = "mdzk";
    rev = version;
-    sha256 = "sha256-VUvV1XA9Bd3ugYHcKOcAQLUt0etxS/Cw2EgnFGxX0z0=";
+    sha256 = "sha256-NkoKQKcww5ktEbxbOY6WP8OemCB+rvXbuN9oSPjLE3Y=";
  };

-  cargoSha256 = "sha256-lZ4fc/94ESlhpfa5ylg45oZNeaF1mZPxQUSLZrl2V3o=";
+  cargoSha256 = "sha256-uJ00tGiKtcYghFUh0fcYg4nZc/o8yhvlVs+6/aRNY5s=";

  buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];

--- a/pkgs/applications/misc/smos/default.nix
+++ b/pkgs/applications/misc/smos/default.nix
@ -1,27 +0,0 @@
-{ lib, stdenv
-, fetchurl
-, unzip
-}:
-
-stdenv.mkDerivation rec {
-  pname = "smos";
-  version = "0.1.0";
-
-  src = fetchurl {
-    url = "https://github.com/NorfairKing/smos/releases/download/v${version}/smos-release.zip";
-    sha256 = "sha256:07yavk7xl92yjwwjdig90yq421n8ldv4fjfw7izd4hfpzw849a12";
-  };
-
-  dontInstall = true;
-
-  unpackCmd = "${unzip}/bin/unzip -d $out $curSrc";
-  sourceRoot = ".";
-
-  meta = with lib; {
-    description = "A comprehensive self-management system";
-    homepage = "https://smos.online";
-    license = licenses.mit;
-    maintainers = with maintainers; [ norfair ];
-    platforms = platforms.linux ++ platforms.darwin;
-  };
-}
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -1,21 +1,21 @@
 {
  "stable": {
-    "version": "96.0.4664.110",
-    "sha256": "1s3ilq0ik36qgqp7l88gfd1yx97zscn8yr2kprsrjfp9q8lrva9n",
-    "sha256bin64": "17cyj1jx47fz6y26f196xhlngrw5gnjgcvapvgkgswlwd7y67jcb",
+    "version": "97.0.4692.71",
+    "sha256": "0z7ximvm4a78kxyp4j0i2jzklxazpw6jcqi9jkaf8bvq9ga8kqca",
+    "sha256bin64": "1z1d50i5pvqaw6hjdxwasbznzgqwrnd1z8jmy2x05b6i49vd7r9j",
    "deps": {
      "gn": {
-        "version": "2021-09-24",
+        "version": "2021-11-03",
        "url": "https://gn.googlesource.com/gn",
-        "rev": "0153d369bbccc908f4da4993b1ba82728055926a",
-        "sha256": "0y4414h8jqsbz5af6pn91c0vkfp4s281s85g992xfyl785c5zbsi"
+        "rev": "90294ccdcf9334ed25a76ac9b67689468e506342",
+        "sha256": "0n0jml8s00ayy186jzrf207hbz70pxiq426znxwxd4gjcp60scsa"
      }
    },
    "chromedriver": {
-      "version": "96.0.4664.45",
-      "sha256_linux": "15wybxlh38sw7f2bzalf9ivfp8262cpcvhq08nw9d2cj3j39f13m",
-      "sha256_darwin": "0r3b8wgbd8xjb09f4vc402gp77y2aqjk9hpqvvr6xgdr7nqym20f",
-      "sha256_darwin_aarch64": "1yynw8ngs2655blnf1s6r9flbxlwgaybdvgl6r6h7ppl974dl7rm"
+      "version": "97.0.4692.36",
+      "sha256_linux": "11x28m31bsfq1flqrsa5mawss39kznia2ig5ams5qkm2v5p3y39d",
+      "sha256_darwin": "1ysnfvj0795yc3g8sbz7g9mhc5j0sxm2r3ad2fh13sarnhn6wrs4",
+      "sha256_darwin_aarch64": "09m1qpk6901gqs4c7isgryffhb92szfzbxfybxhn2g5i4wrns6j7"
    }
  },
  "beta": {
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
@ -28,7 +28,7 @@ buildGoModule rec {
  meta = with lib; {
    description = "A Helm plugin that shows a diff";
    inherit (src.meta) homepage;
-    license = licenses.apsl20;
+    license = licenses.asl20;
    maintainers = with maintainers; [ yurrriq ];
  };
 }
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-s3.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-s3.nix
@ -31,7 +31,7 @@ buildGoModule rec {
  meta = with lib; {
    description = "A Helm plugin that shows a diff";
    inherit (src.meta) homepage;
-    license = licenses.apsl20;
+    license = licenses.mit;
    maintainers = with maintainers; [ yurrriq ];
  };
 }
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-secrets.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-secrets.nix
@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "A Helm plugin that helps manage secrets";
    inherit (src.meta) homepage;
-    license = licenses.apsl20;
+    license = licenses.asl20;
    maintainers = with maintainers; [ yurrriq ];
    platforms = platforms.all;
  };
--- a/pkgs/applications/networking/cluster/kbst/default.nix
+++ b/pkgs/applications/networking/cluster/kbst/default.nix
@ -34,7 +34,7 @@ buildGoModule rec {
  meta = with lib; {
    description = "Kubestack framework CLI";
    homepage = "https://www.kubestack.com/";
-    license = licenses.apsl20;
+    license = licenses.asl20;
    maintainers = with maintainers; [ mtrsk ];
  };
 }
--- a/pkgs/applications/networking/cluster/terraform-providers/gandi/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/gandi/default.nix
@ -1,21 +1,25 @@
-{ lib, fetchFromGitHub, buildGoPackage }:
-buildGoPackage rec {
+{ lib, fetchFromGitHub, buildGoModule }:
+buildGoModule rec {
  pname = "terraform-provider-gandi";
-  version = "1.0.0";
-
-  goPackagePath = "github.com/tiramiseb/terraform-provider-gandi";
-  goDeps = ./deps.nix;
+  version = "1.1.1";

  src = fetchFromGitHub {
-    owner = "tiramiseb";
+    owner = "go-gandi";
    repo = "terraform-provider-gandi";
    rev = "v${version}";
-    sha256 = "0byydpqsimvnk11bh9iz8zlxbsmsk65w55pvkp18vjzqrhf4kyfv";
+    sha256 = "sha256-PI7cujatzmljyxosGMaqg3Jizee9Py7ffq9gKdehlvo=";
  };

+  vendorSha256 = "sha256-dASIvZ3d7xTYMfvqeTcSJt+kaswGNRNqjHDcgoRVxNk=";
+  deleteVendor = true;
+
+  doCheck = false;
+
+  subPackages = [ "." ];
+
  # Terraform allow checking the provider versions, but this breaks
  # if the versions are not provided via file paths.
-  postBuild = "mv go/bin/terraform-provider-gandi{,_v${version}}";
+  postBuild = "mv $NIX_BUILD_TOP/go/bin/terraform-provider-gandi{,_v${version}}";

  meta = with lib; {
    description = "Terraform provider for the Gandi LiveDNS service.";
--- a/pkgs/applications/networking/cluster/terraform-providers/gandi/deps.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/gandi/deps.nix
@ -1,21 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.2.1
-[
-  {
-    goPackagePath = "github.com/hashicorp/terraform";
-    fetch = {
-      type = "git";
-      url = "https://github.com/hashicorp/terraform";
-      rev = "27b720113ed5143a870ec151b3b7c9d955a09bc0";
-      sha256 = "1f0hwdf2z68p0ll3pgrx949h09q52gcfaxap0zz52m7px98sfab4";
-    };
-  }
-  {
-    goPackagePath = "github.com/tiramiseb/go-gandi-livedns";
-    fetch = {
-      type = "git";
-      url = "https://github.com/tiramiseb/go-gandi-livedns";
-      rev = "4773a84f8ee7365ed21edc6cd0602aaf93e94e59";
-      sha256 = "1i8s7yclrkhf974vs2splh5symzk0ym54px0bc216bq4ifzkwkqc";
-    };
-  }
-]
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -40,10 +40,10 @@
    "owner": "aliyun",
    "provider-source-address": "registry.terraform.io/aliyun/alicloud",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.149.0",
-    "sha256": "0v9jhpvz33hzq09i8bxp1dif9jdypb5g2xy3d2g1mw4lgqrdpjix",
+    "rev": "v1.150.0",
+    "sha256": "16apk8axn2kkbnlvnzcjwf29vmxyhqhp3bx9vdz4ckvk1ajsw4dw",
    "vendorSha256": "18chs2723i2cxhhm649mz52pp6wrfqzxgk12zxq9idrhicchqnzg",
-    "version": "1.149.0"
+    "version": "1.150.0"
  },
  "ansible": {
    "owner": "nbering",
@ -76,10 +76,10 @@
    "owner": "vmware",
    "provider-source-address": "registry.terraform.io/vmware/avi",
    "repo": "terraform-provider-avi",
-    "rev": "v21.1.2",
-    "sha256": "1j96k7yklaxykqj6v1yvxxib2zr2jyx37pkan34jxd8nk43lix67",
-    "vendorSha256": "0pz0n2ijmbhqzvhq41h1hs80yiphwwb0lf3zacifp6rxyv8aawlf",
-    "version": "21.1.2"
+    "rev": "v21.1.3",
+    "sha256": "160l9864p73283hc27qaabd3lrh7lm8fyh6k9xlal5isfd9vrm5p",
+    "vendorSha256": "1hw1xp20nhs4p1q9l887m82456fg5977pm66165gdkczwrq2zr6v",
+    "version": "21.1.3"
  },
  "aviatrix": {
    "owner": "AviatrixSystems",
@ -311,10 +311,10 @@
    "owner": "dome9",
    "provider-source-address": "registry.terraform.io/dome9/dome9",
    "repo": "terraform-provider-dome9",
-    "rev": "v1.24.4",
-    "sha256": "01zvav3r25qbhq1dfxjwmcgyk377cisn1k6406xq66fsyijcf5rw",
+    "rev": "v1.24.5",
+    "sha256": "0a4q5lf11xxfc9ndicdmjir77rdsiq5a8fwb6065879qaamvaxqi",
    "vendorSha256": null,
-    "version": "1.24.4"
+    "version": "1.24.5"
  },
  "elasticsearch": {
    "owner": "phillbaker",
@ -329,10 +329,10 @@
    "owner": "exoscale",
    "provider-source-address": "registry.terraform.io/exoscale/exoscale",
    "repo": "terraform-provider-exoscale",
-    "rev": "v0.31.1",
-    "sha256": "1k6z7mi20ijn3lj734abrbpgcpa6lr5ziacg8h5xr99xs5r9g5yi",
+    "rev": "v0.31.2",
+    "sha256": "1fncpy8vc72g6h560mnkwm160wah8iik4bn12mjgbz3nvjlsm04x",
    "vendorSha256": null,
-    "version": "0.31.1"
+    "version": "0.31.2"
  },
  "external": {
    "owner": "hashicorp",
@ -938,10 +938,10 @@
    "owner": "jianyuan",
    "provider-source-address": "registry.terraform.io/jianyuan/sentry",
    "repo": "terraform-provider-sentry",
-    "rev": "v0.6.0",
-    "sha256": "0246hv52kslrzj43dkbk8r8gimwz3sgzxsbv7sxwmk3ll3sl2zrk",
-    "vendorSha256": "1d4c8cg4a81mndrzwrsi1k9ll553csnb0r4avlq9hyc03z60dwdc",
-    "version": "0.6.0"
+    "rev": "v0.7.0",
+    "sha256": "09rxgq4m28nhwg6y51m5sq3d12lx7r1q3k76zrd5gpbxagqhvhkr",
+    "vendorSha256": "1cpwa8a3p6mixdgvbgim1pnhvqh72sask950w2bxsgrpgdbnys5m",
+    "version": "0.7.0"
  },
  "shell": {
    "owner": "scottwinkler",
--- a/pkgs/applications/networking/cluster/terraform-providers/update-provider
+++ b/pkgs/applications/networking/cluster/terraform-providers/update-provider
@ -149,7 +149,7 @@ if [[ -z ${vendorSha256} ]]; then
    vendorSha256=null
  elif [[ -n ${old_vendor_sha256} || ${vendor} == 1 ]]; then
    echo "=== Calculating vendorSha256 ==="
-    vendorSha256=$(nix-prefetch "{ sha256 }: (import ../../../../.. {}).terraform-providers.${provider_name}.go-modules.overrideAttrs (_: { vendorSha256 = sha256; })")
+    vendorSha256=$(nix-prefetch -I nixpkgs=../../../../.. "{ sha256 }: (import ../../../../.. {}).terraform-providers.${provider_name}.go-modules.overrideAttrs (_: { vendorSha256 = sha256; })")
    # Deal with nix unstable
    if [[ ${vendorSha256} == sha256-* ]]; then
      vendorSha256=$(nix --extra-experimental-features nix-command hash to-base32 "${vendorSha256}")
--- a/pkgs/applications/networking/ftp/gftp/default.nix
+++ b/pkgs/applications/networking/ftp/gftp/default.nix
@ -15,13 +15,13 @@

 stdenv.mkDerivation rec {
  pname = "gftp";
-  version = "2.7.0b";
+  version = "2.8.0b";

  src = fetchFromGitHub {
    owner = "masneyb";
    repo = pname;
    rev = version;
-    hash = "sha256-cIB3SneYKavgdI8eTtM1qsOrBJJ0c7/3CEvNPishNog=";
+    hash = "sha256-syeRFpqbd1VhKhhs/fIByDSVpcY+SAlmikDo3J1ZHlo=";
  };

  nativeBuildInputs = [
@ -32,6 +32,7 @@ stdenv.mkDerivation rec {
    libtool
    pkg-config
  ];
+
  buildInputs = [
    gtk
    ncurses
@ -39,12 +40,12 @@ stdenv.mkDerivation rec {
    readline
  ];

-  hardeningDisable = [ "format" ];
-
  preConfigure = ''
    ./autogen.sh
  '';

+  hardeningDisable = [ "format" ];
+
  meta = with lib; {
    homepage = "https://github.com/masneyb/gftp";
    description = "GTK-based multithreaded FTP client for *nix-based machines";
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@ -48,6 +48,8 @@
 , brotli
 , microsoft_gsl
 , rlottie
+, stdenv
+, gcc10Stdenv
 }:

 # Main reference:
@ -63,10 +65,12 @@ let
      cxxStandard = "17";
    };
  };
+  # Aarch64 default gcc9 will cause ICE. For reference #108305
+  env = if stdenv.isAarch64 then gcc10Stdenv else stdenv;
 in
-mkDerivation rec {
+env.mkDerivation rec {
  pname = "telegram-desktop";
-  version = "3.1.11";
+  version = "3.4.3";
  # Note: Update via pkgs/applications/networking/instant-messengers/telegram/tdesktop/update.py

  # Telegram-Desktop with submodules
@ -75,7 +79,7 @@ mkDerivation rec {
    repo = "tdesktop";
    rev = "v${version}";
    fetchSubmodules = true;
-    sha256 = "0hpcsraw3gx37wk3r88q51qf68ny0kb3kd6slnklwf22d1jqr3fn";
+    sha256 = "0w8llqc4ffhp4gkvk6cyxah16yxm15am0msg3qn39fi2qqnm01x8";
  };

  postPatch = ''
@ -154,6 +158,8 @@ mkDerivation rec {
    "-DTDESKTOP_API_HASH=d524b414d21f4d37f08684c1df41ac9c"
    # See: https://github.com/NixOS/nixpkgs/pull/130827#issuecomment-885212649
    "-DDESKTOP_APP_USE_PACKAGED_FONTS=OFF"
+    # TODO: Remove once QT6 is available in nixpkgs
+    "-DDESKTOP_APP_QT6=OFF"
  ];

  postFixup = ''
--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/tg_owt.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation {
  pname = "tg_owt";
-  version = "unstable-2021-10-21";
+  version = "unstable-2021-12-22";

  src = fetchFromGitHub {
    owner = "desktop-app";
    repo = "tg_owt";
-    rev = "d578c760dc6f1ae5f0f3bb5317b0b2ed04b79138";
-    sha256 = "12lr50nma3j9df55sxi6p48yhn9yxrwzz5yrx7r29p8p4fv1c75w";
+    rev = "6708e0d31a73e64fe12f54829bf4060c41b2658e";
+    sha256 = "081ylw8vp8c84x3f1xx1kia6k1sds2iza9fm5dvn3ccgjwxdm5ny";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/networking/irc/kirc/default.nix
+++ b/pkgs/applications/networking/irc/kirc/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "kirc";
-  version = "0.2.7";
+  version = "0.2.9";

  src = fetchFromGitHub {
    owner = "mcpcpc";
    repo = pname;
    rev = version;
-    hash = "sha256-iaqj4xB15DB3w/RaiCOMdAu8eONhTw1Dz0j5kykAHV4=";
+    hash = "sha256-KRCVjz59SHjk86VgfGxYKk/Ti3o77dV7fdRu9mB3FSo=";
  };

  dontConfigure = true;
--- a/pkgs/applications/office/pyspread/default.nix
+++ b/pkgs/applications/office/pyspread/default.nix
@ -1,31 +1,22 @@
 { lib
-, python3
-, fetchpatch
+, copyDesktopItems
 , makeDesktopItem
+, python3
 , qtsvg
 , wrapQtAppsHook
 }:

 python3.pkgs.buildPythonApplication rec {
  pname = "pyspread";
-  version = "1.99.6";
+  version = "2.0.2";

  src = python3.pkgs.fetchPypi {
    inherit pname version;
-    sha256 = "sha256-B1oyWUAXn63mmVFN9brJwbHxi7I5nYrK2JJU1DjAlb8=";
+    hash = "sha256-rg2T9Y9FU2a+aWg0XM8jyQB9t8zDVlpad3TjUcx4//8=";
  };

-  patches = [
-    # https://gitlab.com/pyspread/pyspread/-/merge_requests/34
-    (fetchpatch {
-      name = "entry-points.patch";
-      url = "https://gitlab.com/pyspread/pyspread/-/commit/3d8da6a7a7d76f7027d77ca95fac103961d729a2.patch";
-      excludes = [ "bin/pyspread" "bin/pyspread.bat" ];
-      sha256 = "1l614k7agv339hrin23jj7s1mq576vkdfkdim6wp224k7y37bnil";
-    })
-  ];
-
  nativeBuildInputs = [
+    copyDesktopItems
    wrapQtAppsHook
  ];

@ -47,19 +38,17 @@ python3.pkgs.buildPythonApplication rec {

  pythonImportsCheck = [ "pyspread" ];

-  desktopItem = makeDesktopItem rec {
-    name = pname;
-    exec = name;
-    icon = name;
-    desktopName = "Pyspread";
-    genericName = "Spreadsheet";
-    comment = meta.description;
-    categories = "Office;Development;Spreadsheet;";
-  };
-
-  postInstall = ''
-    install -m 444 -Dt $out/share/applications ${desktopItem}/share/applications/*
-  '';
+  desktopItems = [
+    (makeDesktopItem rec {
+      name = pname;
+      exec = name;
+      icon = name;
+      desktopName = "Pyspread";
+      genericName = "Spreadsheet";
+      comment = meta.description;
+      categories = "Office;Development;Spreadsheet;";
+    })
+  ];

  preFixup = ''
    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
--- a/pkgs/applications/science/astronomy/astrolog/default.nix
+++ b/pkgs/applications/science/astronomy/astrolog/default.nix
@ -1,4 +1,8 @@
-{ lib, stdenv, fetchzip, fetchurl, xorg, gnused }:
+{ lib, stdenv, fetchzip, fetchurl, xorg, gnused
+, withBigAtlas ? true
+, withEphemeris ? true
+, withMoonsEphemeris ? true
+}:
 stdenv.mkDerivation rec {
  pname = "astrolog";
  version = "7.30";
@ -23,15 +27,30 @@ stdenv.mkDerivation rec {
      sha256 = "1mwvpvfk3lxjcc79zvwl4ypqzgqzipnc01cjldxrmx56xkc35zn7";
      stripRoot = false;
    };
+    moonsEphemeris = fetchzip {
+      url = "https://www.astrolog.org/ftp/ephem/moons/sepm.zip";
+      sha256 = "0labcidm8mrwvww93nwpp5738m9ff9q48cqzbgd18xny1jf6f8xd";
+      stripRoot = false;
+    };
    atlas = fetchurl {
      url = "http://astrolog.org/ftp/atlas/atlasbig.as";
-      sha256 = "1k8cy8gpcvkwkhyz248qhvrv5xiwp1n1s3b7rlz86krh7vzz01mp";
+      sha256 = "001bmqyldsbk4bdliqfl4a9ydrh1ff13wccvfniwaxlmvkridx2q";
    };
  in ''
    mkdir -p $out/bin $out/astrolog
-    cp -r ${ephemeris}/*.se1 $out/astrolog
    cp *.as $out/astrolog
    install astrolog $out/bin
+    ${lib.optionalString withBigAtlas "cp ${atlas} $out/astrolog/atlas.as"}
+    ${lib.optionalString withEphemeris ''
+      sed -i "/-Yi1/s#\".*\"#\"$out/ephemeris\"#" $out/astrolog/astrolog.as
+      mkdir -p $out/ephemeris
+      cp -r ${ephemeris}/*.se1 $out/ephemeris
+    ''}
+    ${lib.optionalString withMoonsEphemeris ''
+      sed -i "/-Yi1/s#\".*\"#\"$out/ephemeris\"#" $out/astrolog/astrolog.as
+      mkdir -p $out/ephemeris
+      cp -r ${moonsEphemeris}/*.se1 $out/ephemeris
+    ''}
  '';

  meta = with lib; {
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "lean";
-  version = "3.35.1";
+  version = "3.36.0";

  src = fetchFromGitHub {
    owner  = "leanprover-community";
@ -11,8 +11,8 @@ stdenv.mkDerivation rec {
    # from. this is then used to check whether an olean file should be
    # rebuilt. don't use a tag as rev because this will get replaced into
    # src/githash.h.in in preConfigure.
-    rev    = "4887d8a30621941c883f208e151e61ab268c006d";
-    sha256 = "0xmiysmq80dnzq1lw9jmprc85kfimw0sl8m5rbi05z8f782gzv1z";
+    rev    = "e948149d3d1bbdb8eac9cd103d58626a59fae3b9";
+    sha256 = "1lcjif29lfj3myc6j63ifk8fdvylyv8g82g2dv0d85nz7mpbq47b";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/video/celluloid/default.nix
+++ b/pkgs/applications/video/celluloid/default.nix
@ -4,48 +4,50 @@
 , appstream-glib
 , desktop-file-utils
 , libepoxy
-, gettext
 , glib
-, gtk3
+, gtk4
+, wayland
 , meson
 , mpv
 , ninja
 , nix-update-script
 , pkg-config
 , python3
-, wrapGAppsHook
+, wrapGAppsHook4
 }:

 stdenv.mkDerivation rec {
  pname = "celluloid";
-  version = "0.21";
+  version = "0.22";

  src = fetchFromGitHub {
    owner = "celluloid-player";
    repo = "celluloid";
    rev = "v${version}";
-    hash = "sha256-1Jeg1uqWxURGKR/Xg4j4roZ9Pg5MR7geyttdzlOU+rA=";
+    hash = "sha256-QGN8YLtyb9YVNDK2ZDQwHJVg6UTIQssfNK9lQqxMNKQ=";
  };

  nativeBuildInputs = [
    appstream-glib
    desktop-file-utils
-    gettext
    meson
    ninja
    pkg-config
    python3
-    wrapGAppsHook
+    wrapGAppsHook4
  ];
  buildInputs = [
    libepoxy
    glib
-    gtk3
+    gtk4
+    wayland
    mpv
  ];

  postPatch = ''
    patchShebangs meson-post-install.py src/generate-authors.py
+    # Remove this for next release
+    substituteInPlace meson-post-install.py --replace "gtk-update-icon-cache" "gtk4-update-icon-cache"
  '';

  doCheck = true;
--- a/pkgs/applications/video/mpv/scripts/mpvacious.nix
+++ b/pkgs/applications/video/mpv/scripts/mpvacious.nix
@ -1,19 +1,29 @@
-{ lib, stdenvNoCC, fetchFromGitHub, curl, xclip }:
+{ lib
+, stdenvNoCC
+, fetchFromGitHub
+, curl
+, wl-clipboard
+, xclip
+}:

 stdenvNoCC.mkDerivation rec {
  pname = "mpvacious";
-  version = "0.14";
+  version = "0.15";

  src = fetchFromGitHub {
    owner = "Ajatt-Tools";
    repo = "mpvacious";
    rev = "v${version}";
-    sha256 = "0r031hh3hpim9dli15m9q4cwka4ljvwg0hdgyp36r1n097q44r5f";
+    sha256 = "1lxlgbjk4x3skg5s7kkr9llcdlmpmabfrcslwhhz5f4j3bq7498w";
  };

  postPatch = ''
+    # 'require' replaced with 'dofile' to work around
+    # https://github.com/mpv-player/mpv/issues/7399 until fixed in mpvacious
    substituteInPlace subs2srs.lua \
+      --replace "require('osd_styler')" "dofile('"$out/share/mpv/scripts/mpvacious/osd_styler.lua"')" \
      --replace "'curl'" "'${curl}/bin/curl'" \
+      --replace "'wl-copy'" "'${wl-clipboard}/bin/wl-copy'" \
      --replace "xclip" "${xclip}/bin/xclip"
  '';

@ -21,12 +31,12 @@ stdenvNoCC.mkDerivation rec {

  installPhase = ''
    runHook preInstall
-    mkdir -p $out/share/mpv/scripts
-    cp subs2srs.lua $out/share/mpv/scripts
+    mkdir -p $out/share/mpv/scripts/mpvacious
+    cp *.lua $out/share/mpv/scripts/mpvacious
    runHook postInstall
  '';

-  passthru.scriptName = "subs2srs.lua";
+  passthru.scriptName = "mpvacious/subs2srs.lua";

  meta = with lib; {
    description = "Adds mpv keybindings to create Anki cards from movies and TV shows";
--- a/pkgs/applications/video/plex-mpv-shim/default.nix
+++ b/pkgs/applications/video/plex-mpv-shim/default.nix
@ -2,13 +2,13 @@

 buildPythonApplication rec {
  pname = "plex-mpv-shim";
-  version = "1.10.1";
+  version = "1.10.3";

  src = fetchFromGitHub {
    owner = "iwalton3";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1ql7idkm916f1wlkqxqmq1i2pc94gbgq6pvb8szhb21icyy5d1y0";
+    sha256 = "0hgv9g17dkrh3zbsx27n80yvkgix9j2x0rgg6d3qsf7hp5j3xw4r";
  };

  propagatedBuildInputs = [ mpv requests python-mpv-jsonipc ];
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -283,6 +283,7 @@ stdenv.mkDerivation rec {
    homepage = "http://www.qemu.org/";
    description = "A generic and open source machine emulator and virtualizer";
    license = licenses.gpl2Plus;
+    mainProgram = "qemu-kvm";
    maintainers = with maintainers; [ eelco qyliss ];
    platforms = platforms.unix;
  };
--- a/pkgs/build-support/go/garble.nix
+++ b/pkgs/build-support/go/garble.nix
@ -30,5 +30,6 @@ buildGoModule rec {
    homepage = "https://github.com/burrowers/garble/";
    maintainers = with lib.maintainers; [ davhau ];
    license = lib.licenses.bsd3;
+    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/garble.x86_64-darwin
  };
 }
--- a/pkgs/desktops/enlightenment/enlightenment/default.nix
+++ b/pkgs/desktops/enlightenment/enlightenment/default.nix
@ -21,11 +21,11 @@

 stdenv.mkDerivation rec {
  pname = "enlightenment";
-  version = "0.25.0";
+  version = "0.25.1";

  src = fetchurl {
    url = "http://download.enlightenment.org/rel/apps/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "01nzyvjy06043m01fdb1309xx3wxxg0s3hj9g9di7jjsxp774vkx";
+    sha256 = "0i1424vsc929h36hx04646pbrjiya6nc1nqr6s15xwvfv7imzw1c";
  };

  nativeBuildInputs = [
--- a/pkgs/desktops/gnome/extensions/arcmenu/default.nix
+++ b/pkgs/desktops/gnome/extensions/arcmenu/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "gnome-shell-extension-arcmenu";
-  version = "19";
+  version = "20";

  src = fetchFromGitLab {
    owner = "arcmenu";
    repo = "ArcMenu";
    rev = "v${version}";
-    sha256 = "sha256-GEeONrrH00Tt9tuxhH7Gv5lSZ2D/hFgeGbUstqJsWZo=";
+    sha256 = "sha256-HjhOZfXld0gnKOAazT8qbI0Jdq6NY/FsrhzAY9uxxMg=";
  };

  patches = [
--- a/pkgs/desktops/lxqt/lxqt-config/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-config/default.nix
@ -13,6 +13,7 @@
 , libkscreen
 , liblxqt
 , libqtxdg
+, xkeyboard_config
 , xorg
 , lxqtUpdateScript
 }:
@ -57,6 +58,10 @@ mkDerivation rec {
    substituteInPlace lxqt-config-appearance/configothertoolkits.cpp \
      --replace 'QStringLiteral("gsettings' \
                'QStringLiteral("${glib.bin}/bin/gsettings'
+
+    substituteInPlace lxqt-config-input/keyboardlayoutconfig.h \
+      --replace '/usr/share/X11/xkb/rules/base.lst' \
+                '${xkeyboard_config}/share/X11/xkb/rules/base.lst'
  '';

  passthru.updateScript = lxqtUpdateScript { inherit pname version src; };
--- a/pkgs/development/compilers/xa/xa.nix
+++ b/pkgs/development/compilers/xa/xa.nix
@ -6,14 +6,14 @@

 stdenv.mkDerivation rec {
  pname = "xa";
-  version = "2.3.11";
+  version = "2.3.12";

  src = fetchurl {
    urls = [
      "https://www.floodgap.com/retrotech/xa/dists/${pname}-${version}.tar.gz"
      "https://www.floodgap.com/retrotech/xa/dists/unsupported/${pname}-${version}.tar.gz"
    ];
-    hash = "sha256-MvIWTJnjBSGOmSlwhW3Y4jCbXLasR1jXsq/jv+vJAS0=";
+    hash = "sha256-+P0VNgEtZ2/Gy/zdapF5PlZMibbvdH+NuPRnwXj7BwQ=";
  };

  checkInputs = [ perl ];
--- a/pkgs/development/interpreters/clojure/obb.nix
+++ b/pkgs/development/interpreters/clojure/obb.nix
@ -0,0 +1,79 @@
+{ lib
+, stdenv
+, fetchurl
+, babashka
+, cacert
+, clojure
+, git
+, jdk
+, callPackage
+, makeWrapper
+, runCommand }:
+
+stdenv.mkDerivation rec {
+  pname = "obb";
+  version = "0.0.1";
+
+  src = fetchurl {
+    url = "https://github.com/babashka/${pname}/archive/refs/tags/v${version}.tar.gz";
+    sha256 = "sha256-ZVd3VCJ7vdQGQ7iY5v2b+gRX/Ni0/03hzqBElqpPvpI=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildInputs = [ babashka cacert git jdk ];
+
+  configurePhase = ''
+    runHook preConfigure
+
+    mkdir -p .m2
+    substituteInPlace deps.edn --replace ':paths' ':mvn/local-repo "./.m2" :paths'
+    substituteInPlace bb.edn --replace ':paths' ':mvn/local-repo "./.m2" :paths'
+    echo deps.edn
+
+    runHook postConfigure
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    export DEPS_CLJ_TOOLS_DIR=${clojure}
+    export DEPS_CLJ_TOOLS_VERSION=${clojure.version}
+    mkdir -p .gitlibs
+    mkdir -p .cpcache
+    export GITLIBS=.gitlibs
+    export CLJ_CACHE=.cpcache
+
+    bb build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    ln -s /usr/bin/osascript $out/bin/osascript
+
+    install -Dm755 "out/bin/obb" "$out/bin/obb"
+    wrapProgram $out/bin/obb --prefix PATH : $out/bin
+
+    runHook postInstall
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    [ $($out/bin/obb -e '(+ 1 2)') = '3' ]
+  '';
+
+
+  meta = with lib; {
+    description = "Ad-hoc ClojureScript scripting of Mac applications via Apple's Open Scripting Architecture";
+    homepage = "https://github.com/babashka/obb";
+    license = licenses.epl10;
+    maintainers = with maintainers; [
+      willcohen
+    ];
+    platforms = platforms.darwin;
+  };
+}
--- a/pkgs/development/interpreters/dart/default.nix
+++ b/pkgs/development/interpreters/dart/default.nix
@ -56,7 +56,7 @@ stdenv.mkDerivation {

  meta = with lib; {
    homepage = "https://www.dartlang.org/";
-    maintainers = with maintainers; [ grburst thiagokokada flexagoon ];
+    maintainers = with maintainers; [ grburst flexagoon ];
    description = "Scalable programming language, with robust libraries and runtimes, for building web, server, and mobile apps";
    longDescription = ''
      Dart is a class-based, single inheritance, object-oriented language
--- a/pkgs/development/libraries/audio/roc-toolkit/default.nix
+++ b/pkgs/development/libraries/audio/roc-toolkit/default.nix
@ -0,0 +1,63 @@
+{ stdenv,
+  lib,
+  fetchFromGitHub,
+  sconsPackages,
+  ragel,
+  gengetopt,
+  pkg-config,
+  libuv,
+  openfecSupport ? true,
+  openfec,
+  libunwindSupport ? true,
+  libunwind,
+  pulseaudioSupport ? true,
+  libpulseaudio
+}:
+
+stdenv.mkDerivation rec {
+  pname = "roc-toolkit";
+  version = "0.1.5";
+
+  src = fetchFromGitHub {
+    owner = "roc-streaming";
+    repo = "roc-toolkit";
+    rev = "v${version}";
+    sha256 = "sha256:1pld340zfch4p3qaf5anrspq7vmxrgf9ddsdsq92pk49axaaz19w";
+  };
+
+  nativeBuildInputs = [
+    sconsPackages.scons_3_0_1
+    ragel
+    gengetopt
+    pkg-config
+  ];
+
+  buildInputs = [
+    libuv
+    libunwind
+    openfec
+    libpulseaudio
+  ];
+
+  sconsFlags =
+    [ "--disable-sox"
+      "--disable-tests" ] ++
+    lib.optional (!libunwindSupport) "--disable-libunwind" ++
+    lib.optional (!pulseaudioSupport) "--disable-pulseaudio" ++
+    (if (!openfecSupport)
+       then ["--disable-openfec"]
+       else [ "--with-libraries=${openfec}/lib"
+              "--with-openfec-includes=${openfec.dev}/include" ]);
+
+  preConfigure = ''
+    sconsFlags+=" --prefix=$out"
+  '';
+
+  meta = with lib; {
+    description = "Roc is a toolkit for real-time audio streaming over the network";
+    homepage = "https://github.com/roc-streaming/roc-toolkit";
+    license = licenses.mpl20;
+    maintainers = with maintainers; [ bgamari ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/development/libraries/cimg/default.nix
+++ b/pkgs/development/libraries/cimg/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "cimg";
-  version = "2.9.9";
+  version = "3.0.0";

  src = fetchFromGitHub {
    owner = "dtschump";
    repo = "CImg";
    rev = "v.${version}";
-    hash = "sha256-DWyqVN7v+j2XCArv4jmrD45XKWMNhd2DddJHH3gQWQY=";
+    hash = "sha256-dC4VuWTz0uyFxLjBQ+2ggndHaCErcoI7tJMfkqbWmeg=";
  };

  outputs = [ "out" "doc" ];
@ -21,8 +21,8 @@ stdenv.mkDerivation rec {

    install -dm 755 $out/include/CImg/plugins $doc/share/doc/cimg/examples
    install -m 644 CImg.h $out/include/
-    cp -dr --no-preserve=ownership examples/* $doc/share/doc/cimg/examples/
    cp -dr --no-preserve=ownership plugins/* $out/include/CImg/plugins/
+    cp -dr --no-preserve=ownership examples/* $doc/share/doc/cimg/examples/
    cp README.txt $doc/share/doc/cimg/

    runHook postInstall
--- a/pkgs/development/libraries/intel-media-sdk/default.nix
+++ b/pkgs/development/libraries/intel-media-sdk/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "intel-media-sdk";
-  version = "21.4.3";
+  version = "22.1.0";

  src = fetchFromGitHub {
    owner = "Intel-Media-SDK";
    repo = "MediaSDK";
    rev = "intel-mediasdk-${version}";
-    sha256 = "sha256-Z6wIwgcKa+EaqSmbD//pYzGjDezASNWGnLCROiRvACo=";
+    sha256 = "sha256-iISG947MUWVVAxykFwB5UK5Z4uQnEWJ6AFr/ZlHx4Nw=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/development/libraries/libfprint/default.nix
+++ b/pkgs/development/libraries/libfprint/default.nix
@ -19,7 +19,7 @@

 stdenv.mkDerivation rec {
  pname = "libfprint";
-  version = "1.92.1";
+  version = "1.94.1";
  outputs = [ "out" "devdoc" ];

  src = fetchFromGitLab {
@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
    owner = "libfprint";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0dpwzmwl9jjpaz44znvy3v8s9sln0c71b756rs1knk0zx8sa1qbc";
+    sha256 = "sha256-xFmby1x2TRZqXrV9Einqu3002qMAN5tQga2mIAHfC9c=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/openfec/default.nix
+++ b/pkgs/development/libraries/openfec/default.nix
@ -0,0 +1,40 @@
+{ stdenv, lib, fetchzip, cmake }:
+
+stdenv.mkDerivation rec {
+  pname = "openfec";
+  version = "1.4.2";
+
+  src = fetchzip {
+    url = "http://openfec.org/files/openfec_v1_4_2.tgz";
+    sha256 = "sha256:0c2lg8afr7lqpzrsi0g44a6h6s7nq4vz7yc9vm2k57ph2y6r86la";
+  };
+
+  outputs = [ "out" "dev" ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  cmakeFlags = [ "-DDEBUG:STRING=OFF" ];
+
+  installPhase =
+    let so = stdenv.hostPlatform.extensions.sharedLibrary;
+    in ''
+      # This is pretty horrible but sadly there is not installation procedure
+      # provided.
+      mkdir -p $dev/include
+      cp -R ../src/* $dev/include
+      find $dev/include -type f -a ! -iname '*.h' -delete
+
+      install -D -m755 -t $out/lib ../bin/Release/libopenfec${so}
+      ln -s libopenfec${so} $out/lib/libopenfec${so}.1
+    '';
+
+  meta = with lib; {
+    description = "Application-level Forward Erasure Correction codes";
+    homepage = "https://github.com/roc-streaming/openfec";
+    license = licenses.cecill-c;
+    maintainers = with maintainers; [ bgamari ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@ -54,6 +54,8 @@
 , libpulseaudio
 , zeroconfSupport ? true
 , avahi
+, rocSupport ? true
+, roc-toolkit
 }:

 let
@ -134,7 +136,8 @@ let
    ++ lib.optional ffmpegSupport ffmpeg
    ++ lib.optionals bluezSupport [ bluez libfreeaptx ldacbt sbc fdk_aac ]
    ++ lib.optional pulseTunnelSupport libpulseaudio
-    ++ lib.optional zeroconfSupport avahi;
+    ++ lib.optional zeroconfSupport avahi
+    ++ lib.optional rocSupport roc-toolkit;

    # Valgrind binary is required for running one optional test.
    checkInputs = lib.optional withValgrind valgrind;
@ -147,7 +150,7 @@ let
      "-Dpipewire_pulse_prefix=${placeholder "pulse"}"
      "-Dlibjack-path=${placeholder "jack"}/lib"
      "-Dlibcamera=${mesonEnable libcameraSupport}"
-      "-Droc=disabled"
+      "-Droc=${mesonEnable rocSupport}"
      "-Dlibpulse=${mesonEnable pulseTunnelSupport}"
      "-Davahi=${mesonEnable zeroconfSupport}"
      "-Dgstreamer=${mesonEnable gstreamerSupport}"
--- a/pkgs/development/libraries/proj/default.nix
+++ b/pkgs/development/libraries/proj/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , pkg-config
 , sqlite
@ -12,23 +11,15 @@

 stdenv.mkDerivation rec {
  pname = "proj";
-  version = "8.2.0";
+  version = "8.2.1";

  src = fetchFromGitHub {
    owner = "OSGeo";
    repo = "PROJ";
    rev = version;
-    sha256 = "sha256-YXZ3txBWW5vUcdYLISJPxdFGCQpKi1vvJlX8rntujg8=";
+    hash = "sha256-tnaIqYKgYHY1Tg33jsKYn9QL8YUobgXKbQsodoCXNys=";
  };

-  patches = [
-    (fetchpatch {
-      name = "Make-CApi-test-cross-platform.patch";
-      url = "https://github.com/OSGeo/PROJ/commit/ac113a8898cded7f5359f1edd3abc17a78eee9b4.patch";
-      sha256 = "0gz2xa5nxzck5c0yr7cspv3kw4cz3fxb2yic76w7qfvxidi7z1s1";
-    })
-  ];
-
  outputs = [ "out" "dev"];

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/development/libraries/xalanc/default.nix
+++ b/pkgs/development/libraries/xalanc/default.nix
@ -1,35 +1,17 @@
-{ lib, stdenv, fetchurl, xercesc, getopt }:
+{ lib, stdenv, fetchFromGitHub, xercesc, getopt, cmake }:

-let
-  platform = if stdenv.isLinux then "linux" else
-             if stdenv.isDarwin then "macosx" else
-             throw "Unsupported platform";
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
  pname = "xalan-c";
-  version = "1.11";
+  version = "1.12.0";

-  src = fetchurl {
-    url = "mirror://apache/xalan/xalan-c/sources/xalan_c-${version}-src.tar.gz";
-    sha256 = "0a3a2b15vpacnqgpp6fiy1pwyc8q6ywzvyb5445f6wixfdspypjg";
+  src = fetchFromGitHub {
+    owner = "apache";
+    repo = "xalan-c";
+    rev = "Xalan-C_1_12_0";
+    sha256 = "sha256:0q1204qk97i9h14vxxq7phcfpyiin0i1zzk74ixvg4wqy87b62s8";
  };

-  configurePhase = ''
-    export XALANCROOT=`pwd`/c
-    cd `pwd`/c
-    mkdir -p $out
-    ./runConfigure -p ${platform} -c cc -x c++ -P$out
-  '';
-
-  buildInputs = [ xercesc getopt ];
-
-  # Parallel build fails as:
-  #   c++ ... -c ... ExecutionContext.cpp
-  #   ProblemListenerBase.hpp:28:10: fatal error: LocalMsgIndex.hpp: No such file or directory
-  # The build failure happens due to missing intra-project dependencies
-  # against generated headers. Future 1.12 version dropped
-  # autotools-based build system. Let's disable parallel builds until
-  # next release.
-  enableParallelBuilding = false;
+  buildInputs = [ xercesc getopt cmake ];

  meta = {
    homepage = "https://xalan.apache.org/";
--- a/pkgs/development/libraries/xed/default.nix
+++ b/pkgs/development/libraries/xed/default.nix
@ -39,7 +39,7 @@ in stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Intel X86 Encoder Decoder (Intel XED)";
    homepage    = "https://intelxed.github.io/";
-    license     = licenses.apsl20;
+    license     = licenses.asl20;
    platforms   = platforms.unix;
    maintainers = with maintainers; [ arturcygan ];
  };
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@ -6,13 +6,13 @@

 buildPythonPackage rec {
  pname = "adafruit-platformdetect";
-  version = "3.18.0";
+  version = "3.19.1";
  format = "setuptools";

  src = fetchPypi {
    pname = "Adafruit-PlatformDetect";
    inherit version;
-    sha256 = "593f3719580b31b3dffab0817414a3aa548ed609659ad216ceb8cf31cc51ec9b";
+    sha256 = "sha256-mJ121SSoO7v2p+qCF5Va5+ppHQsHcFuyJDpyc6lykRI=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/alot/default.nix
+++ b/pkgs/development/python-modules/alot/default.nix
@ -66,6 +66,6 @@ buildPythonPackage rec {
    description = "Terminal MUA using notmuch mail";
    license = licenses.gpl3Plus;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ edibopp ];
+    maintainers = with maintainers; [ milibopp ];
  };
 }
--- a/pkgs/development/python-modules/capstone/default.nix
+++ b/pkgs/development/python-modules/capstone/default.nix
@ -10,7 +10,7 @@ buildPythonPackage rec {
  version = lib.getVersion capstone;

  src = capstone.src;
-  sourceRoot = "${capstone.name}/bindings/python";
+  sourceRoot = "source/bindings/python";

  postPatch = ''
    ln -s ${capstone}/lib/libcapstone${stdenv.targetPlatform.extensions.sharedLibrary} prebuilt/
--- a/Show More
+++ b/Show More