Merge branch 'staging-next' into staging

; Conflicts: ; nixos/doc/manual/from_md/release-notes/rl-2205.section.xml ; nixos/doc/manual/release-notes/rl-2205.section.md
2021-12-31 15:32:37 +01:00 · 2021-12-31 15:32:37 +01:00 · d995596052
commit d995596052
parent 36839cd87b 77da198145
225 changed files with 2368 additions and 2127 deletions
--- a/doc/contributing/submitting-changes.chapter.md
+++ b/doc/contributing/submitting-changes.chapter.md
@ -246,11 +246,21 @@ If the branch is already in a broken state, please refrain from adding extra new

 ### Stable release branches {#submitting-changes-stable-release-branches}

-For cherry-picking a commit to a stable release branch (“backporting”), use `git cherry-pick -x <original commit>` so that the original commit id is included in the commit.
+The same staging workflow applies to stable release branches, but the main branch is called `release-*` instead of `master`.

-Add a reason for the backport by using `git cherry-pick -xe <original commit>` instead when it is not obvious from the original commit message. It is not needed when it's a minor version update that includes security and bug fixes but don't add new features or when the commit fixes an otherwise broken package.
+Example branch names: `release-21.11`, `staging-21.11`, `staging-next-21.11`.

-For backporting Pull Requests to stable branches, assign label `backport <branch>` to the original Pull Requests and automation should take care of the rest once the Pull Requests is merged.
+Most changes added to the stable release branches are cherry-picked (“backported”) from the `master` and staging branches.
+
+#### Automatically backporting a Pull Request {#submitting-changes-stable-release-branches-automatic-backports}
+
+Assign label `backport <branch>` (e.g. `backport release-21.11`) to the PR and a backport PR is automatically created after the PR is merged.
+
+#### Manually backporting changes {#submitting-changes-stable-release-branches-manual-backports}
+
+Cherry-pick changes via `git cherry-pick -x <original commit>` so that the original commit id is included in the commit message.
+
+Add a reason for the backport when it is not obvious from the original commit message. You can do this by cherry picking with `git cherry-pick -xe <original commit>`, which allows editing the commit message. This is not needed for minor version updates that include security and bug fixes but don't add new features or when the commit fixes an otherwise broken package.

 Here is an example of a cherry-picked commit message with good reason description:

--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -103,6 +103,12 @@
          new versions will release.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>services.kubernetes.addons.dashboard</literal> was
+          removed due to it being an outdated version.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The <literal>wafHook</literal> hook now honors
@ -163,6 +169,20 @@
          ~100MB for python itself).
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>documentation.man</literal> has been refactored to
+          support choosing a man implementation other than GNU’s
+          <literal>man-db</literal>. For this,
+          <literal>documentation.man.manualPages</literal> has been
+          renamed to
+          <literal>documentation.man.man-db.manualPages</literal>. If
+          you want to use the new alternative man implementation
+          <literal>mandoc</literal>, add
+          <literal>documentation.man = { enable = true; man-db.enable = false; mandoc.enable = true; }</literal>
+          to your configuration.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The iputils package, which is installed by default, no longer
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -41,6 +41,8 @@ In addition to numerous new and upgraded packages, this release has the followin
  org-contrib, refer to the ones in `pkgs.emacsPackages.elpaPackages` and
  `pkgs.emacsPackages.nongnuPackages` where the new versions will release.

+- `services.kubernetes.addons.dashboard` was removed due to it being an outdated version.
+
 - The `wafHook` hook now honors `NIX_BUILD_CORES` when `enableParallelBuilding` is not set explicitly. Packages can restore the old behaviour by setting `enableParallelBuilding=false`.

 - `pkgs.claws-mail-gtk2`, representing Claws Mail's older release version three, was removed in order to get rid of Python 2.
@ -60,6 +62,8 @@ In addition to numerous new and upgraded packages, this release has the followin
  This has the added benefit to reduce the closure size of `ipython` from ~400MB to ~160MB
  (including ~100MB for python itself).

+- `documentation.man` has been refactored to support choosing a man implementation other than GNU's `man-db`. For this, `documentation.man.manualPages` has been renamed to `documentation.man.man-db.manualPages`. If you want to use the new alternative man implementation `mandoc`, add `documentation.man = { enable = true; man-db.enable = false; mandoc.enable = true; }` to your configuration.
+
 - The iputils package, which is installed by default, no longer provides the
  legacy tools `tftpd` and `traceroute6`. More tools (`ninfod`, `rarpd`, and
  `rdisc`) are going to be removed in the next release. See
--- a/nixos/modules/misc/documentation.nix
+++ b/nixos/modules/misc/documentation.nix
@ -74,10 +74,6 @@ let
      ];
    };

-  # list of man outputs currently active intended for use as default values
-  # for man-related options, thus "man" is included unconditionally.
-  activeManOutputs = [ "man" ] ++ lib.optionals cfg.dev.enable [ "devman" ];
-
 in

 {
@ -107,8 +103,8 @@ in
        type = types.bool;
        default = true;
        description = ''
-          Whether to install manual pages and the <command>man</command> command.
-          This also includes "man" outputs.
+          Whether to install manual pages.
+          This also includes <literal>man</literal> outputs.
        '';
      };

@ -116,27 +112,18 @@ in
        type = types.bool;
        default = false;
        description = ''
-          Whether to generate the manual page index caches using
-          <literal>mandb(8)</literal>. This allows searching for a page or
-          keyword using utilities like <literal>apropos(1)</literal>.
-        '';
-      };
-
-      man.manualPages = mkOption {
-        type = types.path;
-        default = pkgs.buildEnv {
-          name = "man-paths";
-          paths = config.environment.systemPackages;
-          pathsToLink = [ "/share/man" ];
-          extraOutputsToInstall = activeManOutputs;
-          ignoreCollisions = true;
-        };
-        defaultText = literalDocBook "all man pages in <option>config.environment.systemPackages</option>";
-        description = ''
-          The manual pages to generate caches for if <option>generateCaches</option>
-          is enabled. Must be a path to a directory with man pages under
-          <literal>/share/man</literal>; see the source for an example.
-          Advanced users can make this a content-addressed derivation to save a few rebuilds.
+          Whether to generate the manual page index caches.
+          This allows searching for a page or
+          keyword using utilities like
+          <citerefentry>
+            <refentrytitle>apropos</refentrytitle>
+            <manvolnum>1</manvolnum>
+          </citerefentry>
+          and the <literal>-k</literal> option of
+          <citerefentry>
+            <refentrytitle>man</refentrytitle>
+            <manvolnum>1</manvolnum>
+          </citerefentry>.
        '';
      };

@ -220,30 +207,22 @@ in
  };

  config = mkIf cfg.enable (mkMerge [
-
-    (mkIf cfg.man.enable {
-      environment.systemPackages = [ pkgs.man-db ];
-      environment.pathsToLink = [ "/share/man" ];
-      environment.extraOutputsToInstall = activeManOutputs;
-      environment.etc."man_db.conf".text =
-        let
-          manualCache = pkgs.runCommandLocal "man-cache" { } ''
-            echo "MANDB_MAP ${cfg.man.manualPages}/share/man $out" > man.conf
-            ${pkgs.man-db}/bin/mandb -C man.conf -psc >/dev/null 2>&1
+    {
+      assertions = [
+        {
+          assertion = !(cfg.man.man-db.enable && cfg.man.mandoc.enable);
+          message = ''
+            man-db and mandoc can't be used as the default man page viewer at the same time!
          '';
-        in
-        ''
-          # Manual pages paths for NixOS
-          MANPATH_MAP /run/current-system/sw/bin /run/current-system/sw/share/man
-          MANPATH_MAP /run/wrappers/bin          /run/current-system/sw/share/man
+        }
+      ];
+    }

-          ${optionalString cfg.man.generateCaches ''
-          # Generated manual pages cache for NixOS (immutable)
-          MANDB_MAP /run/current-system/sw/share/man ${manualCache}
-          ''}
-          # Manual pages caches for NixOS
-          MANDB_MAP /run/current-system/sw/share/man /var/cache/man/nixos
-        '';
+    # The actual implementation for this lives in man-db.nix or mandoc.nix,
+    # depending on which backend is active.
+    (mkIf cfg.man.enable {
+      environment.pathsToLink = [ "/share/man" ];
+      environment.extraOutputsToInstall = [ "man" ] ++ optional cfg.dev.enable "devman";
    })

    (mkIf cfg.info.enable {
--- a/nixos/modules/misc/man-db.nix
+++ b/nixos/modules/misc/man-db.nix
@ -0,0 +1,73 @@
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.documentation.man.man-db;
+in
+
+{
+  options = {
+    documentation.man.man-db = {
+      enable = lib.mkEnableOption "man-db as the default man page viewer" // {
+        default = config.documentation.man.enable;
+        defaultText = lib.literalExpression "config.documentation.man.enable";
+        example = false;
+      };
+
+      manualPages = lib.mkOption {
+        type = lib.types.path;
+        default = pkgs.buildEnv {
+          name = "man-paths";
+          paths = config.environment.systemPackages;
+          pathsToLink = [ "/share/man" ];
+          extraOutputsToInstall = [ "man" ]
+            ++ lib.optionals config.documentation.dev.enable [ "devman" ];
+          ignoreCollisions = true;
+        };
+        defaultText = lib.literalDocBook "all man pages in <option>config.environment.systemPackages</option>";
+        description = ''
+          The manual pages to generate caches for if <option>documentation.man.generateCaches</option>
+          is enabled. Must be a path to a directory with man pages under
+          <literal>/share/man</literal>; see the source for an example.
+          Advanced users can make this a content-addressed derivation to save a few rebuilds.
+        '';
+      };
+
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.man-db;
+        defaultText = lib.literalExpression "pkgs.man-db";
+        description = ''
+          The <literal>man-db</literal> derivation to use. Useful to override
+          configuration options used for the package.
+        '';
+      };
+    };
+  };
+
+  imports = [
+    (lib.mkRenamedOptionModule [ "documentation" "man" "manualPages" ] [ "documentation" "man" "man-db" "manualPages" ])
+  ];
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    environment.etc."man_db.conf".text =
+      let
+        manualCache = pkgs.runCommandLocal "man-cache" { } ''
+          echo "MANDB_MAP ${cfg.manualPages}/share/man $out" > man.conf
+          ${cfg.package}/bin/mandb -C man.conf -psc >/dev/null 2>&1
+        '';
+      in
+      ''
+        # Manual pages paths for NixOS
+        MANPATH_MAP /run/current-system/sw/bin /run/current-system/sw/share/man
+        MANPATH_MAP /run/wrappers/bin          /run/current-system/sw/share/man
+
+        ${lib.optionalString config.documentation.man.generateCaches ''
+        # Generated manual pages cache for NixOS (immutable)
+        MANDB_MAP /run/current-system/sw/share/man ${manualCache}
+        ''}
+        # Manual pages caches for NixOS
+        MANDB_MAP /run/current-system/sw/share/man /var/cache/man/nixos
+      '';
+  };
+}
--- a/nixos/modules/misc/mandoc.nix
+++ b/nixos/modules/misc/mandoc.nix
@ -0,0 +1,61 @@
+{ config, lib, pkgs, ... }:
+
+let
+  makewhatis = "${lib.getBin cfg.package}/bin/makewhatis";
+
+  cfg = config.documentation.man.mandoc;
+
+in {
+  meta.maintainers = [ lib.maintainers.sternenseemann ];
+
+  options = {
+    documentation.man.mandoc = {
+      enable = lib.mkEnableOption "mandoc as the default man page viewer";
+
+      manPath = lib.mkOption {
+        type = with lib.types; listOf str;
+        default = [ "share/man" ];
+        example = lib.literalExpression "[ \"share/man\" \"share/man/fr\" ]";
+        description = ''
+          Change the manpath, i. e. the directories where
+          <citerefentry><refentrytitle>man</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+          looks for section-specific directories of man pages.
+          You only need to change this setting if you want extra man pages
+          (e. g. in non-english languages). All values must be strings that
+          are a valid path from the target prefix (without including it).
+          The first value given takes priority.
+        '';
+      };
+
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.mandoc;
+        defaultText = lib.literalExpression "pkgs.mandoc";
+        description = ''
+          The <literal>mandoc</literal> derivation to use. Useful to override
+          configuration options used for the package.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment = {
+      systemPackages = [ cfg.package ];
+
+      # tell mandoc about man pages
+      etc."man.conf".text = lib.concatMapStrings (path: ''
+        manpath /run/current-system/sw/${path}
+      '') cfg.manPath;
+
+      # create mandoc.db for whatis(1), apropos(1) and man(1) -k
+      # TODO(@sternenseemman): fix symlinked directories not getting indexed,
+      # see: https://inbox.vuxu.org/mandoc-tech/20210906171231.GF83680@athene.usta.de/T/#e85f773c1781e3fef85562b2794f9cad7b2909a3c
+      extraSetup = lib.mkIf config.documentation.man.generateCaches ''
+        ${makewhatis} -T utf8 ${
+          lib.concatMapStringsSep " " (path: "\"$out/${path}\"") cfg.manPath
+        }
+      '';
+    };
+  };
+}
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -108,6 +108,8 @@
  ./misc/lib.nix
  ./misc/label.nix
  ./misc/locate.nix
+  ./misc/man-db.nix
+  ./misc/mandoc.nix
  ./misc/meta.nix
  ./misc/nixpkgs.nix
  ./misc/passthru.nix
@ -296,7 +298,6 @@
  ./services/cluster/hadoop/default.nix
  ./services/cluster/k3s/default.nix
  ./services/cluster/kubernetes/addons/dns.nix
-  ./services/cluster/kubernetes/addons/dashboard.nix
  ./services/cluster/kubernetes/addon-manager.nix
  ./services/cluster/kubernetes/apiserver.nix
  ./services/cluster/kubernetes/controller-manager.nix
--- a/nixos/modules/services/cluster/kubernetes/addon-manager.nix
+++ b/nixos/modules/services/cluster/kubernetes/addon-manager.nix
@ -58,7 +58,7 @@ in
            "spec" = { ... };
          };
        }
-        // import <nixpkgs/nixos/modules/services/cluster/kubernetes/dashboard.nix> { cfg = config.services.kubernetes; };
+        // import <nixpkgs/nixos/modules/services/cluster/kubernetes/dns.nix> { cfg = config.services.kubernetes; };
      '';
    };

--- a/nixos/modules/services/cluster/kubernetes/addons/dashboard.nix
+++ b/nixos/modules/services/cluster/kubernetes/addons/dashboard.nix
@ -1,344 +0,0 @@
-{ config, options, pkgs, lib, ... }:
-
-with lib;
-
-let
-  cfg = config.services.kubernetes.addons.dashboard;
-  opt = options.services.kubernetes.addons.dashboard;
-in {
-  imports = [
-    (mkRenamedOptionModule [ "services" "kubernetes" "addons" "dashboard" "enableRBAC" ] [ "services" "kubernetes" "addons" "dashboard" "rbac" "enable" ])
-  ];
-
-  options.services.kubernetes.addons.dashboard = {
-    enable = mkEnableOption "kubernetes dashboard addon";
-
-    extraArgs = mkOption {
-      description = "Extra arguments to append to the dashboard cmdline";
-      type = types.listOf types.str;
-      default = [];
-      example = ["--enable-skip-login"];
-    };
-
-    rbac = mkOption {
-      description = "Role-based access control (RBAC) options";
-      default = {};
-      type = types.submodule {
-        options = {
-          enable = mkOption {
-            description = "Whether to enable role based access control is enabled for kubernetes dashboard";
-            type = types.bool;
-            default = elem "RBAC" config.services.kubernetes.apiserver.authorizationMode;
-            defaultText = literalExpression ''
-              elem "RBAC" config.${options.services.kubernetes.apiserver.authorizationMode}
-            '';
-          };
-
-          clusterAdmin = mkOption {
-            description = "Whether to assign cluster admin rights to the kubernetes dashboard";
-            type = types.bool;
-            default = false;
-          };
-        };
-      };
-    };
-
-    version = mkOption {
-      description = "Which version of the kubernetes dashboard to deploy";
-      type = types.str;
-      default = "v1.10.1";
-    };
-
-    image = mkOption {
-      description = "Docker image to seed for the kubernetes dashboard container.";
-      type = types.attrs;
-      default = {
-        imageName = "k8s.gcr.io/kubernetes-dashboard-amd64";
-        imageDigest = "sha256:0ae6b69432e78069c5ce2bcde0fe409c5c4d6f0f4d9cd50a17974fea38898747";
-        finalImageTag = cfg.version;
-        sha256 = "01xrr4pwgr2hcjrjsi3d14ifpzdfbxzqpzxbk2fkbjb9zkv38zxy";
-      };
-      defaultText = literalExpression ''
-        {
-          imageName = "k8s.gcr.io/kubernetes-dashboard-amd64";
-          imageDigest = "sha256:0ae6b69432e78069c5ce2bcde0fe409c5c4d6f0f4d9cd50a17974fea38898747";
-          finalImageTag = config.${opt.version};
-          sha256 = "01xrr4pwgr2hcjrjsi3d14ifpzdfbxzqpzxbk2fkbjb9zkv38zxy";
-        };
-      '';
-    };
-  };
-
-  config = mkIf cfg.enable {
-    services.kubernetes.kubelet.seedDockerImages = [(pkgs.dockerTools.pullImage cfg.image)];
-
-    services.kubernetes.addonManager.addons = {
-      kubernetes-dashboard-deployment = {
-        kind = "Deployment";
-        apiVersion = "apps/v1";
-        metadata = {
-          labels = {
-            k8s-addon = "kubernetes-dashboard.addons.k8s.io";
-            k8s-app = "kubernetes-dashboard";
-            version = cfg.version;
-            "kubernetes.io/cluster-service" = "true";
-            "addonmanager.kubernetes.io/mode" = "Reconcile";
-          };
-          name = "kubernetes-dashboard";
-          namespace = "kube-system";
-        };
-        spec = {
-          replicas = 1;
-          revisionHistoryLimit = 10;
-          selector.matchLabels.k8s-app = "kubernetes-dashboard";
-          template = {
-            metadata = {
-              labels = {
-                k8s-addon = "kubernetes-dashboard.addons.k8s.io";
-                k8s-app = "kubernetes-dashboard";
-                version = cfg.version;
-                "kubernetes.io/cluster-service" = "true";
-              };
-              annotations = {
-                "scheduler.alpha.kubernetes.io/critical-pod" = "";
-              };
-            };
-            spec = {
-              priorityClassName = "system-cluster-critical";
-              containers = [{
-                name = "kubernetes-dashboard";
-                image = with cfg.image; "${imageName}:${finalImageTag}";
-                ports = [{
-                  containerPort = 8443;
-                  protocol = "TCP";
-                }];
-                resources = {
-                  limits = {
-                    cpu = "100m";
-                    memory = "300Mi";
-                  };
-                  requests = {
-                    cpu = "100m";
-                    memory = "100Mi";
-                  };
-                };
-                args = ["--auto-generate-certificates"] ++ cfg.extraArgs;
-                volumeMounts = [{
-                  name = "tmp-volume";
-                  mountPath = "/tmp";
-                } {
-                  name = "kubernetes-dashboard-certs";
-                  mountPath = "/certs";
-                }];
-                livenessProbe = {
-                  httpGet = {
-                    scheme = "HTTPS";
-                    path = "/";
-                    port = 8443;
-                  };
-                  initialDelaySeconds = 30;
-                  timeoutSeconds = 30;
-                };
-              }];
-              volumes = [{
-                name = "kubernetes-dashboard-certs";
-                secret = {
-                  secretName = "kubernetes-dashboard-certs";
-                };
-              } {
-                name = "tmp-volume";
-                emptyDir = {};
-              }];
-              serviceAccountName = "kubernetes-dashboard";
-              tolerations = [{
-                key = "node-role.kubernetes.io/master";
-                effect = "NoSchedule";
-              } {
-                key = "CriticalAddonsOnly";
-                operator = "Exists";
-              }];
-            };
-          };
-        };
-      };
-
-      kubernetes-dashboard-svc = {
-        apiVersion = "v1";
-        kind = "Service";
-        metadata = {
-          labels = {
-            k8s-addon = "kubernetes-dashboard.addons.k8s.io";
-            k8s-app = "kubernetes-dashboard";
-            "kubernetes.io/cluster-service" = "true";
-            "kubernetes.io/name" = "KubeDashboard";
-            "addonmanager.kubernetes.io/mode" = "Reconcile";
-          };
-          name = "kubernetes-dashboard";
-          namespace  = "kube-system";
-        };
-        spec = {
-          ports = [{
-            port = 443;
-            targetPort = 8443;
-          }];
-          selector.k8s-app = "kubernetes-dashboard";
-        };
-      };
-
-      kubernetes-dashboard-sa = {
-        apiVersion = "v1";
-        kind = "ServiceAccount";
-        metadata = {
-          labels = {
-            k8s-app = "kubernetes-dashboard";
-            k8s-addon = "kubernetes-dashboard.addons.k8s.io";
-            "addonmanager.kubernetes.io/mode" = "Reconcile";
-          };
-          name = "kubernetes-dashboard";
-          namespace = "kube-system";
-        };
-      };
-      kubernetes-dashboard-sec-certs = {
-        apiVersion = "v1";
-        kind = "Secret";
-        metadata = {
-          labels = {
-            k8s-app = "kubernetes-dashboard";
-            # Allows editing resource and makes sure it is created first.
-            "addonmanager.kubernetes.io/mode" = "EnsureExists";
-          };
-          name = "kubernetes-dashboard-certs";
-          namespace = "kube-system";
-        };
-        type = "Opaque";
-      };
-      kubernetes-dashboard-sec-kholder = {
-        apiVersion = "v1";
-        kind = "Secret";
-        metadata = {
-          labels = {
-            k8s-app = "kubernetes-dashboard";
-            # Allows editing resource and makes sure it is created first.
-            "addonmanager.kubernetes.io/mode" = "EnsureExists";
-          };
-          name = "kubernetes-dashboard-key-holder";
-          namespace = "kube-system";
-        };
-        type = "Opaque";
-      };
-      kubernetes-dashboard-cm = {
-        apiVersion = "v1";
-        kind = "ConfigMap";
-        metadata = {
-          labels = {
-            k8s-app = "kubernetes-dashboard";
-            # Allows editing resource and makes sure it is created first.
-            "addonmanager.kubernetes.io/mode" = "EnsureExists";
-          };
-          name = "kubernetes-dashboard-settings";
-          namespace = "kube-system";
-        };
-      };
-    } // (optionalAttrs cfg.rbac.enable
-      (let
-        subjects = [{
-          kind = "ServiceAccount";
-          name = "kubernetes-dashboard";
-          namespace = "kube-system";
-        }];
-        labels = {
-          k8s-app = "kubernetes-dashboard";
-          k8s-addon = "kubernetes-dashboard.addons.k8s.io";
-          "addonmanager.kubernetes.io/mode" = "Reconcile";
-        };
-      in
-        (if cfg.rbac.clusterAdmin then {
-          kubernetes-dashboard-crb = {
-            apiVersion = "rbac.authorization.k8s.io/v1";
-            kind = "ClusterRoleBinding";
-            metadata = {
-              name = "kubernetes-dashboard";
-              inherit labels;
-            };
-            roleRef = {
-              apiGroup = "rbac.authorization.k8s.io";
-              kind = "ClusterRole";
-              name = "cluster-admin";
-            };
-            inherit subjects;
-          };
-        }
-        else
-        {
-          # Upstream role- and rolebinding as per:
-          # https://raw.githubusercontent.com/kubernetes/dashboard/master/src/deploy/alternative/kubernetes-dashboard.yaml
-          kubernetes-dashboard-role = {
-            apiVersion = "rbac.authorization.k8s.io/v1";
-            kind = "Role";
-            metadata = {
-              name = "kubernetes-dashboard-minimal";
-              namespace = "kube-system";
-              inherit labels;
-            };
-            rules = [
-              # Allow Dashboard to create 'kubernetes-dashboard-key-holder' secret.
-              {
-                apiGroups = [""];
-                resources = ["secrets"];
-                verbs = ["create"];
-              }
-              # Allow Dashboard to create 'kubernetes-dashboard-settings' config map.
-              {
-                apiGroups = [""];
-                resources = ["configmaps"];
-                verbs = ["create"];
-              }
-              # Allow Dashboard to get, update and delete Dashboard exclusive secrets.
-              {
-                apiGroups = [""];
-                resources = ["secrets"];
-                resourceNames = ["kubernetes-dashboard-key-holder"];
-                verbs = ["get" "update" "delete"];
-              }
-              # Allow Dashboard to get and update 'kubernetes-dashboard-settings' config map.
-              {
-                apiGroups = [""];
-                resources = ["configmaps"];
-                resourceNames = ["kubernetes-dashboard-settings"];
-                verbs = ["get" "update"];
-              }
-              # Allow Dashboard to get metrics from heapster.
-              {
-                apiGroups = [""];
-                resources = ["services"];
-                resourceNames = ["heapster"];
-                verbs = ["proxy"];
-              }
-              {
-                apiGroups = [""];
-                resources = ["services/proxy"];
-                resourceNames = ["heapster" "http:heapster:" "https:heapster:"];
-                verbs = ["get"];
-              }
-            ];
-          };
-
-          kubernetes-dashboard-rb = {
-            apiVersion = "rbac.authorization.k8s.io/v1";
-            kind = "RoleBinding";
-            metadata = {
-              name = "kubernetes-dashboard-minimal";
-              namespace = "kube-system";
-              inherit labels;
-            };
-            roleRef = {
-              apiGroup = "rbac.authorization.k8s.io";
-              kind = "Role";
-              name = "kubernetes-dashboard-minimal";
-            };
-            inherit subjects;
-          };
-        })
-    ));
-  };
-}
--- a/nixos/modules/services/cluster/kubernetes/default.nix
+++ b/nixos/modules/services/cluster/kubernetes/default.nix
@ -106,6 +106,7 @@ let
 in {

  imports = [
+    (mkRemovedOptionModule [ "services" "kubernetes" "addons" "dashboard" ] "Removed due to it being an outdated version")
    (mkRemovedOptionModule [ "services" "kubernetes" "verbose" ] "")
  ];

--- a/nixos/modules/services/networking/dhcpd.nix
+++ b/nixos/modules/services/networking/dhcpd.nix
@ -28,45 +28,38 @@ let
      }
    '';

-  dhcpdService = postfix: cfg:
-    let
-      configFile =
-        if cfg.configFile != null
-          then cfg.configFile
-          else writeConfig cfg;
-      leaseFile = "/var/lib/dhcpd${postfix}/dhcpd.leases";
-      args = [
-        "@${pkgs.dhcp}/sbin/dhcpd" "dhcpd${postfix}" "-${postfix}"
-        "-pf" "/run/dhcpd${postfix}/dhcpd.pid"
-        "-cf" configFile
-        "-lf" leaseFile
-      ] ++ cfg.extraFlags
-        ++ cfg.interfaces;
-    in
-      optionalAttrs cfg.enable {
-        "dhcpd${postfix}" = {
-          description = "DHCPv${postfix} server";
-          wantedBy = [ "multi-user.target" ];
-          after = [ "network.target" ];
+  dhcpdService = postfix: cfg: optionalAttrs cfg.enable {
+    "dhcpd${postfix}" = {
+      description = "DHCPv${postfix} server";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];

-          preStart = "touch ${leaseFile}";
-          serviceConfig = {
-            ExecStart = concatMapStringsSep " " escapeShellArg args;
-            Type = "forking";
-            Restart = "always";
-            DynamicUser = true;
-            User = "dhcpd";
-            Group = "dhcpd";
-            AmbientCapabilities = [
-              "CAP_NET_RAW"          # to send ICMP messages
-              "CAP_NET_BIND_SERVICE" # to bind on DHCP port (67)
-            ];
-            StateDirectory   = "dhcpd${postfix}";
-            RuntimeDirectory = "dhcpd${postfix}";
-            PIDFile = "/run/dhcpd${postfix}/dhcpd.pid";
-          };
+      preStart = ''
+        mkdir -m 755 -p ${cfg.stateDir}
+        chown dhcpd:nogroup ${cfg.stateDir}
+        touch ${cfg.stateDir}/dhcpd.leases
+      '';
+
+      serviceConfig =
+        let
+          configFile = if cfg.configFile != null then cfg.configFile else writeConfig cfg;
+          args = [ "@${pkgs.dhcp}/sbin/dhcpd" "dhcpd${postfix}" "-${postfix}"
+                   "-pf" "/run/dhcpd${postfix}/dhcpd.pid"
+                   "-cf" "${configFile}"
+                   "-lf" "${cfg.stateDir}/dhcpd.leases"
+                   "-user" "dhcpd" "-group" "nogroup"
+                 ] ++ cfg.extraFlags
+                   ++ cfg.interfaces;
+
+        in {
+          ExecStart = concatMapStringsSep " " escapeShellArg args;
+          Type = "forking";
+          Restart = "always";
+          RuntimeDirectory = [ "dhcpd${postfix}" ];
+          PIDFile = "/run/dhcpd${postfix}/dhcpd.pid";
        };
-      };
+    };
+  };

  machineOpts = { ... }: {

@ -109,6 +102,15 @@ let
      '';
    };

+    stateDir = mkOption {
+      type = types.path;
+      # We use /var/lib/dhcp for DHCPv4 to save backwards compatibility.
+      default = "/var/lib/dhcp${if postfix == "4" then "" else postfix}";
+      description = ''
+        State directory for the DHCP server.
+      '';
+    };
+
    extraConfig = mkOption {
      type = types.lines;
      default = "";
@ -192,13 +194,7 @@ in

  imports = [
    (mkRenamedOptionModule [ "services" "dhcpd" ] [ "services" "dhcpd4" ])
-  ] ++ flip map [ "4" "6" ] (postfix:
-    mkRemovedOptionModule [ "services" "dhcpd${postfix}" "stateDir" ] ''
-      The DHCP server state directory is now managed with the systemd's DynamicUser mechanism.
-      This means the directory is named after the service (dhcpd${postfix}), created under
-      /var/lib/private/ and symlinked to /var/lib/.
-    ''
-  );
+  ];

  ###### interface

@ -214,6 +210,15 @@ in

  config = mkIf (cfg4.enable || cfg6.enable) {

+    users = {
+      users.dhcpd = {
+        isSystemUser = true;
+        group = "dhcpd";
+        description = "DHCP daemon user";
+      };
+      groups.dhcpd = {};
+    };
+
    systemd.services = dhcpdService "4" cfg4 // dhcpdService "6" cfg6;

  };
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -255,6 +255,7 @@ in
  magnetico = handleTest ./magnetico.nix {};
  mailcatcher = handleTest ./mailcatcher.nix {};
  mailhog = handleTest ./mailhog.nix {};
+  man = handleTest ./man.nix {};
  mariadb-galera-mariabackup = handleTest ./mysql/mariadb-galera-mariabackup.nix {};
  mariadb-galera-rsync = handleTest ./mysql/mariadb-galera-rsync.nix {};
  matomo = handleTest ./matomo.nix {};
@ -398,6 +399,7 @@ in
  proxy = handleTest ./proxy.nix {};
  prowlarr = handleTest ./prowlarr.nix {};
  pt2-clone = handleTest ./pt2-clone.nix {};
+  pulseaudio = discoverTests (import ./pulseaudio.nix);
  qboot = handleTestOn ["x86_64-linux" "i686-linux"] ./qboot.nix {};
  quorum = handleTest ./quorum.nix {};
  rabbitmq = handleTest ./rabbitmq.nix {};
--- a/nixos/tests/kubernetes/base.nix
+++ b/nixos/tests/kubernetes/base.nix
@ -51,7 +51,6 @@ let
              environment.systemPackages = [ kubectl ];
              services.flannel.iface = "eth1";
              services.kubernetes = {
-                addons.dashboard.enable = true;
                proxy.hostname = "${masterName}.${domain}";

                easyCerts = true;
--- a/nixos/tests/man.nix
+++ b/nixos/tests/man.nix
@ -0,0 +1,100 @@
+
+import ./make-test-python.nix ({ pkgs, lib, ... }: let
+  manImplementations = [
+    "mandoc"
+    "man-db"
+  ];
+
+  machineNames = builtins.map machineSafe manImplementations;
+
+  makeConfig = useImpl: {
+    # Note: mandoc currently can't index symlinked section directories.
+    # So if a man section comes from one package exclusively (e. g.
+    # 1p from man-pages-posix and 2 from man-pages), it isn't searchable.
+    environment.systemPackages = [
+      pkgs.man-pages
+      pkgs.openssl
+      pkgs.libunwind
+    ];
+
+    documentation = {
+      enable = true;
+      nixos.enable = lib.mkForce true;
+      dev.enable = true;
+      man = {
+        enable = true;
+        generateCaches = true;
+      } // lib.listToAttrs (builtins.map (impl: {
+        name = impl;
+        value = {
+          enable = useImpl == impl;
+        };
+      }) manImplementations);
+    };
+  };
+
+  machineSafe = builtins.replaceStrings [ "-" ] [ "_" ];
+in {
+  name = "man";
+  meta.maintainers = [ lib.maintainers.sternenseemann ];
+
+  nodes = lib.listToAttrs (builtins.map (i: {
+    name = machineSafe i;
+    value = makeConfig i;
+  }) manImplementations);
+
+  testScript = ''
+    import re
+    start_all()
+
+    def match_man_k(page, section, haystack):
+      """
+      Check if the man page {page}({section}) occurs in
+      the output of `man -k` given as haystack. Note:
+      This is not super reliable, e. g. it can't deal
+      with man pages that are in multiple sections.
+      """
+
+      for line in haystack.split("\n"):
+        # man -k can look like this:
+        # page(3) - bla
+        # page (3) - bla
+        # pagea, pageb (3, 3P) - foo
+        # pagea, pageb, pagec(3) - bar
+        pages = line.split("(")[0]
+        sections = re.search("\\([a-zA-Z1-9, ]+\\)", line)
+        if sections is None:
+          continue
+        else:
+          sections = sections.group(0)[1:-1]
+
+        if page in pages and f'{section}' in sections:
+          return True
+
+      return False
+
+  '' + lib.concatMapStrings (machine: ''
+    with subtest("Test direct man page lookups in ${machine}"):
+      # man works
+      ${machine}.succeed("man man > /dev/null")
+      # devman works
+      ${machine}.succeed("man 3 libunwind > /dev/null")
+      # NixOS configuration man page is installed
+      ${machine}.succeed("man configuration.nix > /dev/null")
+
+    with subtest("Test generateCaches via man -k in ${machine}"):
+      expected = [
+        ("openssl", "ssl", 3),
+        ("unwind", "libunwind", 3),
+        ("user", "useradd", 8),
+        ("user", "userdel", 8),
+        ("mem", "free", 3),
+        ("mem", "free", 1),
+      ]
+
+      for (keyword, page, section) in expected:
+        matches = ${machine}.succeed(f"man -k {keyword}")
+        if not match_man_k(page, section, matches):
+          raise Exception(f"{page}({section}) missing in matches: {matches}")
+  '') machineNames;
+})
--- a/nixos/tests/pulseaudio.nix
+++ b/nixos/tests/pulseaudio.nix
@ -0,0 +1,71 @@
+let
+  mkTest = { systemWide ? false }:
+    import ./make-test-python.nix ({ pkgs, lib, ... }:
+      let
+        testFile = pkgs.fetchurl {
+          url =
+            "https://file-examples-com.github.io/uploads/2017/11/file_example_MP3_700KB.mp3";
+          hash = "sha256-+iggJW8s0/LfA/okfXsB550/55Q0Sq3OoIzuBrzOPJQ=";
+        };
+
+        makeTestPlay = key:
+          { sox, alsa-utils }:
+          pkgs.writeScriptBin key ''
+            set -euxo pipefail
+            ${sox}/bin/play ${testFile}
+            ${sox}/bin/sox ${testFile} -t wav - | ${alsa-utils}/bin/aplay
+            touch /tmp/${key}_success
+          '';
+
+        testers = builtins.mapAttrs makeTestPlay {
+          testPlay = { inherit (pkgs) sox alsa-utils; };
+          testPlay32 = { inherit (pkgs.pkgsi686Linux) sox alsa-utils; };
+        };
+      in {
+        name = "pulseaudio${lib.optionalString systemWide "-systemWide"}";
+        meta = with pkgs.lib.maintainers; {
+          maintainers = [ synthetica ] ++ pkgs.pulseaudio.meta.maintainers;
+        };
+
+        machine = { ... }:
+
+          {
+            imports = [ ./common/wayland-cage.nix ];
+            hardware.pulseaudio = {
+              enable = true;
+              support32Bit = true;
+              inherit systemWide;
+            };
+
+            environment.systemPackages = [ testers.testPlay pkgs.pavucontrol ]
+              ++ lib.optional pkgs.stdenv.isx86_64 testers.testPlay32;
+          } // lib.optionalAttrs systemWide {
+            users.users.alice.extraGroups = [ "audio" ];
+            systemd.services.pulseaudio.wantedBy = [ "multi-user.target" ];
+          };
+
+        enableOCR = true;
+
+        testScript = { ... }: ''
+          machine.wait_until_succeeds("pgrep xterm")
+          machine.wait_for_text("alice@machine")
+
+          machine.send_chars("testPlay \n")
+          machine.wait_for_file("/tmp/testPlay_success")
+          ${lib.optionalString pkgs.stdenv.isx86_64 ''
+            machine.send_chars("testPlay32 \n")
+            machine.wait_for_file("/tmp/testPlay32_success")
+          ''}
+          machine.screenshot("testPlay")
+
+          # Pavucontrol only loads when Pulseaudio is running. If it isn't, the
+          # text "Playback" (one of the tabs) will never show.
+          machine.send_chars("pavucontrol\n")
+          machine.wait_for_text("Playback")
+          machine.screenshot("Pavucontrol")
+        '';
+      });
+in builtins.mapAttrs (key: val: mkTest val) {
+  user = { systemWide = false; };
+  system = { systemWide = true; };
+}
--- a/pkgs/applications/blockchains/btcpayserver/default.nix
+++ b/pkgs/applications/blockchains/btcpayserver/default.nix
@ -3,13 +3,13 @@

 buildDotnetModule rec {
  pname = "btcpayserver";
-  version = "1.3.6";
+  version = "1.3.7";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-8SWbbdPx/cC7EWTkSbB/YqR13jaL76fFIjHPGL4rFyk=";
+    sha256 = "sha256-W8WRw42hMNUaQZlfrl73REGIvLcj6Vso9Axx53ENkx0=";
  };

  projectFile = "BTCPayServer/BTCPayServer.csproj";
--- a/pkgs/applications/blockchains/ergo/default.nix
+++ b/pkgs/applications/blockchains/ergo/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ergo";
-  version = "4.0.16";
+  version = "4.0.16.2";

  src = fetchurl {
    url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "sha256-cdfpXJtN/JXQNBnCyTIvJLQQhjzDV3+l4WoASII9uuU=";
+    sha256 = "sha256-nAaNT5Rt/oLBA2pSJSinoLKMYJ0VZmuC0zoMYbMSAJQ=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/blockchains/go-ethereum/default.nix
+++ b/pkgs/applications/blockchains/go-ethereum/default.nix
@ -9,13 +9,13 @@ let

 in buildGoModule rec {
  pname = "go-ethereum";
-  version = "1.10.11";
+  version = "1.10.14";

  src = fetchFromGitHub {
    owner = "ethereum";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-8kPaa2wRKUQBn4LFDnc7tEbLR62f99NS1HIVDeHHzto=";
+    sha256 = "sha256-0DQrcei3FM+X4BYokou7dPNVCcJTbY05YsTvzdtsas8=";
  };

  runVend = true;
--- a/pkgs/applications/blockchains/lightning-loop/default.nix
+++ b/pkgs/applications/blockchains/lightning-loop/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "lightning-loop";
-  version = "0.15.0-beta";
+  version = "0.16.0-beta";

  src = fetchFromGitHub {
    owner = "lightninglabs";
    repo = "loop";
    rev = "v${version}";
-    sha256 = "1yjc04jiam3836w7vn3b1jqj1dq1k8wwfnccir0vh29cn6v0cf63";
+    sha256 = "0q4lk338mr30frilgnjr43gd55z7ryj2s260437b4pnp03hmbf10";
  };

-  vendorSha256 = "0c3ly0s438sr9iql2ps4biaswphp7dfxshddyw5fcm0ajqzvhrmw";
+  vendorSha256 = "14862603rrss14p537j9i7iwflaaprwrnslmqm9hpb7hj52bxqfv";

  subPackages = [ "cmd/loop" "cmd/loopd" ];

--- a/pkgs/applications/blockchains/lightning-pool/default.nix
+++ b/pkgs/applications/blockchains/lightning-pool/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "lightning-pool";
-  version = "0.5.1-alpha";
+  version = "0.5.3-alpha";

  src = fetchFromGitHub {
    owner = "lightninglabs";
    repo = "pool";
    rev = "v${version}";
-    sha256 = "147s0p4arfxl2akzm267p8zfy6hgssym5rwxv78kp8i39mfinpkn";
+    sha256 = "1nc3hksk9qcxrsyqpz9vcfc8x093rc8yx8ppfk177j9fhdnn8bk7";
  };

-  vendorSha256 = "0zd3bwqi0hnk0562x9hd62cwjw1xj386m83jagg41kzz0cpcr7zl";
+  vendorSha256 = "09yxaa74814l1rp0arqhqpplr2j0p8dj81zqcbxlwp5ckjv9r2za";

  subPackages = [ "cmd/pool" "cmd/poold" ];

--- a/pkgs/applications/blockchains/nbxplorer/util/update-common.sh
+++ b/pkgs/applications/blockchains/nbxplorer/util/update-common.sh
@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p coreutils curl jq common-updater-scripts dotnet-sdk_3 git gnupg nix
+#!nix-shell -i bash -p coreutils curl jq common-updater-scripts dotnet-sdk_3 git gnupg nixFlakes
 set -euo pipefail

 # This script uses the following env vars:
@ -17,7 +17,7 @@ scriptDir=$(cd "${BASH_SOURCE[0]%/*}" && pwd)
 nixpkgs=$(realpath "$scriptDir"/../../../../..)

 evalNixpkgs() {
-  nix eval --raw "(with import \"$nixpkgs\" {}; $1)"
+  nix eval --impure --raw --expr "(with import \"$nixpkgs\" {}; $1)"
 }

 getRepo() {
--- a/pkgs/applications/editors/featherpad/default.nix
+++ b/pkgs/applications/editors/featherpad/default.nix
@ -3,13 +3,13 @@

 mkDerivation rec {
  pname = "featherpad";
-  version = "1.0.1";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "tsujan";
    repo = "FeatherPad";
    rev = "V${version}";
-    sha256 = "sha256-FeqTPDix2tqTJ3UU6i2e6FkmCO0KMNt4tLtrPjX57fc=";
+    sha256 = "sha256-Sff1oyRYCsiJ7Kl3HxI/bln0M80KlbcNSw6jrEOeWiI=";
  };

  nativeBuildInputs = [ cmake pkg-config qttools ];
--- a/pkgs/applications/misc/bottles/default.nix
+++ b/pkgs/applications/misc/bottles/default.nix
@ -1,20 +1,21 @@
 { lib, fetchFromGitHub
 , meson, ninja, pkg-config, wrapGAppsHook
-, desktop-file-utils, gsettings-desktop-schemas, libnotify, libhandy
+, desktop-file-utils, gsettings-desktop-schemas, libnotify, libhandy, webkitgtk
 , python3Packages, gettext
-, appstream-glib, gdk-pixbuf, glib, gobject-introspection, gspell, gtk3
+, appstream-glib, gdk-pixbuf, glib, gobject-introspection, gspell, gtk3, gnome
 , steam-run, xdg-utils, pciutils, cabextract, wineWowPackages
+, freetype, p7zip, gamemode
 }:

 python3Packages.buildPythonApplication rec {
  pname = "bottles";
-  version = "2021.7.28-treviso-2";
+  version = "2021.12.28-treviso";

  src = fetchFromGitHub {
    owner = "bottlesdevs";
    repo = pname;
    rev = version;
-    sha256 = "0kvwcajm9izvkwfg7ir7bks39bpc665idwa8mc8d536ajyjriysn";
+    sha256 = "lZbSLLBg7XM6PuOmu5rJ15dg+QHHRcjijRYE6u3WT9Y=";
  };

  postPatch = ''
@ -41,10 +42,13 @@ python3Packages.buildPythonApplication rec {
    gtk3
    libhandy
    libnotify
+    webkitgtk
+    gnome.adwaita-icon-theme
  ];

  propagatedBuildInputs = with python3Packages; [
    pyyaml
+    pytoml
    requests
    pycairo
    pygobject3
@ -53,12 +57,16 @@ python3Packages.buildPythonApplication rec {
    gst-python
    liblarch
    patool
+    markdown
  ] ++ [
    steam-run
    xdg-utils
    pciutils
    cabextract
    wineWowPackages.minimal
+    freetype
+    p7zip
+    gamemode # programs.gamemode.enable
  ];

  format = "other";
@ -66,13 +74,9 @@ python3Packages.buildPythonApplication rec {
  dontWrapGApps = true; # prevent double wrapping

  preConfigure = ''
-    substituteInPlace build-aux/meson/postinstall.py \
-      --replace "'update-desktop-database'" "'${desktop-file-utils}/bin/update-desktop-database'"
-    substituteInPlace src/runner.py \
-      --replace " {runner}" " ${steam-run}/bin/steam-run {runner}" \
-      --replace " {dxvk_setup}" " ${steam-run}/bin/steam-run {dxvk_setup}"
-      substituteInPlace src/runner_utilities.py \
-        --replace " {runner}" " ${steam-run}/bin/steam-run {runner}" \
+    patchShebangs build-aux/meson/postinstall.py
+    substituteInPlace src/backend/runner.py \
+      --replace "{Paths.runners}" "${steam-run}/bin/steam-run {Paths.runners}"
  '';

  preFixup = ''
--- a/pkgs/applications/misc/koreader/default.nix
+++ b/pkgs/applications/misc/koreader/default.nix
@ -13,12 +13,12 @@
 let font-droid = nerdfonts.override { fonts = [ "DroidSansMono" ]; };
 in stdenv.mkDerivation rec {
  pname = "koreader";
-  version = "2021.12";
+  version = "2021.12.1";

  src = fetchurl {
    url =
      "https://github.com/koreader/koreader/releases/download/v${version}/koreader-${version}-amd64.deb";
-    sha256 = "sha256-duOIbYavqmUUkH6RthTYu/SeM8zOeeLm7CIAQwhw6AY=";
+    sha256 = "sha256-Ia0oCSGs6UYcvZVEhNpiOh3D08FgXqjqpgsQJojd3dk=";
  };

  sourceRoot = ".";
--- a/pkgs/applications/misc/mkgmap/default.nix
+++ b/pkgs/applications/misc/mkgmap/default.nix
@ -14,11 +14,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "mkgmap";
-  version = "4835";
+  version = "4836";

  src = fetchurl {
    url = "https://www.mkgmap.org.uk/download/mkgmap-r${version}-src.tar.gz";
-    sha256 = "u4qwfL8qp+rUIIYuZmVYjEkh0riL8yeQz0t8j5shT34=";
+    sha256 = "nmEl7pN3LW6nqo5IB6GgzcDMHhdAsMySTdANVbybznY=";
  };

  patches = [
--- a/pkgs/applications/misc/openrgb/default.nix
+++ b/pkgs/applications/misc/openrgb/default.nix
@ -1,18 +1,18 @@
-{ lib, mkDerivation, fetchFromGitLab, qmake, libusb1, hidapi, pkg-config, coreutils }:
+{ lib, mkDerivation, fetchFromGitLab, qmake, libusb1, hidapi, pkg-config, coreutils, mbedtls }:

 mkDerivation rec {
  pname = "openrgb";
-  version = "0.6";
+  version = "0.7";

  src = fetchFromGitLab {
    owner = "CalcProgrammer1";
    repo = "OpenRGB";
    rev = "release_${version}";
-    sha256 = "sha256-x/wGD39Jm/kmcTEZP3BnLXxyv/jkPOJd6mLCO0dp5wM=";
+    sha256 = "0xhfaz0b74nfnh7il2cz5c0338xlzay00g6hc2h3lsncarj8d5n7";
  };

  nativeBuildInputs = [ qmake pkg-config ];
-  buildInputs = [ libusb1 hidapi ];
+  buildInputs = [ libusb1 hidapi mbedtls ];

  installPhase = ''
    runHook preInstall
--- a/pkgs/applications/misc/stog/default.nix
+++ b/pkgs/applications/misc/stog/default.nix
@ -1,32 +1,44 @@
-{ lib, stdenv, fetchFromGitLab, ocaml, findlib, ocf, ptime,
-  uutf, uri, ppx_blob, xtmpl, ocaml_lwt, higlo, omd
+{ lib, buildDunePackage, fetchFromGitLab, ocaml
+, fmt, lwt_ppx, menhir, ocf_ppx, ppx_blob, xtmpl_ppx
+, dune-build-info, dune-site, higlo, logs, lwt, ocf, ptime, uri, uutf, xtmpl
 }:

-stdenv.mkDerivation rec {
+if lib.versionAtLeast ocaml.version "4.13"
+then throw "stog is not available for OCaml ${ocaml.version}"
+else
+
+buildDunePackage rec {
  pname = "stog";
-  version = "0.18.0";
+  version = "0.20.0";
+  useDune2 = true;
+  minimalOCamlVersion = "4.12";
  src = fetchFromGitLab {
    domain = "framagit.org";
    owner = "zoggy";
    repo = "stog";
    rev = version;
-    sha256 = "154gl3ljxqlw8wz1vmsyv8180igrl5bjq0wir7ybrnzq2cdflkv0";
+    sha256 = "sha256:0krj5w4y05bcfx7hk9blmap8avl31gp7yi01lpqzs6ync23mvm0x";
  };

-  buildInputs = [ ocaml uutf ];
-  propagatedBuildInputs = [ findlib omd ppx_blob ocf ptime uri xtmpl ocaml_lwt higlo ];
-
-  createFindlibDestdir = true;
-
-  patches = [ ./install.patch ./uri.patch ];
+  buildInputs = [ fmt lwt_ppx menhir ocf_ppx ppx_blob xtmpl_ppx ];
+  propagatedBuildInputs = [
+    dune-build-info
+    dune-site
+    higlo
+    logs
+    lwt
+    ocf
+    ppx_blob
+    ptime
+    uri
+    uutf
+    xtmpl
+  ];

  meta = with lib; {
    description = "XML documents and web site compiler";
    homepage = "https://www.good-eris.net/stog";
    license = licenses.lgpl3;
-    platforms = ocaml.meta.platforms or [];
    maintainers = with maintainers; [ regnat ];
  };
 }
-
-
--- a/pkgs/applications/misc/stog/install.patch
+++ b/pkgs/applications/misc/stog/install.patch
@ -1,18 +0,0 @@
-diff --git a/src/Makefile b/src/Makefile
-index 736dd037..79a85b9c 100644
--- a/src/Makefile
-+++ b/src/Makefile
-@@ -431,11 +431,12 @@ install-lib:
- install-share:
- 
- install-bin:
-+	mkdir $(out)/bin
- 	$(CP) $(MAIN) $(MAIN_BYTE) $(TMPL) $(TMPL_BYTE) \
- 		$(SERVER) $(SERVER_BYTE) $(OCAML_SESSION) \
- 	  $(MK_STOG) $(MK_STOG_BYTE) $(MK_STOG_OCAML) \
- 	  $(LATEX2STOG) $(LATEX2STOG_BYTE) \
-		`dirname \`which $(OCAMLC)\``/
-+	  $(out)/bin
- 
- uninstall: uninstall-lib uninstall-share uninstall-bin
- 
--- a/pkgs/applications/misc/stog/uri.patch
+++ b/pkgs/applications/misc/stog/uri.patch
@ -1,13 +0,0 @@
-diff --git a/src/stog_url.ml b/src/stog_url.ml
-index 5d30a43f..c67bfc36 100644
--- a/src/stog_url.ml
-+++ b/src/stog_url.ml
-@@ -40,7 +40,7 @@ let of_string s =
-   with _ ->
-     failwith (Printf.sprintf "Malformed URL %S" s)
- ;;
-let to_string = Uri.to_string ;;
-+let to_string u = Uri.to_string u;;
- 
- let path url =
-   let l =
--- a/pkgs/applications/misc/tmatrix/default.nix
+++ b/pkgs/applications/misc/tmatrix/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "tmatrix";
-  version = "1.3";
+  version = "1.4";

  src = fetchFromGitHub {
    owner = "M4444";
    repo = "TMatrix";
    rev = "v${version}";
-    sha256 = "1cvgxmdpdzpl8w4z3sh4g5pbd15rd8s1kcspi9v95yf9rydyy69s";
+    sha256 = "sha256-G3dg0SWfBjCA66TTxkVAcVrFNJOWE9+GJXYKzCUX34w=";
  };

  nativeBuildInputs = [ cmake installShellFiles ];
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -18,9 +18,9 @@
    }
  },
  "beta": {
-    "version": "97.0.4692.56",
-    "sha256": "19i572z02hp7n7j7k5i38jr60jfli5jk5qnydfzxavwx9vjqjwgf",
-    "sha256bin64": "1im2dq2p5cdy6hj6n2lvn2nzwb5mgy57hyskhwhfm1fz5xzjzc3g",
+    "version": "97.0.4692.71",
+    "sha256": "0z7ximvm4a78kxyp4j0i2jzklxazpw6jcqi9jkaf8bvq9ga8kqca",
+    "sha256bin64": "18wr4pgzfcvvdpvvxhpd4as2qnyggq9f8z90ikdz8yj8i71l5wnc",
    "deps": {
      "gn": {
        "version": "2021-11-03",
--- a/pkgs/applications/networking/browsers/elinks/default.nix
+++ b/pkgs/applications/networking/browsers/elinks/default.nix
@ -13,13 +13,13 @@ assert enablePython -> python != null;

 stdenv.mkDerivation rec {
  pname = "elinks";
-  version = "0.14.3";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "rkd77";
    repo = "felinks";
    rev = "v${version}";
-    sha256 = "sha256-vyzuMU2Qfz8DMRP0+QQmSx8J40ADTMJqg2jQOZJQxUA=";
+    sha256 = "sha256-2TF0rbmjwhwV2AVUXjfzoprzpeqrETis3AFhMftpaZQ=";
  };

  buildInputs = [
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@ -297,10 +297,17 @@ stdenv.mkDerivation rec {
    cp -u --no-preserve=mode,owner "$TBB_IN_STORE/TorBrowser/Data/Browser/profile.default/bookmarks.html" \
      "\$HOME/TorBrowser/Data/Browser/profile.default/bookmarks.html"

-    # Clear out some files that tend to capture store references but are
-    # easily generated by firefox at startup.
-    rm -f "\$HOME/TorBrowser/Data/Browser/profile.default"/{addonStartup.json.lz4,compatibility.ini,extensions.ini,extensions.json}
-    rm -f "\$HOME/TorBrowser/Data/Browser/profile.default"/startupCache/*
+    # Clear some files if the last known store path is different from the new one
+    : "\''${KNOWN_STORE_PATH:=\$HOME/known-store-path}"
+    if ! [ "\$KNOWN_STORE_PATH" -ef $out ]; then
+      echo "Cleanup files with outdated store references"
+      ln -Tsf $out "\$KNOWN_STORE_PATH"
+
+      # Clear out some files that tend to capture store references but are
+      # easily generated by firefox at startup.
+      rm -f "\$HOME/TorBrowser/Data/Browser/profile.default"/{addonStartup.json.lz4,compatibility.ini,extensions.ini,extensions.json}
+      rm -f "\$HOME/TorBrowser/Data/Browser/profile.default"/startupCache/*
+    fi

    # XDG
    : "\''${XDG_RUNTIME_DIR:=/run/user/\$(id -u)}"
--- a/pkgs/applications/networking/cluster/kubeone/default.nix
+++ b/pkgs/applications/networking/cluster/kubeone/default.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "kubeone";
-  version = "1.3.2";
+  version = "1.3.3";

  src = fetchFromGitHub {
    owner = "kubermatic";
    repo = "kubeone";
    rev = "v${version}";
-    sha256 = "sha256-Y0IlTOAfwEp8WkFpXSS02vEhCM4+juAY+Nx/e9Vv0F0=";
+    sha256 = "sha256-IgV1ULxwL17ECsm7MdRfQERcEVy9cEft2L7fHP3XCKo=";
  };

  vendorSha256 = "sha256-/rhV7JHuqejCTizcjKIkaJlbRcx7AfMcGqQYo6dlg48=";
--- a/pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/libvirt/default.nix
@ -13,9 +13,9 @@
 # https://github.com/dmacvicar/terraform-provider-libvirt/tree/main/examples

 let
-  sha256 = "sha256-8GGPd0+qdw7s4cr0RgLoS0Cu4C+RAuuboZzTyYN/kq8=";
-  vendorSha256 = "sha256-fpO2sGM+VUKLmdfJ9CQfTFnCfxVTK2m9Sirj9oerD/I=";
-  version = "0.6.11";
+  sha256 = "sha256-1l+ARrXHxtSdnQfYV/6gw3BYHVH8NN4pi+Ttk1nwF88=";
+  vendorSha256 = "sha256-OJa8pQgf5PlECZZkFV9fyCOdh6CrregY1BWycx7JPFE=";
+  version = "0.6.12";
 in buildGoModule {
  inherit version;
  inherit vendorSha256;
@ -41,7 +41,7 @@ in buildGoModule {
  # Terraform allow checking the provider versions, but this breaks
  # if the versions are not provided via file paths.
  postBuild = "mv $GOPATH/bin/terraform-provider-libvirt{,_v${version}}";
-  
+
  ldflags = [ "-X main.version=${version}" ];
  passthru.provider-source-address = "registry.terraform.io/dmacvicar/libvirt";

@ -50,7 +50,6 @@ in buildGoModule {
  meta = with lib; {
    homepage = "https://github.com/dmacvicar/terraform-provider-libvirt";
    description = "Terraform provider for libvirt";
-    platforms = platforms.linux;
    license = licenses.asl20;
    maintainers = with maintainers; [ mic92 ];
  };
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -10,38 +10,38 @@
    "owner": "vancluever",
    "provider-source-address": "registry.terraform.io/vancluever/acme",
    "repo": "terraform-provider-acme",
-    "rev": "v2.7.0",
-    "sha256": "0dyzsfazhxjjfkykykz823n0fk2fbl53nwxpv7wvl1zzmg72lk37",
-    "vendorSha256": "1sw83jxa3kjjqrjv3z1hczlszskc7lk0i4lrnvdnxa6s642i7brl",
-    "version": "2.7.0"
+    "rev": "v2.7.1",
+    "sha256": "0gnq8jm31v0q2a4v310cjrrdc7y17c9vi326c6x9cs3lgjvn27m2",
+    "vendorSha256": "1wssw8x8zlrgx51ij0ghhwsbyzfl2r1qy4aqv03v705xipil8yn3",
+    "version": "2.7.1"
  },
  "aiven": {
    "owner": "aiven",
    "provider-source-address": "registry.terraform.io/aiven/aiven",
    "repo": "terraform-provider-aiven",
-    "rev": "v2.3.2",
-    "sha256": "14ivvb1ql06gxfi6ffg1kg9k9xadds6fgzj9wp2hh3an2rf7v9ym",
-    "vendorSha256": "0akqbhjz309znzjqm633nk2zbf925l6027n88bb7mgbv1zjxqw9j",
-    "version": "2.3.2"
+    "rev": "v2.4.0",
+    "sha256": "0m43d2iaa9kywzvlgcnsya1ma9k570j9q8cq9l6ldpc8565fqq0i",
+    "vendorSha256": "1lpfnpg4sivy8vilkxamdn1hyn6k61lxsfcq67afxsq8pcy6q44v",
+    "version": "2.4.0"
  },
  "akamai": {
    "owner": "akamai",
    "provider-source-address": "registry.terraform.io/akamai/akamai",
    "repo": "terraform-provider-akamai",
-    "rev": "v1.8.0",
-    "sha256": "0jpw16bap4q75dzchimfqgqqkkn3ckw19q9rjfb8zbkvini5ybw1",
-    "vendorSha256": "sha256-03Q0/YrivaG2fMgIjW6mxWOIdFZ7FKYB8C6DZIGr+/w=",
-    "version": "1.8.0"
+    "rev": "v1.9.1",
+    "sha256": "17a3ml4h1b1480z9dzppig20jx9mgldnmpz8cn2x8qgzbpiqz3hs",
+    "vendorSha256": "0l50hy4cy360g6adbhhbl4x8hagma9zfb3yyzk6vbslal9m4kd6j",
+    "version": "1.9.1"
  },
  "alicloud": {
    "deleteVendor": true,
    "owner": "aliyun",
    "provider-source-address": "registry.terraform.io/aliyun/alicloud",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.144.0",
-    "sha256": "14nphpz15p83n6fsvvrnaz96nb87wvb10ri21hlhlsm2579zcbqd",
-    "vendorSha256": "1k28fcfm7437i7gfbcbrigk2i50c1mix7z1rb2g617prih84wa6y",
-    "version": "1.144.0"
+    "rev": "v1.149.0",
+    "sha256": "0v9jhpvz33hzq09i8bxp1dif9jdypb5g2xy3d2g1mw4lgqrdpjix",
+    "vendorSha256": "18chs2723i2cxhhm649mz52pp6wrfqzxgk12zxq9idrhicchqnzg",
+    "version": "1.149.0"
  },
  "archive": {
    "owner": "hashicorp",
@ -84,28 +84,28 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/aws",
    "repo": "terraform-provider-aws",
-    "rev": "v3.66.0",
-    "sha256": "1s9bdpadg34wbr0qgiafn86xnaryfdfa5vdbvz6i24dps082gv6y",
-    "vendorSha256": "1cycfd3vc9980ijfwldgyvx3v003khrcm3qg18928s7k16xaql0b",
-    "version": "3.66.0"
+    "rev": "v3.70.0",
+    "sha256": "0133f1ngwa7x8w9zicfwmkj14rav9cvwk7qf7hdz0cfmyl4pj4x2",
+    "vendorSha256": "03k8xijzfawbdzc1wavw9k2z2zyffi1ysnqls412nzdyvxyl8xw4",
+    "version": "3.70.0"
  },
  "azuread": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/azuread",
    "repo": "terraform-provider-azuread",
-    "rev": "v2.10.0",
-    "sha256": "1q70kighdgsq1jwwfhcjx6458242lvkczlzjl0mf5j5y7k5g3m42",
+    "rev": "v2.13.0",
+    "sha256": "13337m20yxamdjpiw4kfi2ik4i5ivvr1fryygixpsj34lr21zxgk",
    "vendorSha256": null,
-    "version": "2.10.0"
+    "version": "2.13.0"
  },
  "azurerm": {
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/azurerm",
    "repo": "terraform-provider-azurerm",
-    "rev": "v2.86.0",
-    "sha256": "0p508qvqh0bg3x80i62i4p3q4nzgq0il651vrcg4c13lwynk2wcn",
+    "rev": "v2.90.0",
+    "sha256": "04bll0ygjgrqq18va97xi42p55fvlbgdc24m2i9amjhjbly5m7wn",
    "vendorSha256": null,
-    "version": "2.86.0"
+    "version": "2.90.0"
  },
  "azurestack": {
    "owner": "hashicorp",
@ -183,10 +183,10 @@
    "owner": "cloudflare",
    "provider-source-address": "registry.terraform.io/cloudflare/cloudflare",
    "repo": "terraform-provider-cloudflare",
-    "rev": "v3.4.0",
-    "sha256": "1w37wkpb785jfqq91piclcsrhy3idpbmwb90n5y7rkgmm37ij7ij",
-    "vendorSha256": "004pb5xnvisq3j113i6qfvnh1j06nkpkgzav3wb08k0bl19b6jks",
-    "version": "3.4.0"
+    "rev": "v3.6.0",
+    "sha256": "1adpzk9vjllr18dq8kggxfabm3ax59m55ls98mkqh8lmgq96bh7d",
+    "vendorSha256": "0qby6fa1x5fapgcy5i35dwwlkb2ggws9sxcssshzssy0fzpb3k87",
+    "version": "3.6.0"
  },
  "cloudinit": {
    "owner": "hashicorp",
@ -254,19 +254,19 @@
    "owner": "DataDog",
    "provider-source-address": "registry.terraform.io/DataDog/datadog",
    "repo": "terraform-provider-datadog",
-    "rev": "v3.6.0",
-    "sha256": "00j40m720m2kh0pn4953n8zis78g02ah9yjkcavcjkpxy4p899ma",
-    "vendorSha256": "1i5ph7p4pj5ph9rkynii50n3npjprrcsmd15i430wpyjxvsjnw8c",
-    "version": "3.6.0"
+    "rev": "v3.7.0",
+    "sha256": "0fynbn0zbplslbvqz0jij4gm8q6ydg697x7nh5rzw89dy26l2f8g",
+    "vendorSha256": "0ngvbc9h3csl811g40q707flf4dl1hal95hpkxsvz7p71s3371q8",
+    "version": "3.7.0"
  },
  "dhall": {
    "owner": "awakesecurity",
    "provider-source-address": "registry.terraform.io/awakesecurity/dhall",
    "repo": "terraform-provider-dhall",
-    "rev": "v0.0.1",
-    "sha256": "1cymabpa03a5avf0j6jj2mpnc62ap9b82zmpsgzwdjrb3mf954fa",
-    "vendorSha256": "0m11cpis171j9aicw0c66y4m1ckg41gjknj86qvblh57ai96gc1n",
-    "version": "0.0.1"
+    "rev": "v0.0.2",
+    "sha256": "1fw83ic5wwhl5yk1asy8p4cxsdwclw639j7ki1xgpi284h6gmh5a",
+    "vendorSha256": "1wqbblqpb1lpbsn4k9yh43g19iw13q825l5i9wvy4w0w4nzz70p4",
+    "version": "0.0.2"
  },
  "digitalocean": {
    "owner": "digitalocean",
@ -341,19 +341,19 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/external",
    "repo": "terraform-provider-external",
-    "rev": "v2.1.0",
-    "sha256": "0xc3mj0d4yrr1952c5ywrx19ny1k2475grka9v2w7szdy6p2rkk5",
-    "vendorSha256": null,
-    "version": "2.1.0"
+    "rev": "v2.1.1",
+    "sha256": "1f92cg2fjwy2n5380fx9j6j2bnsnkcy18kq0bjbkwkh8kmshqjn8",
+    "vendorSha256": "031knr4axrcwisbhzs39faykzc1jgm9hx4rhqk46wim950gifl7g",
+    "version": "2.1.1"
  },
  "fastly": {
    "owner": "fastly",
    "provider-source-address": "registry.terraform.io/fastly/fastly",
    "repo": "terraform-provider-fastly",
-    "rev": "v0.38.0",
-    "sha256": "1pfwpx83f5v12r9h2a89z8xvqpmwzsadzxx6wh0d1csdkdrr9z1n",
+    "rev": "v0.39.0",
+    "sha256": "0sjjcz2z7qr1dmm6zzyi382cas4k5vdg0q7yxlpcqxqqrql636k8",
    "vendorSha256": null,
-    "version": "0.38.0"
+    "version": "0.39.0"
  },
  "flexibleengine": {
    "owner": "terraform-providers",
@ -416,10 +416,10 @@
    "owner": "grafana",
    "provider-source-address": "registry.terraform.io/grafana/grafana",
    "repo": "terraform-provider-grafana",
-    "rev": "v1.14.0",
-    "sha256": "1d8w2a86m1q79f41ypgwg4i4w5269br1yvh437xiypvabajn7yjl",
-    "vendorSha256": "0gk0hk4f060hbl89ay1r91ayp5mwnc236x5jxvw4sgi2cq7mmns2",
-    "version": "1.14.0"
+    "rev": "v1.17.0",
+    "sha256": "10mj1dvz7q3w250hvi3k4rj2x0mn592gw2xcy1j98x5ll6kx4ynd",
+    "vendorSha256": "1bhygkkgd3j971cg6wha57cyh4ggbkaihw6sn6p9jvdi1k1f63lw",
+    "version": "1.17.0"
  },
  "gridscale": {
    "owner": "terraform-providers",
@ -487,10 +487,10 @@
    "owner": "IBM-Cloud",
    "provider-source-address": "registry.terraform.io/IBM-Cloud/ibm",
    "repo": "terraform-provider-ibm",
-    "rev": "v1.36.0",
-    "sha256": "09lhxh1cmg1k939gaksaqx11j06f971s1091wk03vivgfzrjy3hn",
-    "vendorSha256": "sha256-IjCLN/7EKenJbbHfBnRJh1LT3Ym/R2yEu+7zCnJ8Giw=",
-    "version": "1.36.0"
+    "rev": "v1.37.1",
+    "sha256": "1m9038ylv44xhgws0jrqdynj7kd97x9jgk1npqblbfv86fccwqxc",
+    "vendorSha256": "1a8zy023j3mcy3bswyrmllkgv61wiyxa1f7bfj8mxx3701rsb4ji",
+    "version": "1.37.1"
  },
  "icinga2": {
    "owner": "terraform-providers",
@ -648,10 +648,10 @@
    "owner": "equinix",
    "provider-source-address": "registry.terraform.io/equinix/metal",
    "repo": "terraform-provider-metal",
-    "rev": "v3.2.0",
-    "sha256": "07qdgxvdk564psb4v5d8saaak2037y04b3cj2p09m18fbam8cpry",
+    "rev": "v3.2.1",
+    "sha256": "0j07rras4m6i668lkvvn3rq5l67qfzk9bmpijsfk3my0zsgv8nvw",
    "vendorSha256": null,
-    "version": "3.2.0"
+    "version": "3.2.1"
  },
  "metalcloud": {
    "owner": "terraform-providers",
@ -747,10 +747,10 @@
    "owner": "terraform-providers",
    "provider-source-address": "registry.terraform.io/hashicorp/oci",
    "repo": "terraform-provider-oci",
-    "rev": "v4.53.0",
-    "sha256": "0vbi8k6mvcwvmjrs7walw1gfam77simvcr89gmh84jagvz0mngbw",
+    "rev": "v4.57.0",
+    "sha256": "123k24pa5232j9yxhgn6ng36s46y3iv4xsqay9ry53g4pw6zcx9y",
    "vendorSha256": null,
-    "version": "4.53.0"
+    "version": "4.57.0"
  },
  "okta": {
    "owner": "terraform-providers",
@ -791,10 +791,10 @@
    "owner": "terraform-provider-openstack",
    "provider-source-address": "registry.terraform.io/terraform-provider-openstack/openstack",
    "repo": "terraform-provider-openstack",
-    "rev": "v1.45.0",
-    "sha256": "0r769ckswcz6q3qmdxkvhqkq77x9qlv3359lvaplmkilk7zhpvcj",
-    "vendorSha256": "1wcls4kc19wy2nkwzrc1zc2lrlazfqr6dmfvzv9andldvd8swspg",
-    "version": "1.45.0"
+    "rev": "v1.46.0",
+    "sha256": "1kkqfr0i33kw0qj3dp5knxm14p1ndy72n4chd36dhkydp4rm688f",
+    "vendorSha256": "1f77z6p8423gh8x7zbhn3pkd8a1nxd5pabc1043d66pbw9rxchax",
+    "version": "1.46.0"
  },
  "opentelekomcloud": {
    "owner": "terraform-providers",
@ -902,12 +902,12 @@
  },
  "rancher2": {
    "owner": "rancher",
-    "provider-source-address": "registry.terraform.io/hashicorp/rancher2",
+    "provider-source-address": "registry.terraform.io/rancher/rancher2",
    "repo": "terraform-provider-rancher2",
-    "rev": "v1.13.0",
-    "sha256": "0xczv9qsviryiw95yd6cl1nnb0daxs971fm733gfvwm36jvmyr89",
-    "vendorSha256": "0apy6qbmshfj4pzz9nqdhyk6h7l9qwrccz30q8ljl928pj49q04c",
-    "version": "1.13.0"
+    "rev": "v1.22.1",
+    "sha256": "0sx24riks78ywxsrhvc18w3wppz676zv1bjmzvm7r4q94miplxgl",
+    "vendorSha256": "0qdd1sl9r6rpp9jmxy3r5a064f8agjmlkrn241p4sd7j5cncxdk3",
+    "version": "1.22.1"
  },
  "random": {
    "owner": "hashicorp",
@ -947,11 +947,13 @@
    "version": "1.15.0"
  },
  "secret": {
-    "owner": "tweag",
+    "owner": "numtide",
+    "provider-source-address": "registry.terraform.io/numtide/secret",
    "repo": "terraform-provider-secret",
-    "rev": "v1.1.1",
-    "sha256": "1pr0amzgv1i1lxniqlx8spdb73q522l7pm8a4m25hwy1kwby37sd",
-    "version": "1.1.1"
+    "rev": "v1.2.0",
+    "sha256": "1211vvcd00llajza3chw25h0sl43wl116ni4r251k00m6kb5nfwq",
+    "vendorSha256": null,
+    "version": "1.2.0"
  },
  "segment": {
    "owner": "ajbosco",
@ -1010,9 +1012,10 @@
    "owner": "carlpett",
    "provider-source-address": "registry.terraform.io/carlpett/sops",
    "repo": "terraform-provider-sops",
-    "rev": "v0.5.1",
-    "sha256": "1x32w1qw46rwa8bjhkfn6ybr1dkbdqk0prlm0bnwn3gvvj0hc7kh",
-    "version": "0.5.1"
+    "rev": "v0.6.3",
+    "sha256": "1db67jcgpg279hq4vfk1xhql0msn9fy95m8fdi1cxv54y7zcxwf9",
+    "vendorSha256": "1haw17k6xg3n6hbx3pj8ysyhq35k3lis1qq65qnyskl62y1ia54h",
+    "version": "0.6.3"
  },
  "spotinst": {
    "owner": "terraform-providers",
@ -1129,10 +1132,10 @@
    "owner": "hashicorp",
    "provider-source-address": "registry.terraform.io/hashicorp/vault",
    "repo": "terraform-provider-vault",
-    "rev": "v3.0.1",
-    "sha256": "0ppx8kc4zf0yp09vbkmj875sqvklbx0p8a1ganpzdm3462zskra4",
-    "vendorSha256": "03l8bk9jsqf4c7gv0hs1rli7wmlcvpdxmxhra9vndnz6g0jvkvyx",
-    "version": "3.0.1"
+    "rev": "v3.1.1",
+    "sha256": "15fwc0sfdpcl85194gq6r97y18ggh61wbyh6lq7nrprwn2xvjch9",
+    "vendorSha256": "1q2yfmg6g3bl6h0vzanz7874xc4g7ggmysh2dqryijvr4kccnari",
+    "version": "3.1.1"
  },
  "vcd": {
    "owner": "terraform-providers",
--- a/pkgs/applications/networking/cluster/tilt/default.nix
+++ b/pkgs/applications/networking/cluster/tilt/default.nix
@ -5,13 +5,13 @@ buildGoModule rec {
  /* Do not use "dev" as a version. If you do, Tilt will consider itself
    running in development environment and try to serve assets from the
    source tree, which is not there once build completes.  */
-  version = "0.23.3";
+  version = "0.23.4";

  src = fetchFromGitHub {
    owner  = "tilt-dev";
    repo   = pname;
    rev    = "v${version}";
-    sha256 = "sha256:1612yrlsajl1j95zh057k82nzz492a9p1cgamph4m84zpm0v67jc";
+    sha256 = "sha256-SWofXsbkuirPvqgU639W8IQklafLKbThoZUzOzfYwdQ=";
  };
  vendorSha256 = null;

--- a/pkgs/applications/networking/instant-messengers/jackline/default.nix
+++ b/pkgs/applications/networking/instant-messengers/jackline/default.nix
@ -4,7 +4,7 @@ with ocamlPackages;

 buildDunePackage rec {
  pname = "jackline";
-  version = "unstable-2021-08-10";
+  version = "unstable-2021-12-28";

  minimumOCamlVersion = "4.08";

@ -13,8 +13,8 @@ buildDunePackage rec {
  src = fetchFromGitHub {
    owner  = "hannesm";
    repo   = "jackline";
-    rev    = "73d87e9a62d534566bb0fbe64990d32d75487f11";
-    sha256 = "0wk574rqfg2vqz27nasxzwf67x51pj5fgl4vkc27r741dg4q6c5a";
+    rev    = "ca1012098d123c555e9fa5244466d2e009521700";
+    sha256 = "1j1azskcdrp4g44rv3a4zylkzbzpcs23zzzrx94llbgssw6cd9ih";
  };

  nativeBuildInpts = [
--- a/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
+++ b/pkgs/applications/networking/instant-messengers/skypeforlinux/default.nix
@ -7,7 +7,7 @@ let

  # Please keep the version x.y.0.z and do not update to x.y.76.z because the
  # source of the latter disappears much faster.
-  version = "8.79.0.92";
+  version = "8.79.0.95";

  rpath = lib.makeLibraryPath [
    alsa-lib
@ -69,7 +69,7 @@ let
          "https://mirror.cs.uchicago.edu/skype/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
          "https://web.archive.org/web/https://repo.skype.com/deb/pool/main/s/skypeforlinux/skypeforlinux_${version}_amd64.deb"
        ];
-        sha256 = "sha256-wGt0zNBmJf5NJGGOopWNUoBoy8sr4jWp8UKLd8AudnM=";
+        sha256 = "sha256-a6ZtgA0cMAuNVQWAeiIDJ2noPhXjV8KPE8ibkGR7Dns=";
      }
    else
      throw "Skype for linux is not supported on ${stdenv.hostPlatform.system}";
--- a/pkgs/applications/networking/remote/teamviewer/default.nix
+++ b/pkgs/applications/networking/remote/teamviewer/default.nix
@ -6,11 +6,11 @@

 mkDerivation rec {
  pname = "teamviewer";
-  version = "15.24.5";
+  version = "15.25.5";

  src = fetchurl {
    url = "https://dl.tvcdn.de/download/linux/version_15x/teamviewer_${version}_amd64.deb";
-    sha256 = "sha256-u4azVjwD5xTc0vWe8tDEx44rBdYFZljZPVQ0yilqeR0=";
+    sha256 = "sha256-LtITPS0bLy85dv/zdOo8JcsEZ0ZgtVmM+CcggaYJxXA=";
  };

  unpackPhase = ''
--- a/pkgs/applications/networking/sniffers/wireshark/default.nix
+++ b/pkgs/applications/networking/sniffers/wireshark/default.nix
@ -10,7 +10,7 @@ assert withQt  -> qt5  != null;
 with lib;

 let
-  version = "3.4.10";
+  version = "3.6.1";
  variant = if withQt then "qt" else "cli";

 in stdenv.mkDerivation {
@ -20,7 +20,7 @@ in stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.wireshark.org/download/src/all-versions/wireshark-${version}.tar.xz";
-    sha256 = "sha256-iqfvSkSuYruNtGPPdh4swDuXMF4Od+1b5T+oNykYfO8=";
+    sha256 = "sha256-BDTtqPtr+I4rQqZ+tdHeJUpn1QW+w7tR/unXyteSWjg=";
  };

  cmakeFlags = [
@ -67,18 +67,18 @@ in stdenv.mkDerivation {
        done
    done
  '' else optionalString withQt ''
-    install -Dm644 -t $out/share/applications ../wireshark.desktop
+    install -Dm644 -t $out/share/applications ../org.wireshark.Wireshark.desktop

    install -Dm644 ../image/wsicon.svg $out/share/icons/wireshark.svg
-    mkdir $dev/include/{epan/{wmem,ftypes,dfilter},wsutil,wiretap} -pv
+    mkdir $dev/include/{epan/{wmem,ftypes,dfilter},wsutil/wmem,wiretap} -pv

    cp config.h $dev/include/wireshark/
    cp ../ws_*.h $dev/include
    cp ../epan/*.h $dev/include/epan/
-    cp ../epan/wmem/*.h $dev/include/epan/wmem/
    cp ../epan/ftypes/*.h $dev/include/epan/ftypes/
    cp ../epan/dfilter/*.h $dev/include/epan/dfilter/
    cp ../wsutil/*.h $dev/include/wsutil/
+    cp ../wsutil/wmem/*.h $dev/include/wsutil/wmem/
    cp ../wiretap/*.h $dev/include/wiretap
  '');

--- a/pkgs/applications/networking/sniffers/wireshark/wireshark-lookup-dumpcap-in-path.patch
+++ b/pkgs/applications/networking/sniffers/wireshark/wireshark-lookup-dumpcap-in-path.patch
@ -11,16 +11,18 @@ Also change execv() to execvp() because we've set argv[0] to "dumpcap"
 and have to enable PATH lookup. Wireshark is not a setuid program, so
 looking in PATH is not a security issue.

+EDITED by teto for wireshark 3.6
+
 Signed-off-by: Franz Pletz <fpletz@fnordicwalking.de>
 ---
 capchild/capture_sync.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

 diff --git a/capchild/capture_sync.c b/capchild/capture_sync.c
-index 970688e..49914d5 100644
--- a/capchild/capture_sync.c
-+++ b/capchild/capture_sync.c
-@@ -332,7 +332,18 @@ init_pipe_args(int *argc) {
+index f31914886a..df29b6f0ab 100644
+--- a/capture/capture_sync.c
+++ b/capture/capture_sync.c
+@@ -187,7 +187,18 @@ init_pipe_args(int *argc) {
 #ifdef _WIN32
     exename = g_strdup_printf("%s\\dumpcap.exe", progfile_dir);
 #else
@ -40,7 +42,7 @@ index 970688e..49914d5 100644
 #endif
 
     /* Make that the first argument in the argument list (argv[0]). */
-@@ -729,7 +740,7 @@ sync_pipe_start(capture_options *capture_opts, capture_session *cap_session, voi
+@@ -572,7 +583,7 @@ sync_pipe_start(capture_options *capture_opts, capture_session *cap_session, inf
          */
         dup2(sync_pipe[PIPE_WRITE], 2);
         ws_close(sync_pipe[PIPE_READ]);
@ -49,7 +51,7 @@ index 970688e..49914d5 100644
         g_snprintf(errmsg, sizeof errmsg, "Couldn't run %s in child process: %s",
                    argv[0], g_strerror(errno));
         sync_pipe_errmsg_to_parent(2, errmsg, "");
-@@ -997,7 +1008,7 @@ sync_pipe_open_command(char** argv, int *data_read_fd,
+@@ -811,7 +822,7 @@ sync_pipe_open_command(char* const argv[], int *data_read_fd,
         dup2(sync_pipe[PIPE_WRITE], 2);
         ws_close(sync_pipe[PIPE_READ]);
         ws_close(sync_pipe[PIPE_WRITE]);
@ -58,6 +60,3 @@ index 970688e..49914d5 100644
         g_snprintf(errmsg, sizeof errmsg, "Couldn't run %s in child process: %s",
                    argv[0], g_strerror(errno));
         sync_pipe_errmsg_to_parent(2, errmsg, "");
-- 
-2.6.3
-
--- a/pkgs/applications/office/super-productivity/default.nix
+++ b/pkgs/applications/office/super-productivity/default.nix
@ -1,15 +1,12 @@
-{ stdenv , lib , fetchurl , appimageTools , makeWrapper , electron_11 }:
+{ stdenv , lib , fetchurl , appimageTools , makeWrapper , electron }:

-let
-  electron = electron_11;
-in
 stdenv.mkDerivation rec {
  pname = "super-productivity";
-  version = "7.6.0";
+  version = "7.9.1";

  src = fetchurl {
    url = "https://github.com/johannesjo/super-productivity/releases/download/v${version}/superProductivity-${version}.AppImage";
-    sha256 = "f02a451a44f48a8e85a0c1269625d89fb1e0b8a75b7e217d96352064e6464ae5";
+    sha256 = "sha256:0lxnl5ai23dwfsyrkpi9l1a0gl0qn6vp7hzmca77nyx974d6j8m4";
    name = "${pname}-${version}.AppImage";
  };

--- a/pkgs/applications/radio/gqrx/default.nix
+++ b/pkgs/applications/radio/gqrx/default.nix
@ -24,13 +24,13 @@ assert !(pulseaudioSupport && portaudioSupport);

 gnuradio3_8Minimal.pkgs.mkDerivation rec {
  pname = "gqrx";
-  version = "2.15";
+  version = "2.15.1";

  src = fetchFromGitHub {
    owner = "gqrx-sdr";
    repo = "gqrx";
    rev = "v${version}";
-    sha256 = "sha256-m3YV5Hbu5+3eS+LOy+x6HjpdiJo1iObbeEKuQXXmAak=";
+    sha256 = "sha256-OL83l3A27rggfGbfLT1CUaPAQHEKXgoGS1jYJZ9eHPQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/radio/urh/default.nix
+++ b/pkgs/applications/radio/urh/default.nix
@ -1,5 +1,6 @@
 { lib, fetchFromGitHub, python3Packages
 , hackrf, rtl-sdr, airspy, limesuite, libiio
+, libbladeRF
 , qt5
 , USRPSupport ? false, uhd }:

@ -15,7 +16,7 @@ python3Packages.buildPythonApplication rec {
  };

  nativeBuildInputs = [ qt5.wrapQtAppsHook ];
-  buildInputs = [ hackrf rtl-sdr airspy limesuite libiio ]
+  buildInputs = [ hackrf rtl-sdr airspy limesuite libiio libbladeRF ]
    ++ lib.optional USRPSupport uhd;

  propagatedBuildInputs = with python3Packages; [
--- a/pkgs/applications/science/astronomy/stellarium/default.nix
+++ b/pkgs/applications/science/astronomy/stellarium/default.nix
@ -6,13 +6,13 @@

 mkDerivation rec {
  pname = "stellarium";
-  version = "0.21.2";
+  version = "0.21.3";

  src = fetchFromGitHub {
    owner = "Stellarium";
    repo = "stellarium";
    rev = "v${version}";
-    sha256 = "sha256-bh00o++l3sqELX5kgRhiCcQOLVqvjEyEMcJTnnVPNU8=";
+    sha256 = "sha256-TQMLy5ziBF7YqPDzPwgjY5FHxxMUe7MXo/TGxQ1nGcg=";
  };

  nativeBuildInputs = [ cmake perl wrapQtAppsHook ];
--- a/pkgs/applications/science/chemistry/jmol/default.nix
+++ b/pkgs/applications/science/chemistry/jmol/default.nix
@ -17,14 +17,14 @@ let
  };
 in
 stdenv.mkDerivation rec {
-  version = "14.32.2";
+  version = "14.32.6";
  pname = "jmol";

  src = let
    baseVersion = "${lib.versions.major version}.${lib.versions.minor version}";
  in fetchurl {
    url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${version}/Jmol-${version}-binary.tar.gz";
-    sha256 = "sha256-JETS1mxlDyWPC8ngtmYujmfWIdrW9HzkqpX/VZpIMBE=";
+    sha256 = "sha256-b9E/IJfqeA8rBSQogb/ZVBMW3y9bc2dBj/BIl0HWFR8=";
  };

  patchPhase = ''
--- a/pkgs/applications/science/math/singular/default.nix
+++ b/pkgs/applications/science/math/singular/default.nix
@ -47,12 +47,13 @@ stdenv.mkDerivation rec {
  };

  patches = [
+    # fix timeouts when docbuilding with >= 64 cpus
+    # https://github.com/Singular/Singular/issues/1117
+    ./vspace-MAX_PROCESS.patch
+
    # add aarch64 support to cpu-check.m4. copied from redhat.
    ./redhat-aarch64.patch

-    # vspace causes hangs in modstd and other libraries on aarch64
-    ./disable-vspace-on-aarch64.patch
-
    # the newest version of ax-prog-cc-for-build.m4 seems to trigger
    # linker errors. see
    # https://github.com/alsa-project/alsa-firmware/issues/3 for a
--- a/pkgs/applications/science/math/singular/disable-vspace-on-aarch64.patch
+++ b/pkgs/applications/science/math/singular/disable-vspace-on-aarch64.patch
@ -1,15 +0,0 @@
-diff --git a/kernel/mod2.h b/kernel/mod2.h
-index 867fcae47..2abd84f23 100644
--- a/kernel/mod2.h
-+++ b/kernel/mod2.h
-@@ -60,8 +60,10 @@
- 
- /* define for parallel processes with shared memory */
- #ifndef __CCYGWIN__
-+#ifndef SI_CPU_AARCH64
- #define HAVE_VSPACE 1
- #endif
-+#endif
- 
- /*#define PROFILING*/
- #ifdef PROFILING
--- a/pkgs/applications/science/math/singular/vspace-MAX_PROCESS.patch
+++ b/pkgs/applications/science/math/singular/vspace-MAX_PROCESS.patch
@ -0,0 +1,35 @@
+diff --git a/kernel/GBEngine/kChinese.cc b/kernel/GBEngine/kChinese.cc
+index 829a66609..84655caf2 100644
+--- a/kernel/GBEngine/kChinese.cc
+++ b/kernel/GBEngine/kChinese.cc
+@@ -209,6 +209,8 @@ ideal id_ChineseRemainder_0(ideal *xx, number *q, int rl, const ring r)
+     return NULL;
+   }
+   int cpus=(int)(long)feOptValue(FE_OPT_CPUS);
+  if (cpus>=vspace::internals::MAX_PROCESS)
+    cpus=vspace::internals::MAX_PROCESS-1;
+   if ((cpus==1) || (2*cpus>=cnt))
+     /* at least 2 polys for each process, or switch to seriell version */
+     return id_ChineseRemainder(xx,q,rl,r);
+@@ -295,6 +297,8 @@ ideal id_Farey_0(ideal x, number N, const ring r)
+ {
+   int cnt=IDELEMS(x)*x->nrows;
+   int cpus=(int)(long)feOptValue(FE_OPT_CPUS);
+  if (cpus>=vspace::internals::MAX_PROCESS)
+    cpus=vspace::internals::MAX_PROCESS-1;
+   if (2*cpus>=cnt) /* at least 2 polys for each process, 
+                      or switch to seriell version */
+     return id_Farey(x,N,r);
+diff --git a/kernel/GBEngine/kverify.cc b/kernel/GBEngine/kverify.cc
+index 909d84994..aa06d6624 100644
+--- a/kernel/GBEngine/kverify.cc
+++ b/kernel/GBEngine/kverify.cc
+@@ -176,6 +176,8 @@ BOOLEAN kVerify2(ideal F, ideal Q)
+   /*---------------------------------------------------------------------*/
+   BOOLEAN all_okay=TRUE;
+   int cpus=(int)(long)feOptValue(FE_OPT_CPUS);
+  if (cpus>=vspace::internals::MAX_PROCESS)
+    cpus=vspace::internals::MAX_PROCESS-1;
+   int parent_pid=getpid();
+   using namespace vspace;
+   vmem_init();
--- a/pkgs/applications/science/math/speedcrunch/default.nix
+++ b/pkgs/applications/science/math/speedcrunch/default.nix
@ -1,14 +1,14 @@
-{ mkDerivation, lib, fetchgit, cmake, qtbase, qttools }:
+{ mkDerivation, lib, fetchFromBitbucket, cmake, qtbase, qttools }:

 mkDerivation rec {
  pname = "speedcrunch";
-  version = "0.12.0";
+  version = "unstable-2021-10-09";

-  src = fetchgit {
-    # the tagging is not standard, so you probably need to check this when updating
-    rev = "refs/tags/release-${version}";
-    url = "https://bitbucket.org/heldercorreia/speedcrunch";
-    sha256 = "0vh7cd1915bjqzkdp3sk25ngy8cq624mkh8c53c5bnzk357kb0fk";
+  src = fetchFromBitbucket {
+    owner = "heldercorreia";
+    repo = pname;
+    rev = "74756f3438149c01e9edc3259b0f411fa319a22f";
+    sha256 = "sha256-XxQv+A5SfYXFIRK7yacxGHHne1Q93pwCGeHhchIKizU=";
  };

  buildInputs = [ qtbase qttools ];
@ -29,7 +29,7 @@ mkDerivation rec {
      precisions, unlimited variable storage, intelligent automatic completion
      full keyboard-friendly and more than 15 built-in math function.
    '';
-    maintainers = with maintainers; [ gebner ];
+    maintainers = with maintainers; [ gebner j0hax ];
    inherit (qtbase.meta) platforms;
    # works with qt 5.6 and qt 5.8
    broken = builtins.compareVersions qtbase.version "5.7.0" == 0;
--- a/pkgs/applications/version-management/git-and-tools/git-chglog/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-chglog/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "git-chglog";
-  version = "0.15.0";
+  version = "0.15.1";

  src = fetchFromGitHub {
    owner = "git-chglog";
    repo = "git-chglog";
    rev = "v${version}";
-    sha256 = "sha256-BiTnPCgymfpPxuy0i8u7JbpbEBeaSIJaikjwsPSA3qc=";
+    sha256 = "sha256-UlhJ004ceXpdB/9296cL2sbBYsjV8D+3YS1vmFgnko8=";
  };

-  vendorSha256 = "sha256-jIq+oacyT71m78iMZwWOBsBVAY/WxgyH9zRr8GiMGTU=";
+  vendorSha256 = "sha256-FLFPcmkrhZ+/UX1xpexsDv3cgC/Ocj4qTFJOX+rmdyQ=";

  ldflags = [ "-s" "-w" "-X=main.Version=v${version}" ];

--- a/pkgs/applications/version-management/git-and-tools/git-cliff/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-cliff/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "git-cliff";
-  version = "0.4.2";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "orhun";
    repo = "git-cliff";
    rev = "v${version}";
-    sha256 = "sha256-FCBNm51QI1jDdq2BZFwZA1kpIfXIvh1ickmY3ZqwGPY=";
+    sha256 = "sha256-1ScZ8pxRN/Eot/Q+HWbWOgDWBmVLjqtPeftRsNQIJEI=";
  };

-  cargoSha256 = "sha256-CBCyujJHWTatJO+Tk6MyOk12B0cY1JSwLQizjcXeQzQ=";
+  cargoSha256 = "sha256-FMlJn/mVcrHhu3gGISb1e7D2mVAocccqXRYZnMVNPqA=";

  # attempts to run the program on .git in src which is not deterministic
  doCheck = false;
--- a/pkgs/applications/video/kodi/addons/inputstream-rtmp/default.nix
+++ b/pkgs/applications/video/kodi/addons/inputstream-rtmp/default.nix
@ -3,13 +3,13 @@
 buildKodiBinaryAddon rec {
  pname = "inputstream-rtmp";
  namespace = "inputstream.rtmp";
-  version = "19.0.0";
+  version = "19.0.1";

  src = fetchFromGitHub {
    owner = "xbmc";
    repo = "inputstream.rtmp";
    rev = "${version}-${rel}";
-    sha256 = "sha256-76yGttcLJJ5XJKsFJ3GnEuPs9+9J0Tr8Znm45676OI8=";
+    sha256 = "sha256-BNc9HJ4Yq1WTxTr7AUHBB9yDz8oefy2EtFRwVYVGcaY=";
  };

  extraBuildInputs = [ openssl rtmpdump zlib ];
--- a/pkgs/applications/video/qmplay2/default.nix
+++ b/pkgs/applications/video/qmplay2/default.nix
@ -22,13 +22,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "qmplay2";
-  version = "21.12.07";
+  version = "21.12.24";

  src = fetchFromGitHub {
    owner = "zaps166";
    repo = "QMPlay2";
    rev = version;
-    sha256 = "sha256-iFT88CTz7L7tnNmpe/HaeTrHiE8l0Jk+r0c6O7wJ7N8=";
+    sha256 = "sha256-SHReKh+M1rgSIiweYFgVvwMeKWeQD52S4KxEiTsyHrI=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/video/xine-ui/default.nix
+++ b/pkgs/applications/video/xine-ui/default.nix
@ -15,11 +15,11 @@

 stdenv.mkDerivation rec {
  pname = "xine-ui";
-  version = "0.99.12";
+  version = "0.99.13";

  src = fetchurl {
    url = "mirror://sourceforge/xine/${pname}-${version}.tar.xz";
-    sha256 = "10zmmss3hm8gjjyra20qhdc0lb1m6sym2nb2w62bmfk8isfw9gsl";
+    sha256 = "sha256-sjgtB1xysbEAOeDpAxDMhsjZEDWMU1We2C09WEIB9cU=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/window-managers/leftwm/default.nix
+++ b/pkgs/applications/window-managers/leftwm/default.nix
@ -6,16 +6,16 @@ in

 rustPlatform.buildRustPackage rec {
  pname = "leftwm";
-  version = "0.2.9";
+  version = "0.2.10";

  src = fetchFromGitHub {
    owner = "leftwm";
    repo = "leftwm";
    rev = version;
-    sha256 = "sha256:0w4afhrp2cxz0nmpvalyaxz1dpywajjj2wschw8dpkvgxqs64gd5";
+    sha256 = "sha256-WGss/XmryULq8Ly5MFmEqsL+9r4fnrvBEtetngJ05NY=";
  };

-  cargoSha256 = "sha256:0r0smpv50gim2naaa0qf6yhvqvsa2f40rkgiryi686y69m5ii7mv";
+  cargoSha256 = "sha256-9qvXzsAu4H2TAcArajrGqXwKF3BBDvmZbny7hiVO9Yo=";

  buildInputs = rpathLibs;

--- a/pkgs/build-support/build-dotnet-module/default.nix
+++ b/pkgs/build-support/build-dotnet-module/default.nix
@ -117,40 +117,42 @@ let
    DOTNET_NOLOGO = true; # This disables the welcome message.
    DOTNET_CLI_TELEMETRY_OPTOUT = true;

-    passthru.fetch-deps = args.passthru.fetch-deps or writeScript "fetch-${args.pname}-deps" ''
-      set -euo pipefail
-      cd "$(dirname "''${BASH_SOURCE[0]}")"
+    passthru = {
+      fetch-deps = writeScript "fetch-${args.pname}-deps" ''
+        set -euo pipefail
+        cd "$(dirname "''${BASH_SOURCE[0]}")"

-      export HOME=$(mktemp -d)
-      deps_file="/tmp/${args.pname}-deps.nix"
+        export HOME=$(mktemp -d)
+        deps_file="/tmp/${args.pname}-deps.nix"

-      store_src="${package.src}"
-      src="$(mktemp -d /tmp/${args.pname}.XXX)"
-      cp -rT "$store_src" "$src"
-      chmod -R +w "$src"
+        store_src="${package.src}"
+        src="$(mktemp -d /tmp/${args.pname}.XXX)"
+        cp -rT "$store_src" "$src"
+        chmod -R +w "$src"

-      trap "rm -rf $src $HOME" EXIT
-      pushd "$src"
+        trap "rm -rf $src $HOME" EXIT
+        pushd "$src"

-      export DOTNET_NOLOGO=1
-      export DOTNET_CLI_TELEMETRY_OPTOUT=1
+        export DOTNET_NOLOGO=1
+        export DOTNET_CLI_TELEMETRY_OPTOUT=1

-      mkdir -p "$HOME/nuget_pkgs"
+        mkdir -p "$HOME/nuget_pkgs"

-      for project in "${lib.concatStringsSep "\" \"" ((lib.toList projectFile) ++ lib.optionals (testProjectFile != "") (lib.toList testProjectFile))}"; do
-        ${dotnet-sdk}/bin/dotnet restore "$project" \
-          ${lib.optionalString (!enableParallelBuilding) "--disable-parallel"} \
-          -p:ContinuousIntegrationBuild=true \
-          -p:Deterministic=true \
-          --packages "$HOME/nuget_pkgs" \
-          "''${dotnetRestoreFlags[@]}" \
-          "''${dotnetFlags[@]}"
-      done
+        for project in "${lib.concatStringsSep "\" \"" ((lib.toList projectFile) ++ lib.optionals (testProjectFile != "") (lib.toList testProjectFile))}"; do
+          ${dotnet-sdk}/bin/dotnet restore "$project" \
+            ${lib.optionalString (!enableParallelBuilding) "--disable-parallel"} \
+            -p:ContinuousIntegrationBuild=true \
+            -p:Deterministic=true \
+            --packages "$HOME/nuget_pkgs" \
+            "''${dotnetRestoreFlags[@]}" \
+            "''${dotnetFlags[@]}"
+        done

-      echo "Writing lockfile..."
-      ${nuget-to-nix}/bin/nuget-to-nix "$HOME/nuget_pkgs" > "$deps_file"
-      echo "Succesfully wrote lockfile to: $deps_file"
-    '';
+        echo "Writing lockfile..."
+        ${nuget-to-nix}/bin/nuget-to-nix "$HOME/nuget_pkgs" > "$deps_file"
+        echo "Succesfully wrote lockfile to: $deps_file"
+      '';
+    } // args.passthru or {};

    configurePhase = args.configurePhase or ''
      runHook preConfigure
--- a/pkgs/build-support/node/fetch-yarn-deps/index.js
+++ b/pkgs/build-support/node/fetch-yarn-deps/index.js
@ -9,6 +9,7 @@ const child_process = require('child_process')
 const path = require('path')
 const lockfile = require('./yarnpkg-lockfile.js')
 const { promisify } = require('util')
+const url = require('url')

 const execFile = promisify(child_process.execFile)

@ -21,15 +22,15 @@ const exec = async (...args) => {
 // This has to match the logic in pkgs/development/tools/yarn2nix-moretea/yarn2nix/lib/urlToName.js
 // so that fixup_yarn_lock produces the same paths
 const urlToName = url => {
-  const isCodeloadGitTarballUrl = url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')
+	const isCodeloadGitTarballUrl = url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')

-  if (url.startsWith('git+') || isCodeloadGitTarballUrl) {
-    return path.basename(url)
-  } else {
-    return url
-      .replace(/https:\/\/(.)*(.com)\//g, '') // prevents having long directory names
-      .replace(/[@/%:-]/g, '_') // replace @ and : and - and % characters with underscore
-  }
+	if (url.startsWith('git+') || isCodeloadGitTarballUrl) {
+		return path.basename(url)
+	} else {
+		return url
+			.replace(/https:\/\/(.)*(.com)\//g, '') // prevents having long directory names
+			.replace(/[@/%:-]/g, '_') // replace @ and : and - and % characters with underscore
+	}
 }

 const downloadFileHttps = (fileName, url, expectedHash) => {
@ -72,6 +73,23 @@ const downloadGit = async (fileName, url, rev) => {
 	await exec('rm', [ '-rf', fileName + '.tmp', ])
 }

+const isGitUrl = pattern => {
+	// https://github.com/yarnpkg/yarn/blob/3119382885ea373d3c13d6a846de743eca8c914b/src/resolvers/exotics/git-resolver.js#L15-L47
+	const GIT_HOSTS = ['github.com', 'gitlab.com', 'bitbucket.com', 'bitbucket.org']
+	const GIT_PATTERN_MATCHERS = [/^git:/, /^git\+.+:/, /^ssh:/, /^https?:.+\.git$/, /^https?:.+\.git#.+/]
+
+	for (const matcher of GIT_PATTERN_MATCHERS) if (matcher.test(pattern)) return true
+
+	const {hostname, path} = url.parse(pattern)
+	if (hostname && path && GIT_HOSTS.indexOf(hostname) >= 0
+		// only if dependency is pointing to a git repo,
+		// e.g. facebook/flow and not file in a git repo facebook/flow/archive/v1.0.0.tar.gz
+		&& path.split('/').filter(p => !!p).length === 2
+	) return true
+
+	return false
+}
+
 const downloadPkg = (pkg, verbose) => {
 	const [ url, hash ] = pkg.resolved.split('#')
 	if (verbose) console.log('downloading ' + url)
@ -79,12 +97,10 @@ const downloadPkg = (pkg, verbose) => {
 	if (url.startsWith('https://codeload.github.com/') && url.includes('/tar.gz/')) {
 		const s = url.split('/')
 		downloadGit(fileName, `https://github.com/${s[3]}/${s[4]}.git`, s[6])
+	} else if (isGitUrl(url)) {
+		return downloadGit(fileName, url.replace(/^git\+/, ''), hash)
 	} else if (url.startsWith('https://')) {
 		return downloadFileHttps(fileName, url, hash)
-	} else if (url.startsWith('git:')) {
-		return downloadGit(fileName, url.replace(/^git\+/, ''), hash)
-	} else if (url.startsWith('git+')) {
-		return downloadGit(fileName, url.replace(/^git\+/, ''), hash)
 	} else if (url.startsWith('file:')) {
 		console.warn(`ignoring unsupported file:path url "${url}"`)
 	} else {
--- a/pkgs/data/fonts/cascadia-code/default.nix
+++ b/pkgs/data/fonts/cascadia-code/default.nix
@ -1,13 +1,13 @@
 { lib, fetchzip }:
 let
-  version = "2110.31";
+  version = "2111.01";
 in
 fetchzip {
  name = "cascadia-code-${version}";

  url = "https://github.com/microsoft/cascadia-code/releases/download/v${version}/CascadiaCode-${version}.zip";

-  sha256 = "sha256-SyPQtmudfogBwASTApl1hSpOPf2PLTSOzhJAJzrQ3Mg=";
+  sha256 = "sha256-kUVTQ/oMZztNf22sDbQBpQW0luSc5nr5sxWU5etLDec=";

  postFetch = ''
    mkdir -p $out/share/fonts/
--- a/pkgs/data/fonts/sarasa-gothic/default.nix
+++ b/pkgs/data/fonts/sarasa-gothic/default.nix
@ -1,14 +1,14 @@
 { lib, fetchurl, libarchive }:

 let
-  version = "0.35.2";
+  version = "0.35.5";
 in fetchurl {
  name = "sarasa-gothic-${version}";

  # Use the 'ttc' files here for a smaller closure size.
  # (Using 'ttf' files gives a closure size about 15x larger, as of November 2021.)
  url = "https://github.com/be5invis/Sarasa-Gothic/releases/download/v${version}/sarasa-gothic-ttc-${version}.7z";
-  sha256 = "sha256-ts6GM09Z7hYHVx/JGxVPze5X1sZ/22TTdxHBGiYMn5I=";
+  sha256 = "sha256-t9BYV9a/rmEr8nLqcdxg4Z5pWsCefvwI47eSwub41u0=";

  recursiveHash = true;
  downloadToTemp = true;
--- a/pkgs/development/compilers/carp/default.nix
+++ b/pkgs/development/compilers/carp/default.nix
@ -2,13 +2,13 @@

 haskellPackages.mkDerivation rec {
  pname = "carp";
-  version = "0.5.3";
+  version = "0.5.4";

  src = fetchFromGitHub {
    owner = "carp-lang";
    repo = "Carp";
    rev = "v${version}";
-    sha256 = "08ryk30ii24qsdpdq7bqi406ynv9nr8zy2pcv9n70ar8fxfw0859";
+    sha256 = "sha256-o7NLd7jC1BvcoVzbD18LvHg/SqOnfn9yELUrpg2uZtY=";
  };

  buildTools = [ makeWrapper ];
--- a/pkgs/development/compilers/elm/default.nix
+++ b/pkgs/development/compilers/elm/default.nix
@ -1,10 +1,13 @@
 { lib, stdenv, pkgs
-, haskell, haskellPackages, nodejs
+, haskell, haskellPackages, nodejs-14_x
 , fetchurl, fetchpatch, makeWrapper, writeScriptBin
  # Rust dependecies
 , curl, rustPlatform, openssl, pkg-config, Security, darwin
 }:
 let
+  # To controll nodejs version we pass down
+  nodejs = nodejs-14_x;
+
  fetchElmDeps = import ./fetchElmDeps.nix { inherit stdenv lib fetchurl; };

  hsPkgs = haskellPackages.override {
--- a/pkgs/development/compilers/elm/packages/generate-node-packages.sh
+++ b/pkgs/development/compilers/elm/packages/generate-node-packages.sh
@ -4,9 +4,7 @@ ROOT="$(realpath "$(dirname -- "$(readlink -f -- "${BASH_SOURCE[0]}")")"/../../.

 set -eu -o pipefail

-rm -f node-env.nix
 $(nix-build $ROOT -A nodePackages.node2nix --no-out-link)/bin/node2nix \
-    --nodejs-12 \
    -i node-packages.json \
    -o node-packages.nix \
    -c node-composition.nix \
--- a/pkgs/development/compilers/elm/packages/node-packages.nix
+++ b/pkgs/development/compilers/elm/packages/node-packages.nix
--- a/pkgs/development/compilers/fasm/bin.nix
+++ b/pkgs/development/compilers/fasm/bin.nix
@ -3,11 +3,11 @@
 stdenvNoCC.mkDerivation rec {
  pname = "fasm-bin";

-  version = "1.73.28";
+  version = "1.73.29";

  src = fetchurl {
    url = "https://flatassembler.net/fasm-${version}.tgz";
-    sha256 = "sha256-ntHrtIX9EXQRGpTrdzEFojSRE5jgUJD15xSr9iyAkpI=";
+    sha256 = "sha256-Yyj02DRo9wTkJ01ukOwElHr1ZyZFPOMTibwyAkqYISs=";
  };

  installPhase = ''
--- a/pkgs/development/compilers/fstar/default.nix
+++ b/pkgs/development/compilers/fstar/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "fstar";
-  version = "2021.11.27";
+  version = "2021.12.25";

  src = fetchFromGitHub {
    owner = "FStarLang";
    repo = "FStar";
    rev = "v${version}";
-    sha256 = "sha256-OpY7vDb37ym4srsmD+deXiuofUJKRyKXG7g3zsJKvHo=";
+    sha256 = "RmXKv/admC1w26z/ClNhH11J8n87WTfDr2lYOF6Fx7I=";
  };

  nativeBuildInputs = [ makeWrapper installShellFiles ];
--- a/pkgs/development/compilers/gleam/default.nix
+++ b/pkgs/development/compilers/gleam/default.nix
@ -2,13 +2,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "gleam";
-  version = "0.18.0";
+  version = "0.18.2";

  src = fetchFromGitHub {
    owner = "gleam-lang";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-S7PYN0iiSXEApIG0Tyb/PJmKjHzjz3S+ToDy+pwPK18=";
+    sha256 = "sha256-uakZmaIkBgC/FTQ7us58pJT6IzpcF1cQxBfehlB3bWk=";
  };

  nativeBuildInputs = [ pkg-config ];
@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
  buildInputs = [ openssl ] ++
    lib.optionals stdenv.isDarwin [ Security libiconv ];

-  cargoSha256 = "sha256-Q5WyKQ4HFOIL1KAQ0QvAbZfy+WRAWf9HxSvSabSz4W4=";
+  cargoSha256 = "sha256-NogDrd7YWl/CV0aCd1jfYWYB9VZG7u890VLEktI3sOQ=";

  meta = with lib; {
    description = "A statically typed language for the Erlang VM";
--- a/pkgs/development/coq-modules/semantics/default.nix
+++ b/pkgs/development/coq-modules/semantics/default.nix
@ -6,6 +6,7 @@ mkCoqDerivation rec {
  owner = "coq-community";
  releaseRev = v: "v${v}";

+  release."8.14.0".sha256 = "sha256-TB12C3hX9XucbsXr+UL+8jM19NOFXASW/lcytwy6uVE=";
  release."8.13.0".sha256 = "sha256-8bDr/Ovl6s8BFaRcHeS5H33/K/pYdeKfSN+krVuKulQ=";
  release."8.11.1".sha256 = "sha256-jTPgcXSNn1G2mMDC7ocFcmqs8svB7Yo1emXP15iuxiU=";
  release."8.9.0".sha256 = "sha256-UBsvzlDEZsZsVkbUI0GbFEhpxnnLCiaqlqDyWVC5I6s=";
@ -15,7 +16,7 @@ mkCoqDerivation rec {

  inherit version;
  defaultVersion = with versions; switch coq.coq-version [
-    { case = range "8.10" "8.13"; out = "8.13.0"; }
+    { case = range "8.10" "8.14"; out = "8.14.0"; }
    { case = "8.9"; out = "8.9.0"; }
    { case = "8.8"; out = "8.8.0"; }
    { case = "8.7"; out = "8.7.0"; }
--- a/pkgs/development/interpreters/clojure/babashka.nix
+++ b/pkgs/development/interpreters/clojure/babashka.nix
@ -2,11 +2,11 @@

 buildGraalvmNativeImage rec {
  pname = "babashka";
-  version = "0.7.0";
+  version = "0.7.3";

  src = fetchurl {
    url = "https://github.com/babashka/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-zSjiHacetJ68U0GciIbuGET9I/51EM8JnPPUGemDfEI=";
+    sha256 = "sha256-zbxFMc02hbsU2ERlUzqMBHwHYfORB7TkMINrKC52PPU=";
  };

  executable = "bb";
--- a/pkgs/development/interpreters/kona/default.nix
+++ b/pkgs/development/interpreters/kona/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "kona";
-  version = "20201009";
+  version = "20211225";

  src = fetchFromGitHub {
    owner = "kevinlawler";
    repo = "kona";
    rev = "Win64-${version}";
-    sha256 = "0v252zds61y01cf29hxznz1zc1724vxmzy059k9jiri4r73k679v";
+    sha256 = "sha256-m3a9conyKN0qHSSAG8zAb3kx8ir+7dqgxm1XGjCQcfk=";
  };

  makeFlags = [ "PREFIX=$(out)" ];
--- a/pkgs/development/libraries/entt/default.nix
+++ b/pkgs/development/libraries/entt/default.nix
@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, cmake }:
 stdenv.mkDerivation rec {
  pname = "entt";
-  version = "3.8.1";
+  version = "3.9.0";

  src = fetchFromGitHub {
    owner = "skypjack";
    repo = "entt";
    rev = "v${version}";
-    sha256 = "sha256-vg2tpGyZZM8c97Qko88JMP5YNPZx5kI5qRkkRclvZtA=";
+    sha256 = "sha256-7UeL8D+A0pH3TKNO5B8A1nhD7uDWeirHnHaI/YKVwyo=";
  };

  nativeBuildInputs = [ cmake ];
@ -16,6 +16,7 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/skypjack/entt";
    description = "A header-only, tiny and easy to use library for game programming and much more written in modern C++";
    maintainers = with maintainers; [ twey ];
+    platforms = platforms.all;
    license = licenses.mit;
  };
 }
--- a/pkgs/development/libraries/intel-gmmlib/default.nix
+++ b/pkgs/development/libraries/intel-gmmlib/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "intel-gmmlib";
-  version = "21.3.3";
+  version = "22.0.1";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "gmmlib";
    rev = "intel-gmmlib-${version}";
-    sha256 = "0hvly3fykhy4m7mzaa7xadaz7jz8krnfgj3zgzl2a2rpzja6frdn";
+    sha256 = "1s46vwcs26hdlsa8h51gq4fyi9i8k5hrcx5ffbv9g7v3x706nplf";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/intel-media-driver/default.nix
+++ b/pkgs/development/libraries/intel-media-driver/default.nix
@ -7,13 +7,14 @@
 , libva
 , libpciaccess
 , intel-gmmlib
+, libdrm
 , enableX11 ? stdenv.isLinux
 , libX11
 }:

 stdenv.mkDerivation rec {
  pname = "intel-media-driver";
-  version = "21.4.3";
+  version = "22.1.0";

  outputs = [ "out" "dev" ];

@ -21,7 +22,7 @@ stdenv.mkDerivation rec {
    owner = "intel";
    repo = "media-driver";
    rev = "intel-media-${version}";
-    sha256 = "04r03f48j1nly0j6aq8017va9m3yrnscv6lbrvf3a98fpwk9gc1l";
+    sha256 = "0giba5274kzpjb5rp3d9bbnvcz7fp8ybi4s3hha2idxk0l5yamf1";
  };

  patches = [
@ -43,7 +44,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake pkg-config ];

-  buildInputs = [ libva libpciaccess intel-gmmlib ]
+  buildInputs = [ libva libpciaccess intel-gmmlib libdrm ]
    ++ lib.optional enableX11 libX11;

  postFixup = lib.optionalString enableX11 ''
--- a/pkgs/development/libraries/jemalloc/common.nix
+++ b/pkgs/development/libraries/jemalloc/common.nix
@ -1,59 +0,0 @@
-{ version, sha256 }:
-{ lib, stdenv, fetchurl
-, fetchpatch
-# By default, jemalloc puts a je_ prefix onto all its symbols on OSX, which
-# then stops downstream builds (mariadb in particular) from detecting it. This
-# option should remove the prefix and give us a working jemalloc.
-# Causes segfaults with some software (ex. rustc), but defaults to true for backward
-# compatibility.
-, stripPrefix ? stdenv.hostPlatform.isDarwin
-, disableInitExecTls ? false
-}:
-
-with lib;
-
-stdenv.mkDerivation rec {
-  pname = "jemalloc";
-  inherit version;
-
-  src = fetchurl {
-    url = "https://github.com/jemalloc/jemalloc/releases/download/${version}/${pname}-${version}.tar.bz2";
-    inherit sha256;
-  };
-
-  patches = [
-    # workaround https://github.com/jemalloc/jemalloc/issues/2091
-    (fetchpatch {
-      url = "https://github.com/jemalloc/jemalloc/commit/3b4a03b92b2e415415a08f0150fdb9eeb659cd52.diff";
-      sha256 = "sha256-6AYtADREhfj93ZLk9xnXtjc6vHDU0EKLLOvLd6YdJeI=";
-    })
-  ];
-
-  # see the comment on stripPrefix
-  configureFlags = []
-    ++ optional stripPrefix "--with-jemalloc-prefix="
-    ++ optional disableInitExecTls "--disable-initial-exec-tls"
-    # jemalloc is unable to correctly detect transparent hugepage support on
-    # ARM (https://github.com/jemalloc/jemalloc/issues/526), and the default
-    # kernel ARMv6/7 kernel does not enable it, so we explicitly disable support
-    ++ optionals (stdenv.isAarch32 && versionOlder version "5") [
-      "--disable-thp"
-      "je_cv_thp=no"
-    ]
-  ;
-
-  doCheck = true;
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    homepage = "http://jemalloc.net";
-    description = "General purpose malloc(3) implementation";
-    longDescription = ''
-      malloc(3)-compatible memory allocator that emphasizes fragmentation
-      avoidance and scalable concurrency support.
-    '';
-    license = licenses.bsd2;
-    platforms = platforms.all;
-  };
-}
--- a/pkgs/development/libraries/jemalloc/default.nix
+++ b/pkgs/development/libraries/jemalloc/default.nix
@ -1,4 +1,58 @@
-import ./common.nix {
+{ lib
+, stdenv
+, fetchurl
+, fetchpatch
+# By default, jemalloc puts a je_ prefix onto all its symbols on OSX, which
+# then stops downstream builds (mariadb in particular) from detecting it. This
+# option should remove the prefix and give us a working jemalloc.
+# Causes segfaults with some software (ex. rustc), but defaults to true for backward
+# compatibility.
+, stripPrefix ? stdenv.hostPlatform.isDarwin
+, disableInitExecTls ? false
+}:
+
+stdenv.mkDerivation rec {
+  pname = "jemalloc";
  version = "5.2.1";
-  sha256 = "1xl7z0vwbn5iycg7amka9jd6hxd8nmfk7nahi4p9w2bnw9f0wcrl";
+
+  src = fetchurl {
+    url = "https://github.com/jemalloc/jemalloc/releases/download/${version}/${pname}-${version}.tar.bz2";
+    sha256 = "1xl7z0vwbn5iycg7amka9jd6hxd8nmfk7nahi4p9w2bnw9f0wcrl";
+  };
+
+  patches = [
+    # workaround https://github.com/jemalloc/jemalloc/issues/2091
+    (fetchpatch {
+      url = "https://github.com/jemalloc/jemalloc/commit/3b4a03b92b2e415415a08f0150fdb9eeb659cd52.diff";
+      sha256 = "sha256-6AYtADREhfj93ZLk9xnXtjc6vHDU0EKLLOvLd6YdJeI=";
+    })
+  ];
+
+  # see the comment on stripPrefix
+  configureFlags = []
+    ++ lib.optional stripPrefix "--with-jemalloc-prefix="
+    ++ lib.optional disableInitExecTls "--disable-initial-exec-tls"
+    # jemalloc is unable to correctly detect transparent hugepage support on
+    # ARM (https://github.com/jemalloc/jemalloc/issues/526), and the default
+    # kernel ARMv6/7 kernel does not enable it, so we explicitly disable support
+    ++ lib.optionals (stdenv.isAarch32 && lib.versionOlder version "5") [
+      "--disable-thp"
+      "je_cv_thp=no"
+    ]
+  ;
+
+  doCheck = true;
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    homepage = "http://jemalloc.net";
+    description = "General purpose malloc(3) implementation";
+    longDescription = ''
+      malloc(3)-compatible memory allocator that emphasizes fragmentation
+      avoidance and scalable concurrency support.
+    '';
+    license = licenses.bsd2;
+    platforms = platforms.all;
+  };
 }
--- a/pkgs/development/libraries/jemalloc/jemalloc450.nix
+++ b/pkgs/development/libraries/jemalloc/jemalloc450.nix
@ -1,4 +0,0 @@
-import ./common.nix {
-  version = "4.5.0";
-  sha256 = "10373xhpc10pgmai9fkc1z0rs029qlcb3c0qfnvkbwdlcibdh2cl";
-}
--- a/pkgs/development/libraries/libb64/default.nix
+++ b/pkgs/development/libraries/libb64/default.nix
@ -19,7 +19,11 @@ stdenv.mkDerivation rec {
      url = "https://github.com/libb64/libb64/commit/4fe47c052e9123da8f751545deb48be08c3411f6.patch";
      sha256 = "18b3np3gpyzimqmk6001riqv5n70wfbclky6zzsrvj5zl1dj4ljf";
    })
-  ];
+  ] ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) (fetchpatch {
+    name = "0001-example-Do-not-run-the-tests.patch";
+    url = "https://cgit.openembedded.org/meta-openembedded/plain/meta-oe/recipes-support/libb64/libb64/0001-example-Do-not-run-the-tests.patch?id=484e0de1e4ee107f21ae2a5c5f976ed987978baf";
+    sha256 = "sha256-KTsiIWJe66BKlu/A43FWfW0XAu4E7lWX/RY4NITRrm4=";
+  });

  enableParallelBuilding = true;

--- a/pkgs/development/libraries/libplctag/default.nix
+++ b/pkgs/development/libraries/libplctag/default.nix
@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "libplctag";
-  version = "2.4.7";
+  version = "2.4.8";

  src = fetchFromGitHub {
    owner = "libplctag";
    repo = "libplctag";
    rev = "v${version}";
-    sha256 = "sha256-DLx9VBmyn5L30i6qPK4LD+3cOo7zG2YLOui6+krU9So=";
+    sha256 = "sha256-GVYG+ioqGo0k6ClrJu2mijtuBBFc9l6dNexNDNyh5+8=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/mesa/default.nix
+++ b/pkgs/development/libraries/mesa/default.nix
@ -33,7 +33,7 @@ with lib;
 let
  # Release calendar: https://www.mesa3d.org/release-calendar.html
  # Release frequency: https://www.mesa3d.org/releasing.html#schedule
-  version = "21.3.2";
+  version = "21.3.3";
  branch  = versions.major version;

 self = stdenv.mkDerivation {
@ -47,7 +47,7 @@ self = stdenv.mkDerivation {
      "ftp://ftp.freedesktop.org/pub/mesa/${version}/mesa-${version}.tar.xz"
      "ftp://ftp.freedesktop.org/pub/mesa/older-versions/${branch}.x/${version}/mesa-${version}.tar.xz"
    ];
-    sha256 = "1g96y59bw10ml8h4jl259g41jdmf5ww3jbwqpz1sprq7hgxvmrz2";
+    sha256 = "08c118j440xpfbjjxmwzm6dfnv4y35q540mmzkchhpbwx89lczxd";
  };

  # TODO:
--- a/pkgs/development/libraries/ndn-cxx/default.nix
+++ b/pkgs/development/libraries/ndn-cxx/default.nix
@ -1,11 +1,12 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , doxygen
 , pkg-config
 , python3
 , python3Packages
 , wafHook
-, boost
+, boost175
 , openssl
 , sqlite
 }:
@ -18,19 +19,28 @@ stdenv.mkDerivation rec {
    owner = "named-data";
    repo = "ndn-cxx";
    rev = "${pname}-${version}";
-    sha256 = "1lcaqc79n3d9sip7knddblba17sz18b0w7nlxmj3fz3lb3z9qd51";
+    sha256 = "sha256-oTSc/lh0fDdk7dQeDhYKX5+gFl2t2Xlu1KkNmw7DitE=";
  };

  nativeBuildInputs = [ doxygen pkg-config python3 python3Packages.sphinx wafHook ];

-  buildInputs = [ boost openssl sqlite ];
+  buildInputs = [ boost175 openssl sqlite ];

  wafConfigureFlags = [
    "--with-openssl=${openssl.dev}"
-    "--boost-includes=${boost.dev}/include"
-    "--boost-libs=${boost.out}/lib"
+    "--boost-includes=${boost175.dev}/include"
+    "--boost-libs=${boost175.out}/lib"
+    # "--with-tests" # disabled since upstream tests fail (Net/TestFaceUri/ParseDev Bug #3896)
  ];

+
+  doCheck = false; # disabled since upstream tests fail (Net/TestFaceUri/ParseDev Bug #3896)
+  checkPhase = ''
+    runHook preCheck
+    LD_PRELOAD=build/ndn-cxx.so build/unit-tests
+    runHook postCheck
+  '';
+
  meta = with lib; {
    homepage = "https://named-data.net/";
    description = "A Named Data Neworking (NDN) or Content Centric Networking (CCN) abstraction";
@ -49,6 +59,6 @@ stdenv.mkDerivation rec {
    '';
    license = licenses.lgpl3;
    platforms = platforms.unix;
-    maintainers = with maintainers; [ sjmackenzie ];
+    maintainers = with maintainers; [ sjmackenzie bertof ];
  };
 }
--- a/pkgs/development/libraries/ntirpc/default.nix
+++ b/pkgs/development/libraries/ntirpc/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "ntirpc";
-  version = "3.4";
+  version = "4.0";

  src = fetchFromGitHub {
    owner = "nfs-ganesha";
    repo = "ntirpc";
    rev = "v${version}";
-    sha256 = "1xdwqyc9m4lbsgr7ll1g0f84c2h8jrfkg67cgvsp424i1a7r9mm1";
+    sha256 = "0hffma57b4c7g7862yvfr8bvbsbxh5w383mvjkjv3jpzi01l79yv";
  };

  postPatch = ''
--- a/pkgs/development/libraries/science/math/petsc/default.nix
+++ b/pkgs/development/libraries/science/math/petsc/default.nix
@ -18,11 +18,11 @@ assert petsc-withp4est -> p4est.mpiSupport;

 stdenv.mkDerivation rec {
  pname = "petsc";
-  version = "3.16.1";
+  version = "3.16.2";

  src = fetchurl {
    url = "http://ftp.mcs.anl.gov/pub/petsc/release-snapshots/petsc-${version}.tar.gz";
-    sha256 = "sha256-kJz3vOe2oN2yWAoayVAqoBYx7EEFxxZZTBgE8O4eoGo=";
+    sha256 = "sha256-erJXrhUNSDesjThyodIGmXliV4eF7CQnY5zqxG0TG7w=";
  };

  mpiSupport = !withp4est || p4est.mpiSupport;
--- a/pkgs/development/libraries/uid_wrapper/default.nix
+++ b/pkgs/development/libraries/uid_wrapper/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "uid_wrapper";
-  version = "1.2.8";
+  version = "1.2.9";

  src = fetchurl {
    url = "mirror://samba/cwrap/uid_wrapper-${version}.tar.gz";
-    sha256 = "0swm9d8l69dw7nbrw6xh7rdy7cfrqflw3hxshicsrhd9v03iwvqf";
+    sha256 = "sha256-fowCQHKCX+hrq0ZZHPS5CeOZz5j1SCL55SdC9CAEcIQ=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/development/libraries/unicorn/default.nix
+++ b/pkgs/development/libraries/unicorn/default.nix
@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "unicorn";
-  version = "2.0.0-rc4";
+  version = "2.0.0-rc5";

  src = fetchFromGitHub {
    owner = "unicorn-engine";
    repo = pname;
    rev = version;
-    sha256 = "sha256-dNBebXp8HVmmY1RVRYuRFoJ3PStCf4taNTeYKi2lhQM=";
+    sha256 = "1q9k8swnq4qsi54zdfaap69z56w3yj4n4ggm9pscmmmr69nply5f";
  };

  nativeBuildInputs = [ pkg-config cmake ];
--- a/pkgs/development/libraries/v8/plv8_6_x.nix
+++ b/pkgs/development/libraries/v8/plv8_6_x.nix
@ -1,189 +0,0 @@
-# NOTE: this expression is NOT exported from the top-level of all-packages.nix,
-# it is exclusively used by the 'plv8' PostgreSQL extension.
-# Since plv8 2.3.2, plv8 no longer requires this specific version, but as of
-# 2019-08-29, nixpkgs does not have v8 6.x, and v8_5 is bumped to 5.4.232, which
-# is a bit outdated.  plv8 3.x is planned to support v8 7.x
-
-{ stdenv, lib, fetchgit, fetchFromGitHub, gn, ninja, python, glib, pkg-config
-, doCheck ? false
-, snapshot ? true
-}:
-
-let
-  arch = if stdenv.isAarch32
-         then if stdenv.is64bit
-              then"arm64"
-              else "arm"
-         else if stdenv.is64bit
-              then"x64"
-              else "ia32";
-  git_url = "https://chromium.googlesource.com";
-
-  # This data is from the DEPS file in the root of a V8 checkout
-  deps = {
-    "base/trace_event/common" = fetchgit {
-      url    = "${git_url}/chromium/src/base/trace_event/common.git";
-      rev    = "0e9a47d74970bee1bbfc063c47215406f8918699";
-      sha256 = "07rbzrlscp8adh4z86yl5jxdnvgkc3xs950xldpk318wf9i3bh6c";
-    };
-    build = fetchgit {
-      url    = "${git_url}/chromium/src/build.git";
-      rev    = "9338ce52d0b9bcef34c38285fbd5023b62739fac";
-      sha256 = "1s2sa8dy3waidsirjylc82ggb18l1108bczjc8z0v4ywyj4k0cvh";
-    };
-    buildtools = fetchgit {
-      url    = "${git_url}/chromium/buildtools.git";
-      rev    = "505de88083136eefd056e5ee4ca0f01fe9b33de8";
-      sha256 = "0vj216nhb803bggsl0hnyagj8njrm96pn8sim6xcnqb7nhz1vabw";
-    };
-    "test/benchmarks/data" = fetchgit {
-      url    = "${git_url}/v8/deps/third_party/benchmarks.git";
-      rev    = "05d7188267b4560491ff9155c5ee13e207ecd65f";
-      sha256 = "0ad2ay14bn67d61ks4dmzadfnhkj9bw28r4yjdjjyzck7qbnzchl";
-    };
-    "test/mozilla/data" = fetchgit {
-      url    = "${git_url}/v8/deps/third_party/mozilla-tests.git";
-      rev    = "f6c578a10ea707b1a8ab0b88943fe5115ce2b9be";
-      sha256 = "0rfdan76yfawqxbwwb35aa57b723j3z9fx5a2w16nls02yk2kqyn";
-    };
-    "test/test262/data" = fetchgit {
-      url    = "${git_url}/external/github.com/tc39/test262.git";
-      rev    = "5d4c667b271a9b39d0de73aef5ffe6879c6f8811";
-      sha256 = "0q9iwb2nkybf9np95wgf5m372aw2lhx9wlsw41a2a80kbkvb2kqg";
-    };
-    "test/test262/harness" = fetchgit {
-      url    = "${git_url}/external/github.com/test262-utils/test262-harness-py.git";
-      rev    = "0f2acdd882c84cff43b9d60df7574a1901e2cdcd";
-      sha256 = "00brj5avp43yamc92kinba2mg3a2x1rcd7wnm7z093l73idprvkp";
-    };
-    "test/wasm-js" = fetchgit {
-      url    = "${git_url}/external/github.com/WebAssembly/spec.git";
-      rev    = "a7e226a92e660a3d5413cfea4269824f513259d2";
-      sha256 = "0z3aybj3ykajwh2bv5fwd6pwqjjsq8dnwrqc2wncb6r9xcjwbgxp";
-    };
-    "testing/gtest" = fetchgit {
-      url    = "${git_url}/external/github.com/google/googletest.git";
-      rev    = "6f8a66431cb592dad629028a50b3dd418a408c87";
-      sha256 = "0bdba2lr6pg15bla9600zg0r0vm4lnrx0wqz84p376wfdxra24vw";
-    };
-    "third_party/icu" = fetchgit {
-      url    = "${git_url}/chromium/deps/icu.git";
-      rev    = "741688ebf328da9adc52505248bf4e2ef868722c";
-      sha256 = "02ifm18qjlrkn5nm2rxkf9yz9bdlyq7c65jfjndv63vi1drqh1r9";
-    };
-    "third_party/instrumented_libraries" = fetchgit {
-      url    = "${git_url}/chromium/src/third_party/instrumented_libraries.git";
-      rev    = "28417458ac4dc79f68915079d0f283f682504cc0";
-      sha256 = "1qf5c2946n37p843yriv7xawi6ss6samabghq43s49cgd4wq8dc3";
-    };
-    "third_party/jinja2" = fetchgit {
-      url    = "${git_url}/chromium/src/third_party/jinja2.git";
-      rev    = "d34383206fa42d52faa10bb9931d6d538f3a57e0";
-      sha256 = "0d9hyw0bvp3p0dbwy833cm9vdqxcam0qbm9jc561ynphddxlkmgd";
-    };
-    "third_party/markupsafe" = fetchgit {
-      url    = "${git_url}/chromium/src/third_party/markupsafe.git";
-      rev    = "8f45f5cfa0009d2a70589bcda0349b8cb2b72783";
-      sha256 = "168ppjmicfdh4i1l0l25s86mdbrz9fgxmiq1rx33x79mph41scfz";
-    };
-    "tools/clang" = fetchgit {
-      url    = "${git_url}/chromium/src/tools/clang.git";
-      rev    = "8688d267571de76a56746324dcc249bf4232b85a";
-      sha256 = "0krq4zz1vnwp064bm517gwr2napy18wyccdh8w5s4qgkjwwxd63s";
-    };
-    "tools/gyp" = fetchgit {
-      url    = "${git_url}/external/gyp.git";
-      rev    = "d61a9397e668fa9843c4aa7da9e79460fe590bfb";
-      sha256 = "1z081h72mjy285jb1kj5xd0pb4p12n9blvsimsavyn3ldmswv0r0";
-    };
-    "tools/luci-go" = fetchgit {
-      url    = "${git_url}/chromium/src/tools/luci-go.git";
-      rev    = "45a8a51fda92e123619a69e7644d9c64a320b0c1";
-      sha256 = "0r7736gqk7r0i7ig0b5ib10d9q8a8xzsmc0f0fbkm9k78v847vpj";
-    };
-    "tools/swarming_client" = fetchgit {
-      url    = "${git_url}/infra/luci/client-py.git";
-      rev    = "4bd9152f8a975d57c972c071dfb4ddf668e02200";
-      sha256 = "03zk91gzvqv01g1vbl8d7h8al7vs4ymrrdc8ipg9wpq52yh65smh";
-    };
-  };
-
-in
-
-stdenv.mkDerivation rec {
-  pname = "v8";
-  version = "6.4.388.40";
-
-  inherit doCheck;
-
-  src = fetchFromGitHub {
-    owner = "v8";
-    repo = "v8";
-    rev = version;
-    sha256 = "1lq239cgqyidrynz8g3wbdv70ymzv6s0ppad8s219gb3jnizm16a";
-  };
-
-  postUnpack = ''
-    ${lib.concatStringsSep "\n" (
-      lib.mapAttrsToList (n: v: ''
-        mkdir -p $sourceRoot/${n}
-        cp -r ${v}/* $sourceRoot/${n}
-      '') deps)}
-  '';
-
-  prePatch = ''
-    # use our gn, not the bundled one
-    sed -i -e 's#gn_path = .*#gn_path = "${gn}/bin/gn"#' tools/mb/mb.py
-
-    # disable tests
-    if [ "$doCheck" = "" ]; then sed -i -e '/"test:gn_all",/d' BUILD.gn; fi
-
-    # disable sysroot usage
-    chmod u+w build/config build/config/sysroot.gni
-    sed -i build/config/sysroot.gni \
-        -e '/use_sysroot =/ { s#\(use_sysroot =\).*#\1 false#; :a  n; /current_cpu/ { s/^/#/; ba };  }'
-
-    # patch shebangs (/usr/bin/env)
-    patchShebangs tools/dev/v8gen.py
-  '';
-
-  configurePhase = ''
-    tools/dev/v8gen.py -vv ${arch}.release -- \
-        is_component_build=true               \
-        ${if snapshot then "v8_use_external_startup_data=false" else "v8_use_snapshot=false"} \
-        is_clang=false                        \
-        linux_use_bundled_binutils=false      \
-        treat_warnings_as_errors=false        \
-        use_custom_libcxx=false               \
-        use_custom_libcxx_for_host=false
-  '';
-
-  nativeBuildInputs = [ gn ninja pkg-config ];
-  buildInputs = [ python glib ];
-
-  buildPhase = ''
-    ninja -C out.gn/${arch}.release/
-  '';
-
-  enableParallelBuilding = true;
-
-  installPhase = ''
-    install -vD out.gn/${arch}.release/d8 "$out/bin/d8"
-    install -vD out.gn/${arch}.release/mksnapshot "$out/bin/mksnapshot"
-    mkdir -p "$out/lib"
-    for f in libicui18n.so libicuuc.so libv8_libbase.so libv8_libplatform.so libv8.so; do
-        install -vD out.gn/${arch}.release/$f "$out/lib/$f"
-    done
-    install -vD out.gn/${arch}.release/icudtl.dat "$out/lib/icudtl.dat"
-    mkdir -p "$out/include"
-    cp -vr include/*.h "$out/include"
-    cp -vr include/libplatform "$out/include"
-  '';
-
-  meta = with lib; {
-    description = "Google's open source JavaScript engine";
-    maintainers = with maintainers; [ cstrahan proglodyte ];
-    platforms = platforms.linux;
-    license = licenses.bsd3;
-  };
-}
--- a/pkgs/development/ocaml-modules/awa/default.nix
+++ b/pkgs/development/ocaml-modules/awa/default.nix
@ -1,21 +1,21 @@
 { lib, buildDunePackage, fetchurl
 , ppx_sexp_conv, ppx_cstruct
 , mirage-crypto, mirage-crypto-rng, mirage-crypto-pk
-, x509, cstruct, cstruct-unix, cstruct-sexp, sexplib
+, x509, cstruct, cstruct-unix, cstruct-sexp, sexplib, eqaf
 , rresult, mtime, logs, fmt, cmdliner, base64, hacl_x25519
 , zarith
 }:

 buildDunePackage rec {
  pname = "awa";
-  version = "0.0.4";
+  version = "0.0.5";

  minimumOCamlVersion = "4.07";
  useDune2 = true;

  src = fetchurl {
-    url = "https://github.com/mirage/awa-ssh/releases/download/v${version}/awa-v${version}.tbz";
-    sha256 = "1l7nsd8jifxjq78xyzcc0z9igc02m2qlvv4cxzsgdim6n1jfzxj2";
+    url = "https://github.com/mirage/awa-ssh/releases/download/v${version}/awa-${version}.tbz";
+    sha256 = "14hqzmikp3hlynhs0wnwj2491106if183swsl7ldk4215a0b7ms4";
  };

  nativeBuildInputs = [ ppx_cstruct ];
@ -24,7 +24,7 @@ buildDunePackage rec {
    mirage-crypto mirage-crypto-rng mirage-crypto-pk x509
    cstruct cstruct-sexp sexplib mtime
    logs base64 hacl_x25519 zarith
-    ppx_sexp_conv
+    ppx_sexp_conv eqaf
  ];

  doCheck = true;
--- a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
+++ b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
@ -1,13 +1,11 @@
 { lib
 , buildDunePackage
 , fetchurl
-, rresult
 , mirage-crypto
 , mirage-clock
 , x509
 , logs
 , fmt
-, hex
 , bos
 , astring
 , cmdliner
@ -16,19 +14,18 @@

 buildDunePackage rec {
  pname = "ca-certs-nss";
-  version = "3.66";
+  version = "3.71.0.1";

  minimumOCamlVersion = "4.08";

  src = fetchurl {
    url = "https://github.com/mirage/ca-certs-nss/releases/download/v${version}/ca-certs-nss-v${version}.tbz";
-    sha256 = "f0f8035b470f2a48360b92d0e6287f41f98e4ba71576a1cd4c9246c468932f09";
+    sha256 = "b83749d983781631745079dccb7345d9ee1b52c1844ce865e97a25349289a124";
  };

  useDune2 = true;

  propagatedBuildInputs = [
-    rresult
    mirage-crypto
    mirage-clock
    x509
@ -37,7 +34,6 @@ buildDunePackage rec {
  buildInputs = [
    logs
    fmt
-    hex
    bos
    astring
    cmdliner
--- a/pkgs/development/ocaml-modules/conduit/default.nix
+++ b/pkgs/development/ocaml-modules/conduit/default.nix
@ -5,14 +5,14 @@

 buildDunePackage rec {
  pname = "conduit";
-  version = "4.0.1";
+  version = "4.0.2";
  useDune2 = true;

  minimumOCamlVersion = "4.03";

  src = fetchurl {
    url = "https://github.com/mirage/ocaml-conduit/releases/download/v${version}/conduit-v${version}.tbz";
-    sha256 = "500d95bf2a524f4851e94373e32d26b6e99ee04e5134db69fe6e151c3aad9b1f";
+    sha256 = "2a37ffaa352a1e145ef3d80ac28661213c69a741b238623e59f29e3d5a12c537";
  };

  buildInputs = [ ppx_sexp_conv ];
--- a/pkgs/development/ocaml-modules/higlo/default.nix
+++ b/pkgs/development/ocaml-modules/higlo/default.nix
@ -1,27 +1,23 @@
-{ lib, stdenv, fetchFromGitHub, ocaml, findlib, xtmpl, ulex }:
+{ lib, buildDunePackage, fetchFromGitLab, sedlex_2, xtmpl }:

-stdenv.mkDerivation rec {
+buildDunePackage rec {
  pname = "higlo";
-  version = "0.6";
-  src = fetchFromGitHub {
+  version = "0.8";
+  useDune2 = true;
+  src = fetchFromGitLab {
+    domain = "framagit.org";
    owner = "zoggy";
    repo = "higlo";
-    rev = "release-${version}";
-    sha256 = "0m0qyk2ydivai54502s45sdw9w4xr0j3jpwyc4vqk62a7iz9ihxh";
+    rev = version;
+    sha256 = "sha256:09hsbwy5asacgh4gdj0vjpy4kzfnq3qji9szbsbyswsf1nbyczir";
  };

-  buildInputs = [ ocaml findlib ];
-  propagatedBuildInputs = [ xtmpl ulex ];
-
-  createFindlibDestdir = true;
-
-  patches = ./install.patch;
+  propagatedBuildInputs = [ sedlex_2 xtmpl ];

  meta = with lib; {
    description = "OCaml library for syntax highlighting";
-    homepage = "https://zoggy.github.io/higlo/";
+    inherit (src.meta) homepage;
    license = licenses.lgpl3;
-    platforms = ocaml.meta.platforms or [];
    maintainers = with maintainers; [ regnat ];
  };
 }
--- a/pkgs/development/ocaml-modules/higlo/install.patch
+++ b/pkgs/development/ocaml-modules/higlo/install.patch
@ -1,14 +0,0 @@
-diff --git a/Makefile b/Makefile
-index b8c2e01..fcd07ed 100644
--- a/Makefile
-+++ b/Makefile
-@@ -149,7 +149,8 @@ webdoc:
- install: install-lib install-bin
- 
- install-bin:
-	$(CP) $(HIGLO) $(HIGLO_BYTE) $(MK_HIGLO) `dirname \`which ocamlfind\``/
-+	mkdir -p $(out)/bin
-+	$(CP) $(HIGLO) $(HIGLO_BYTE) $(MK_HIGLO) $(out)/bin
- 
- install-lib: higlo.cmo higlo.cmx higlo.cmxs $(HIGLO) $(HIGLO_BYTE)
- 	ocamlfind install higlo META LICENSE \
--- a/pkgs/development/ocaml-modules/iri/default.nix
+++ b/pkgs/development/ocaml-modules/iri/default.nix
@ -1,34 +1,26 @@
-{ stdenv, lib, fetchFromGitLab, ocaml, findlib
-, sedlex, uunf, uutf
+{ lib, buildDunePackage, fetchFromGitLab
+, sedlex_2, uunf, uutf
 }:

-if !lib.versionAtLeast ocaml.version "4.03"
-then throw "iri is not available for OCaml ${ocaml.version}"
-else
-
-stdenv.mkDerivation rec {
-  version = "0.4.0";
-  name = "ocaml${ocaml.version}-iri-${version}";
+buildDunePackage rec {
+  pname = "iri";
+  version = "0.6.0";
+  useDune2 = true;

  src = fetchFromGitLab {
    domain = "framagit.org";
    owner = "zoggy";
    repo = "ocaml-iri";
    rev = version;
-    sha256 = "0fsmfmzmyggm0h77a7mb0n41vqi6q4ln1xzsv72zbvysa7l8w84q";
+    sha256 = "sha256:0zk8nnwcyljkc1a556byncv6cn1vqhk4267z1lm15flh1k7chyax";
  };

-  buildInputs = [ ocaml findlib ];
-
-  propagatedBuildInputs = [ sedlex uunf uutf ];
-
-  createFindlibDestdir = true;
+  propagatedBuildInputs = [ sedlex_2 uunf uutf ];

  meta = {
    description = "IRI (RFC3987) native OCaml implementation";
    license = lib.licenses.lgpl3;
    maintainers = [ lib.maintainers.vbgl ];
    inherit (src.meta) homepage;
-    inherit (ocaml.meta) platforms;
  };
 }
--- a/pkgs/development/ocaml-modules/letsencrypt/app.nix
+++ b/pkgs/development/ocaml-modules/letsencrypt/app.nix
@ -12,6 +12,7 @@
 , bos
 , fpath
 , randomconv
+, cstruct
 }:

 buildDunePackage {
@ -37,6 +38,7 @@ buildDunePackage {
    bos
    fpath
    randomconv
+    cstruct
  ];

  meta = letsencrypt.meta // {
--- a/pkgs/development/ocaml-modules/letsencrypt/default.nix
+++ b/pkgs/development/ocaml-modules/letsencrypt/default.nix
@ -1,15 +1,14 @@
 { buildDunePackage
 , lib
 , fetchurl
-, astring
 , asn1-combinators
 , uri
-, rresult
 , base64
 , logs
 , fmt
 , lwt
 , mirage-crypto
+, mirage-crypto-ec
 , mirage-crypto-pk
 , mirage-crypto-rng
 , x509
@ -17,15 +16,16 @@
 , ounit
 , ptime
 , domain-name
+, cstruct
 }:

 buildDunePackage rec {
  pname = "letsencrypt";
-  version = "0.3.0";
+  version = "0.4.1";

  src = fetchurl {
    url = "https://github.com/mmaker/ocaml-letsencrypt/releases/download/v${version}/letsencrypt-v${version}.tbz";
-    sha256 = "8772b7e6dbda0559a03a7b23b75c1431d42ae09a154eefd64b4c7e23b8d92deb";
+    sha256 = "f90875f5c9bdcab4c8be5ec7ebe9ea763030fa708e02857300996bb16e7c2070";
  };

  minimumOCamlVersion = "4.08";
@ -43,12 +43,12 @@ buildDunePackage rec {
    lwt
    base64
    mirage-crypto
+    mirage-crypto-ec
    mirage-crypto-pk
    asn1-combinators
    x509
    uri
-    rresult
-    astring
+    cstruct
  ];

  doCheck = true;
--- a/pkgs/development/ocaml-modules/ocf/default.nix
+++ b/pkgs/development/ocaml-modules/ocf/default.nix
@ -1,37 +1,24 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, ocaml, findlib, ppx_tools, yojson }:
+{ lib, buildDunePackage, fetchFromGitLab, yojson }:

-if lib.versionOlder ocaml.version "4.03"
-|| lib.versionAtLeast ocaml.version "4.08"
-then throw "ocf not supported for ocaml ${ocaml.version}"
-else
-stdenv.mkDerivation rec {
+buildDunePackage rec {
  pname = "ocf";
-  version = "0.5.0";
-  src = fetchFromGitHub {
+  version = "0.8.0";
+  useDune2 = true;
+  minimalOCamlVersion = "4.03";
+  src = fetchFromGitLab {
+    domain = "framagit.org";
    owner = "zoggy";
    repo = "ocf";
-    rev = "release-${version}";
-    sha256 = "1fhq9l2nmr39hxzpavc0jssmba71nnmhsncdn4dsbh2ylv29w56y";
+    rev = version;
+    sha256 = "sha256:00ap3q5yjqmpk87lxqv1j2wkc7583ynhjr1jjrfn9r0j2h9pfd60";
  };

-  buildInputs = [ ocaml findlib ppx_tools ];
  propagatedBuildInputs = [ yojson ];

-  createFindlibDestdir = true;
-
-  dontStrip = true;
-
-  patches = [(fetchpatch {
-    url = "https://github.com/zoggy/ocf/commit/3a231c7a6c5e535a77c25e207af8952793436444.patch";
-    sha256 = "0nc8cggc5gxhch9amaz3s71lxs1xbgi7fs9p90cng04dsgr64xk5";
-  })
-  ];
-
  meta = with lib; {
    description = "OCaml library to read and write configuration options in JSON syntax";
-    homepage = "https://zoggy.github.io/ocf/";
+    homepage = "https://zoggy.frama.io/ocf/";
    license = licenses.lgpl3;
-    platforms = ocaml.meta.platforms or [];
    maintainers = with maintainers; [ regnat ];
  };
 }
--- a/pkgs/development/ocaml-modules/ocf/ppx.nix
+++ b/pkgs/development/ocaml-modules/ocf/ppx.nix
@ -0,0 +1,14 @@
+{ buildDunePackage, ocf, ppxlib }:
+
+buildDunePackage {
+  pname = "ocf_ppx";
+  minimalOCamlVersion = "4.11";
+
+  inherit (ocf) src version useDune2;
+
+  buildInputs = [ ppxlib ocf ];
+
+  meta = ocf.meta // {
+    description = "Preprocessor for Ocf library";
+  };
+}
--- a/pkgs/development/ocaml-modules/paf/default.nix
+++ b/pkgs/development/ocaml-modules/paf/default.nix
@ -7,17 +7,10 @@
 , h2
 , tls-mirage
 , mimic
-, cohttp-lwt
-, letsencrypt
-, emile
 , ke
 , bigstringaf
-, domain-name
-, duration
 , faraday
-, ipaddr
 , tls
-, x509
 , lwt
 , logs
 , fmt
@ -32,11 +25,11 @@

 buildDunePackage rec {
  pname = "paf";
-  version = "0.0.5";
+  version = "0.0.6";

  src = fetchurl {
    url = "https://github.com/dinosaure/paf-le-chien/releases/download/${version}/paf-${version}.tbz";
-    sha256 = "e85a018046eb062d2399fdbe8d9d3400a4d5cd51bb62840446503f557c3eeff1";
+    sha256 = "21adbe0f7f9c0242354fa996468d01bf21d5cbcbdd978c911df8e2e299e8f9ae";
  };

  useDune2 = true;
@ -48,17 +41,10 @@ buildDunePackage rec {
    h2
    tls-mirage
    mimic
-    cohttp-lwt
-    letsencrypt
-    emile
    ke
    bigstringaf
-    domain-name
-    ipaddr
-    duration
    faraday
    tls
-    x509
    cstruct
  ];

--- a/pkgs/development/ocaml-modules/paf/le.nix
+++ b/pkgs/development/ocaml-modules/paf/le.nix
@ -8,6 +8,7 @@
 , mirage-stack
 , mirage-time
 , tls-mirage
+, x509
 }:

 buildDunePackage {
@ -29,6 +30,7 @@ buildDunePackage {
    mirage-stack
    mirage-time
    tls-mirage
+    x509
  ];

  doCheck = true;
--- a/pkgs/development/ocaml-modules/tls/async.nix
+++ b/pkgs/development/ocaml-modules/tls/async.nix
@ -1,4 +1,4 @@
-{ lib, buildDunePackage, tls, async, cstruct-async, core, cstruct, mirage-crypto-rng-async, async_find }:
+{ lib, buildDunePackage, tls, async, cstruct-async, core, cstruct, mirage-crypto-rng-async }:

 buildDunePackage rec {
  pname = "tls-async";
@ -12,7 +12,6 @@ buildDunePackage rec {

  propagatedBuildInputs = [
    async
-    async_find
    core
    cstruct
    cstruct-async
--- a/pkgs/development/ocaml-modules/tls/default.nix
+++ b/pkgs/development/ocaml-modules/tls/default.nix
@ -1,15 +1,16 @@
 { lib, fetchurl, buildDunePackage
-, cstruct, cstruct-sexp, domain-name, fmt, ppx_cstruct, ppx_sexp_conv, logs, hkdf, mirage-crypto, mirage-crypto-ec, mirage-crypto-pk, mirage-crypto-rng, ocaml_lwt, ptime, rresult, sexplib, x509
+, cstruct, cstruct-sexp, domain-name, fmt, ppx_cstruct, ppx_sexp_conv, logs, hkdf, mirage-crypto, mirage-crypto-ec, mirage-crypto-pk, mirage-crypto-rng, ocaml_lwt, ptime, sexplib, x509
+, ipaddr, ipaddr-sexp
 , alcotest, cstruct-unix, ounit2, randomconv
 }:

 buildDunePackage rec {
  pname = "tls";
-  version = "0.14.1";
+  version = "0.15.2";

  src = fetchurl {
    url = "https://github.com/mirleft/ocaml-tls/releases/download/v${version}/tls-v${version}.tbz";
-    sha256 = "58cf2d517d6eac5b1ccc5eeb656da690aef2125a19c1eca3fbececd858046216";
+    sha256 = "b76371757249bbeabb12c333de4ea2a09c095767bdbbc83322538c0da1fc1e36";
  };

  minimumOCamlVersion = "4.08";
@ -30,9 +31,10 @@ buildDunePackage rec {
    mirage-crypto-rng
    ocaml_lwt
    ptime
-    rresult
    sexplib
    x509
+    ipaddr
+    ipaddr-sexp
  ];

  doCheck = true;
--- a/Show More
+++ b/Show More