Merge master into haskell-updates

2021-12-26 00:09:07 +00:00 · 2021-12-26 00:09:07 +00:00 · e5ae98c9e2
commit e5ae98c9e2
parent 0587013dd2 9ec14cd78d
623 changed files with 4925 additions and 2625 deletions
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@ -834,6 +834,7 @@ sets are
 * `pkgs.python38Packages`
 * `pkgs.python39Packages`
 * `pkgs.python310Packages`
+* `pkgs.python311Packages`
 * `pkgs.pypyPackages`

 and the aliases
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -119,6 +119,12 @@
    githubId = 241628;
    name = "Adam Russell";
  };
+  aadibajpai = {
+    email = "hello@aadibajpai.com";
+    github = "aadibajpai";
+    githubId = 27063113;
+    name = "Aadi Bajpai";
+  };
  aanderse = {
    email = "aaron@fosslib.net";
    matrix = "@aanderse:nixos.dev";
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -190,6 +190,14 @@
          usage in non-X11 environments, e.g. Wayland.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          The <literal>services.stubby</literal> module was converted to
+          a
+          <link xlink:href="https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md">settings-style</link>
+          configuration.
+        </para>
+      </listitem>
    </itemizedlist>
  </section>
 </section>
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -78,3 +78,5 @@ In addition to numerous new and upgraded packages, this release has the followin
  added, decoupling the setting of `SSH_ASKPASS` from
  `services.xserver.enable`. This allows easy usage in non-X11 environments,
  e.g. Wayland.
+
+- The `services.stubby` module was converted to a [settings-style](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md) configuration.
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@ -11,10 +11,8 @@ let
  mysqldOptions =
    "--user=${cfg.user} --datadir=${cfg.dataDir} --basedir=${cfg.package}";

-  settingsFile = pkgs.writeText "my.cnf" (
-    generators.toINI { listsAsDuplicateKeys = true; } cfg.settings +
-    optionalString (cfg.extraOptions != null) "[mysqld]\n${cfg.extraOptions}"
-  );
+  format = pkgs.formats.ini { listsAsDuplicateKeys = true; };
+  configFile = format.generate "my.cnf" cfg.settings;

 in

@ -22,6 +20,9 @@ in
  imports = [
    (mkRemovedOptionModule [ "services" "mysql" "pidDir" ] "Don't wait for pidfiles, describe dependencies through systemd.")
    (mkRemovedOptionModule [ "services" "mysql" "rootPassword" ] "Use socket authentication or set the password outside of the nix store.")
+    (mkRemovedOptionModule [ "services" "mysql" "extraOptions" ] "Use services.mysql.settings.mysqld instead.")
+    (mkRemovedOptionModule [ "services" "mysql" "bind" ] "Use services.mysql.settings.mysqld.bind-address instead.")
+    (mkRemovedOptionModule [ "services" "mysql" "port" ] "Use services.mysql.settings.mysqld.port instead.")
  ];

  ###### interface
@ -40,41 +41,53 @@ in
        ";
      };

-      bind = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        example = "0.0.0.0";
-        description = "Address to bind to. The default is to bind to all addresses.";
-      };
-
-      port = mkOption {
-        type = types.port;
-        default = 3306;
-        description = "Port of MySQL.";
-      };
-
      user = mkOption {
        type = types.str;
        default = "mysql";
-        description = "User account under which MySQL runs.";
+        description = ''
+          User account under which MySQL runs.
+
+          <note><para>
+          If left as the default value this user will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the user exists before the MySQL service starts.
+          </para></note>
+        '';
      };

      group = mkOption {
        type = types.str;
        default = "mysql";
-        description = "Group under which MySQL runs.";
+        description = ''
+          Group account under which MySQL runs.
+
+          <note><para>
+          If left as the default value this group will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the user exists before the MySQL service starts.
+          </para></note>
+        '';
      };

      dataDir = mkOption {
        type = types.path;
        example = "/var/lib/mysql";
-        description = "Location where MySQL stores its table files.";
+        description = ''
+          The data directory for MySQL.
+
+          <note><para>
+          If left as the default value of <literal>/var/lib/mysql</literal> this directory will automatically be created before the MySQL
+          server starts, otherwise you are responsible for ensuring the directory exists with appropriate ownership and permissions.
+          </para></note>
+        '';
      };

      configFile = mkOption {
        type = types.path;
-        default = settingsFile;
-        defaultText = literalExpression "settingsFile";
+        default = configFile;
+        defaultText = ''
+          A configuration file automatically generated by NixOS.
+        '';
        description = ''
          Override the configuration file used by MySQL. By default,
          NixOS generates one automatically from <option>services.mysql.settings</option>.
@ -92,7 +105,7 @@ in
      };

      settings = mkOption {
-        type = with types; attrsOf (attrsOf (oneOf [ bool int str (listOf str) ]));
+        type = format.type;
        default = {};
        description = ''
          MySQL configuration. Refer to
@ -125,23 +138,6 @@ in
        '';
      };

-      extraOptions = mkOption {
-        type = with types; nullOr lines;
-        default = null;
-        example = ''
-          key_buffer_size = 6G
-          table_cache = 1600
-          log-error = /var/log/mysql_err.log
-        '';
-        description = ''
-          Provide extra options to the MySQL configuration file.
-
-          Please note, that these options are added to the
-          <literal>[mysqld]</literal> section so you don't need to explicitly
-          state it again.
-        '';
-      };
-
      initialDatabases = mkOption {
        type = types.listOf (types.submodule {
          options = {
@ -287,7 +283,7 @@ in
        };

        masterPort = mkOption {
-          type = types.int;
+          type = types.port;
          default = 3306;
          description = "Port number on which the MySQL master server runs.";
        };
@ -299,9 +295,7 @@ in

  ###### implementation

-  config = mkIf config.services.mysql.enable {
-
-    warnings = optional (cfg.extraOptions != null) "services.mysql.`extraOptions` is deprecated, please use services.mysql.`settings`.";
+  config = mkIf cfg.enable {

    services.mysql.dataDir =
      mkDefault (if versionAtLeast config.system.stateVersion "17.09" then "/var/lib/mysql"
@ -310,8 +304,7 @@ in
    services.mysql.settings.mysqld = mkMerge [
      {
        datadir = cfg.dataDir;
-        bind-address = mkIf (cfg.bind != null) cfg.bind;
-        port = cfg.port;
+        port = mkDefault 3306;
      }
      (mkIf (cfg.replication.role == "master" || cfg.replication.role == "slave") {
        log-bin = "mysql-bin-${toString cfg.replication.serverId}";
@ -341,156 +334,150 @@ in

    environment.etc."my.cnf".source = cfg.configFile;

-    systemd.tmpfiles.rules = [
-      "d '${cfg.dataDir}' 0700 '${cfg.user}' '${cfg.group}' - -"
-      "z '${cfg.dataDir}' 0700 '${cfg.user}' '${cfg.group}' - -"
-    ];
+    systemd.services.mysql = {
+      description = "MySQL Server";

-    systemd.services.mysql = let
-      hasNotify = isMariaDB;
-    in {
-        description = "MySQL Server";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      restartTriggers = [ cfg.configFile ];

-        after = [ "network.target" ];
-        wantedBy = [ "multi-user.target" ];
-        restartTriggers = [ cfg.configFile ];
+      unitConfig.RequiresMountsFor = cfg.dataDir;

-        unitConfig.RequiresMountsFor = "${cfg.dataDir}";
+      path = [
+        # Needed for the mysql_install_db command in the preStart script
+        # which calls the hostname command.
+        pkgs.nettools
+      ];

-        path = [
-          # Needed for the mysql_install_db command in the preStart script
-          # which calls the hostname command.
-          pkgs.nettools
-        ];
+      preStart = if isMariaDB then ''
+        if ! test -e ${cfg.dataDir}/mysql; then
+          ${cfg.package}/bin/mysql_install_db --defaults-file=/etc/my.cnf ${mysqldOptions}
+          touch ${cfg.dataDir}/mysql_init
+        fi
+      '' else ''
+        if ! test -e ${cfg.dataDir}/mysql; then
+          ${cfg.package}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} --initialize-insecure
+          touch ${cfg.dataDir}/mysql_init
+        fi
+      '';

-        preStart = if isMariaDB then ''
-          if ! test -e ${cfg.dataDir}/mysql; then
-            ${cfg.package}/bin/mysql_install_db --defaults-file=/etc/my.cnf ${mysqldOptions}
-            touch ${cfg.dataDir}/mysql_init
+      script = ''
+        # https://mariadb.com/kb/en/getting-started-with-mariadb-galera-cluster/#systemd-and-galera-recovery
+        if test -n "''${_WSREP_START_POSITION}"; then
+          if test -e "${cfg.package}/bin/galera_recovery"; then
+            VAR=$(cd ${cfg.package}/bin/..; ${cfg.package}/bin/galera_recovery); [[ $? -eq 0 ]] && export _WSREP_START_POSITION=$VAR || exit 1
          fi
-        '' else ''
-          if ! test -e ${cfg.dataDir}/mysql; then
-            ${cfg.package}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} --initialize-insecure
-            touch ${cfg.dataDir}/mysql_init
-          fi
-        '';
+        fi

-        script = ''
-          # https://mariadb.com/kb/en/getting-started-with-mariadb-galera-cluster/#systemd-and-galera-recovery
-          if test -n "''${_WSREP_START_POSITION}"; then
-            if test -e "${cfg.package}/bin/galera_recovery"; then
-              VAR=$(cd ${cfg.package}/bin/..; ${cfg.package}/bin/galera_recovery); [[ $? -eq 0 ]] && export _WSREP_START_POSITION=$VAR || exit 1
-            fi
-          fi
+        # The last two environment variables are used for starting Galera clusters
+        exec ${cfg.package}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} $_WSREP_NEW_CLUSTER $_WSREP_START_POSITION
+      '';

-          # The last two environment variables are used for starting Galera clusters
-          exec ${cfg.package}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} $_WSREP_NEW_CLUSTER $_WSREP_START_POSITION
-        '';
+      postStart = let
+        # The super user account to use on *first* run of MySQL server
+        superUser = if isMariaDB then cfg.user else "root";
+      in ''
+        ${optionalString (!isMariaDB) ''
+          # Wait until the MySQL server is available for use
+          count=0
+          while [ ! -e /run/mysqld/mysqld.sock ]
+          do
+              if [ $count -eq 30 ]
+              then
+                  echo "Tried 30 times, giving up..."
+                  exit 1
+              fi

-        postStart = let
-          # The super user account to use on *first* run of MySQL server
-          superUser = if isMariaDB then cfg.user else "root";
-        in ''
-          ${optionalString (!hasNotify) ''
-            # Wait until the MySQL server is available for use
-            count=0
-            while [ ! -e /run/mysqld/mysqld.sock ]
-            do
-                if [ $count -eq 30 ]
-                then
-                    echo "Tried 30 times, giving up..."
-                    exit 1
-                fi
+              echo "MySQL daemon not yet started. Waiting for 1 second..."
+              count=$((count++))
+              sleep 1
+          done
+        ''}

-                echo "MySQL daemon not yet started. Waiting for 1 second..."
-                count=$((count++))
-                sleep 1
-            done
-          ''}
+        if [ -f ${cfg.dataDir}/mysql_init ]
+        then
+            # While MariaDB comes with a 'mysql' super user account since 10.4.x, MySQL does not
+            # Since we don't want to run this service as 'root' we need to ensure the account exists on first run
+            ( echo "CREATE USER IF NOT EXISTS '${cfg.user}'@'localhost' IDENTIFIED WITH ${if isMariaDB then "unix_socket" else "auth_socket"};"
+              echo "GRANT ALL PRIVILEGES ON *.* TO '${cfg.user}'@'localhost' WITH GRANT OPTION;"
+            ) | ${cfg.package}/bin/mysql -u ${superUser} -N

-          if [ -f ${cfg.dataDir}/mysql_init ]
-          then
-              # While MariaDB comes with a 'mysql' super user account since 10.4.x, MySQL does not
-              # Since we don't want to run this service as 'root' we need to ensure the account exists on first run
-              ( echo "CREATE USER IF NOT EXISTS '${cfg.user}'@'localhost' IDENTIFIED WITH ${if isMariaDB then "unix_socket" else "auth_socket"};"
-                echo "GRANT ALL PRIVILEGES ON *.* TO '${cfg.user}'@'localhost' WITH GRANT OPTION;"
-              ) | ${cfg.package}/bin/mysql -u ${superUser} -N
-
-              ${concatMapStrings (database: ''
-                # Create initial databases
-                if ! test -e "${cfg.dataDir}/${database.name}"; then
-                    echo "Creating initial database: ${database.name}"
-                    ( echo 'create database `${database.name}`;'
-
-                      ${optionalString (database.schema != null) ''
-                      echo 'use `${database.name}`;'
-
-                      # TODO: this silently falls through if database.schema does not exist,
-                      # we should catch this somehow and exit, but can't do it here because we're in a subshell.
-                      if [ -f "${database.schema}" ]
-                      then
-                          cat ${database.schema}
-                      elif [ -d "${database.schema}" ]
-                      then
-                          cat ${database.schema}/mysql-databases/*.sql
-                      fi
-                      ''}
-                    ) | ${cfg.package}/bin/mysql -u ${superUser} -N
-                fi
-              '') cfg.initialDatabases}
-
-              ${optionalString (cfg.replication.role == "master")
-                ''
-                  # Set up the replication master
-
-                  ( echo "use mysql;"
-                    echo "CREATE USER '${cfg.replication.masterUser}'@'${cfg.replication.slaveHost}' IDENTIFIED WITH mysql_native_password;"
-                    echo "SET PASSWORD FOR '${cfg.replication.masterUser}'@'${cfg.replication.slaveHost}' = PASSWORD('${cfg.replication.masterPassword}');"
-                    echo "GRANT REPLICATION SLAVE ON *.* TO '${cfg.replication.masterUser}'@'${cfg.replication.slaveHost}';"
-                  ) | ${cfg.package}/bin/mysql -u ${superUser} -N
-                ''}
-
-              ${optionalString (cfg.replication.role == "slave")
-                ''
-                  # Set up the replication slave
-
-                  ( echo "stop slave;"
-                    echo "change master to master_host='${cfg.replication.masterHost}', master_user='${cfg.replication.masterUser}', master_password='${cfg.replication.masterPassword}';"
-                    echo "start slave;"
-                  ) | ${cfg.package}/bin/mysql -u ${superUser} -N
-                ''}
-
-              ${optionalString (cfg.initialScript != null)
-                ''
-                  # Execute initial script
-                  # using toString to avoid copying the file to nix store if given as path instead of string,
-                  # as it might contain credentials
-                  cat ${toString cfg.initialScript} | ${cfg.package}/bin/mysql -u ${superUser} -N
-                ''}
-
-              rm ${cfg.dataDir}/mysql_init
-          fi
-
-          ${optionalString (cfg.ensureDatabases != []) ''
-            (
            ${concatMapStrings (database: ''
-              echo "CREATE DATABASE IF NOT EXISTS \`${database}\`;"
-            '') cfg.ensureDatabases}
+              # Create initial databases
+              if ! test -e "${cfg.dataDir}/${database.name}"; then
+                  echo "Creating initial database: ${database.name}"
+                  ( echo 'create database `${database.name}`;'
+
+                    ${optionalString (database.schema != null) ''
+                    echo 'use `${database.name}`;'
+
+                    # TODO: this silently falls through if database.schema does not exist,
+                    # we should catch this somehow and exit, but can't do it here because we're in a subshell.
+                    if [ -f "${database.schema}" ]
+                    then
+                        cat ${database.schema}
+                    elif [ -d "${database.schema}" ]
+                    then
+                        cat ${database.schema}/mysql-databases/*.sql
+                    fi
+                    ''}
+                  ) | ${cfg.package}/bin/mysql -u ${superUser} -N
+              fi
+            '') cfg.initialDatabases}
+
+            ${optionalString (cfg.replication.role == "master")
+              ''
+                # Set up the replication master
+
+                ( echo "use mysql;"
+                  echo "CREATE USER '${cfg.replication.masterUser}'@'${cfg.replication.slaveHost}' IDENTIFIED WITH mysql_native_password;"
+                  echo "SET PASSWORD FOR '${cfg.replication.masterUser}'@'${cfg.replication.slaveHost}' = PASSWORD('${cfg.replication.masterPassword}');"
+                  echo "GRANT REPLICATION SLAVE ON *.* TO '${cfg.replication.masterUser}'@'${cfg.replication.slaveHost}';"
+                ) | ${cfg.package}/bin/mysql -u ${superUser} -N
+              ''}
+
+            ${optionalString (cfg.replication.role == "slave")
+              ''
+                # Set up the replication slave
+
+                ( echo "stop slave;"
+                  echo "change master to master_host='${cfg.replication.masterHost}', master_user='${cfg.replication.masterUser}', master_password='${cfg.replication.masterPassword}';"
+                  echo "start slave;"
+                ) | ${cfg.package}/bin/mysql -u ${superUser} -N
+              ''}
+
+            ${optionalString (cfg.initialScript != null)
+              ''
+                # Execute initial script
+                # using toString to avoid copying the file to nix store if given as path instead of string,
+                # as it might contain credentials
+                cat ${toString cfg.initialScript} | ${cfg.package}/bin/mysql -u ${superUser} -N
+              ''}
+
+            rm ${cfg.dataDir}/mysql_init
+        fi
+
+        ${optionalString (cfg.ensureDatabases != []) ''
+          (
+          ${concatMapStrings (database: ''
+            echo "CREATE DATABASE IF NOT EXISTS \`${database}\`;"
+          '') cfg.ensureDatabases}
+          ) | ${cfg.package}/bin/mysql -N
+        ''}
+
+        ${concatMapStrings (user:
+          ''
+            ( echo "CREATE USER IF NOT EXISTS '${user.name}'@'localhost' IDENTIFIED WITH ${if isMariaDB then "unix_socket" else "auth_socket"};"
+              ${concatStringsSep "\n" (mapAttrsToList (database: permission: ''
+                echo "GRANT ${permission} ON ${database} TO '${user.name}'@'localhost';"
+              '') user.ensurePermissions)}
            ) | ${cfg.package}/bin/mysql -N
-          ''}
+          '') cfg.ensureUsers}
+      '';

-          ${concatMapStrings (user:
-            ''
-              ( echo "CREATE USER IF NOT EXISTS '${user.name}'@'localhost' IDENTIFIED WITH ${if isMariaDB then "unix_socket" else "auth_socket"};"
-                ${concatStringsSep "\n" (mapAttrsToList (database: permission: ''
-                  echo "GRANT ${permission} ON ${database} TO '${user.name}'@'localhost';"
-                '') user.ensurePermissions)}
-              ) | ${cfg.package}/bin/mysql -N
-            '') cfg.ensureUsers}
-        '';
-
-        serviceConfig = {
-          Type = if hasNotify then "notify" else "simple";
+      serviceConfig = mkMerge [
+        {
+          Type = if isMariaDB then "notify" else "simple";
          Restart = "on-abort";
          RestartSec = "5s";

@ -523,9 +510,12 @@ in
          PrivateMounts = true;
          # System Call Filtering
          SystemCallArchitectures = "native";
-        };
-      };
-
+        }
+        (mkIf (cfg.dataDir == "/var/lib/mysql") {
+          StateDirectory = "mysql";
+          StateDirectoryMode = "0700";
+        })
+      ];
+    };
  };
-
 }
--- a/nixos/modules/services/networking/stubby.nix
+++ b/nixos/modules/services/networking/stubby.nix
@ -1,180 +1,51 @@
-{ config, lib, pkgs, ...}:
+{ config, lib, pkgs, ... }:

 with lib;

 let
  cfg = config.services.stubby;
+  settingsFormat = pkgs.formats.yaml { };
+  confFile = settingsFormat.generate "stubby.yml" cfg.settings;
+in {
+  imports = map (x:
+    (mkRemovedOptionModule [ "services" "stubby" x ]
+      "Stubby configuration moved to services.stubby.settings.")) [
+        "authenticationMode"
+        "fallbackProtocols"
+        "idleTimeout"
+        "listenAddresses"
+        "queryPaddingBlocksize"
+        "roundRobinUpstreams"
+        "subnetPrivate"
+        "upstreamServers"
+      ];

-  fallbacks = concatMapStringsSep "\n  " (x: "- ${x}") cfg.fallbackProtocols;
-  listeners = concatMapStringsSep "\n  " (x: "- ${x}") cfg.listenAddresses;
-
-  # By default, the recursive resolvers maintained by the getdns
-  # project itself are enabled. More information about both getdns's servers,
-  # as well as third party options for upstream resolvers, can be found here:
-  # https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers
-  #
-  # You can override these values by supplying a yaml-formatted array of your
-  # preferred upstream resolvers in the following format:
-  #
-  # 106 # - address_data: IPv4 or IPv6 address of the upstream
-  #   port: Port for UDP/TCP (default is 53)
-  #   tls_auth_name: Authentication domain name checked against the server
-  #                  certificate
-  #   tls_pubkey_pinset: An SPKI pinset verified against the keys in the server
-  #                      certificate
-  #     - digest: Only "sha256" is currently supported
-  #       value: Base64 encoded value of the sha256 fingerprint of the public
-  #              key
-  #   tls_port: Port for TLS (default is 853)
-
-  defaultUpstream = ''
-    - address_data: 145.100.185.15
-      tls_auth_name: "dnsovertls.sinodun.com"
-      tls_pubkey_pinset:
-        - digest: "sha256"
-          value: 62lKu9HsDVbyiPenApnc4sfmSYTHOVfFgL3pyB+cBL4=
-    - address_data: 145.100.185.16
-      tls_auth_name: "dnsovertls1.sinodun.com"
-      tls_pubkey_pinset:
-        - digest: "sha256"
-          value: cE2ecALeE5B+urJhDrJlVFmf38cJLAvqekONvjvpqUA=
-    - address_data: 185.49.141.37
-      tls_auth_name: "getdnsapi.net"
-      tls_pubkey_pinset:
-        - digest: "sha256"
-          value: foxZRnIh9gZpWnl+zEiKa0EJ2rdCGroMWm02gaxSc9Q=
-    - address_data: 2001:610:1:40ba:145:100:185:15
-      tls_auth_name: "dnsovertls.sinodun.com"
-      tls_pubkey_pinset:
-        - digest: "sha256"
-          value: 62lKu9HsDVbyiPenApnc4sfmSYTHOVfFgL3pyB+cBL4=
-    - address_data: 2001:610:1:40ba:145:100:185:16
-      tls_auth_name: "dnsovertls1.sinodun.com"
-      tls_pubkey_pinset:
-        - digest: "sha256"
-          value: cE2ecALeE5B+urJhDrJlVFmf38cJLAvqekONvjvpqUA=
-    - address_data: 2a04:b900:0:100::38
-      tls_auth_name: "getdnsapi.net"
-      tls_pubkey_pinset:
-        - digest: "sha256"
-          value: foxZRnIh9gZpWnl+zEiKa0EJ2rdCGroMWm02gaxSc9Q=
-  '';
-
-  # Resolution type is not changeable here because it is required per the
-  # stubby documentation:
-  #
-  # "resolution_type: Work in stub mode only (not recursive mode) - required for Stubby
-  # operation."
-  #
-  # https://dnsprivacy.org/wiki/display/DP/Configuring+Stubby
-
-  confFile = pkgs.writeText "stubby.yml" ''
-    resolution_type: GETDNS_RESOLUTION_STUB
-    dns_transport_list:
-      ${fallbacks}
-    appdata_dir: "/var/cache/stubby"
-    tls_authentication: ${cfg.authenticationMode}
-    tls_query_padding_blocksize: ${toString cfg.queryPaddingBlocksize}
-    edns_client_subnet_private: ${if cfg.subnetPrivate then "1" else "0"}
-    idle_timeout: ${toString cfg.idleTimeout}
-    listen_addresses:
-      ${listeners}
-    round_robin_upstreams: ${if cfg.roundRobinUpstreams then "1" else "0"}
-    ${cfg.extraConfig}
-    upstream_recursive_servers:
-    ${cfg.upstreamServers}
-  '';
-in
-
-{
  options = {
    services.stubby = {

      enable = mkEnableOption "Stubby DNS resolver";

-      fallbackProtocols = mkOption {
-        default = [ "GETDNS_TRANSPORT_TLS" ];
-        type = with types; listOf (enum [
-          "GETDNS_TRANSPORT_TLS"
-          "GETDNS_TRANSPORT_TCP"
-          "GETDNS_TRANSPORT_UDP"
-        ]);
-        description = ''
-          Ordered list composed of one or more transport protocols.
-          Strict mode should only use <literal>GETDNS_TRANSPORT_TLS</literal>.
-          Other options are <literal>GETDNS_TRANSPORT_UDP</literal> and
-          <literal>GETDNS_TRANSPORT_TCP</literal>.
+      settings = mkOption {
+        type = types.attrsOf settingsFormat.type;
+        example = lib.literalExpression ''
+          pkgs.stubby.passthru.settingsExample // {
+            upstream_recursive_servers = [{
+              address_data = "158.64.1.29";
+              tls_auth_name = "kaitain.restena.lu";
+              tls_pubkey_pinset = [{
+                digest = "sha256";
+                value = "7ftvIkA+UeN/ktVkovd/7rPZ6mbkhVI7/8HnFJIiLa4=";
+              }];
+            }];
+          };
        '';
-      };
-
-      authenticationMode = mkOption {
-        default = "GETDNS_AUTHENTICATION_REQUIRED";
-        type = types.enum [
-          "GETDNS_AUTHENTICATION_REQUIRED"
-          "GETDNS_AUTHENTICATION_NONE"
-        ];
        description = ''
-          Selects the Strict or Opportunistic usage profile.
-          For strict, set to <literal>GETDNS_AUTHENTICATION_REQUIRED</literal>.
-          for opportunistic, use <literal>GETDNS_AUTHENTICATION_NONE</literal>.
-        '';
-      };
-
-      queryPaddingBlocksize = mkOption {
-        default = 128;
-        type = types.int;
-        description = ''
-          EDNS0 option to pad the size of the DNS query to the given blocksize.
-        '';
-      };
-
-      subnetPrivate = mkOption {
-        default = true;
-        type = types.bool;
-        description = ''
-          EDNS0 option for ECS client privacy. Default is
-          <literal>true</literal>. If set, this option prevents the client
-          subnet from being sent to authoritative nameservers.
-        '';
-      };
-
-      idleTimeout = mkOption {
-        default = 10000;
-        type = types.int;
-        description = "EDNS0 option for keepalive idle timeout expressed in
-        milliseconds.";
-      };
-
-      listenAddresses = mkOption {
-        default = [ "127.0.0.1" "0::1" ];
-        type = with types; listOf str;
-        description = ''
-          Sets the listen address for the stubby daemon.
-          Uses port 53 by default.
-          Ise IP@port to specify a different port.
-        '';
-      };
-
-      roundRobinUpstreams = mkOption {
-        default = true;
-        type = types.bool;
-        description = ''
-          Instructs stubby to distribute queries across all available name
-          servers. Default is <literal>true</literal>. Set to
-          <literal>false</literal> in order to use the first available.
-        '';
-      };
-
-      upstreamServers = mkOption {
-        default = defaultUpstream;
-        type = types.lines;
-        description = ''
-          Replace default upstreams. See <citerefentry><refentrytitle>stubby
-          </refentrytitle><manvolnum>1</manvolnum></citerefentry> for an
-          example of the entry formatting. In Strict mode, at least one of the
-          following settings must be supplied for each nameserver:
-          <literal>tls_auth_name</literal> or
-          <literal>tls_pubkey_pinset</literal>.
+          Content of the Stubby configuration file. All Stubby settings may be set or queried
+          here. The default settings are available at
+          <literal>pkgs.stubby.passthru.settingsExample</literal>. See
+          <link xlink:href="https://dnsprivacy.org/wiki/display/DP/Configuring+Stubby"/>.
+          A list of the public recursive servers can be found here:
+          <link xlink:href="https://dnsprivacy.org/wiki/display/DP/DNS+Privacy+Test+Servers"/>.
        '';
      };

@ -184,20 +55,21 @@ in
        description = "Enable or disable debug level logging.";
      };

-      extraConfig = mkOption {
-        default = "";
-        type = types.lines;
-        description = ''
-          Add additional configuration options. see <citerefentry>
-          <refentrytitle>stubby</refentrytitle><manvolnum>1</manvolnum>
-          </citerefentry>for more options.
-        '';
-      };
    };
  };

  config = mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.stubby ];
+    assertions = [{
+      assertion =
+        (cfg.settings.resolution_type or "") == "GETDNS_RESOLUTION_STUB";
+      message = ''
+        services.stubby.settings.resolution_type must be set to "GETDNS_RESOLUTION_STUB".
+        Is services.stubby.settings unset?
+      '';
+    }];
+
+    services.stubby.settings.appdata_dir = "/var/cache/stubby";
+
    systemd.services.stubby = {
      description = "Stubby local DNS resolver";
      after = [ "network.target" ];
--- a/nixos/modules/services/web-servers/caddy/default.nix
+++ b/nixos/modules/services/web-servers/caddy/default.nix
@ -4,159 +4,81 @@ with lib;

 let
  cfg = config.services.caddy;
-  vhostToConfig = vhostName: vhostAttrs: ''
-    ${vhostName} ${builtins.concatStringsSep " " vhostAttrs.serverAliases} {
-      ${vhostAttrs.extraConfig}
-    }
-  '';
-  configFile = pkgs.writeText "Caddyfile" (builtins.concatStringsSep "\n"
-    ([ cfg.config ] ++ (mapAttrsToList vhostToConfig cfg.virtualHosts)));

-  formattedConfig = pkgs.runCommand "formattedCaddyFile" { } ''
-    ${cfg.package}/bin/caddy fmt ${configFile} > $out
-  '';
+  virtualHosts = attrValues cfg.virtualHosts;
+  acmeVHosts = filter (hostOpts: hostOpts.useACMEHost != null) virtualHosts;

-  tlsConfig = {
-    apps.tls.automation.policies = [{
-      issuers = [{
-        inherit (cfg) ca email;
-        module = "acme";
-      }];
-    }];
-  };
-
-  adaptedConfig = pkgs.runCommand "caddy-config-adapted.json" { } ''
-    ${cfg.package}/bin/caddy adapt \
-      --config ${formattedConfig} --adapter ${cfg.adapter} > $out
-  '';
-  tlsJSON = pkgs.writeText "tls.json" (builtins.toJSON tlsConfig);
-
-  # merge the TLS config options we expose with the ones originating in the Caddyfile
-  configJSON =
-    if cfg.ca != null then
-      let tlsConfigMerge = ''
-        {"apps":
-          {"tls":
-            {"automation":
-              {"policies":
-                (if .[0].apps.tls.automation.policies == .[1]?.apps.tls.automation.policies
-                 then .[0].apps.tls.automation.policies
-                 else (.[0].apps.tls.automation.policies + .[1]?.apps.tls.automation.policies)
-                 end)
-              }
-            }
-          }
-        }'';
-      in
-      pkgs.runCommand "caddy-config.json" { } ''
-        ${pkgs.jq}/bin/jq -s '.[0] * ${tlsConfigMerge}' ${adaptedConfig} ${tlsJSON} > $out
+  mkVHostConf = hostOpts:
+    let
+      sslCertDir = config.security.acme.certs.${hostOpts.useACMEHost}.directory;
+    in
      ''
-    else
-      adaptedConfig;
+        ${hostOpts.hostName} ${concatStringsSep " " hostOpts.serverAliases} {
+          bind ${concatStringsSep " " hostOpts.listenAddresses}
+          ${optionalString (hostOpts.useACMEHost != null) "tls ${sslCertDir}/cert.pem ${sslCertDir}/key.pem"}
+          log {
+            ${hostOpts.logFormat}
+          }
+
+          ${hostOpts.extraConfig}
+        }
+      '';
+
+  configFile =
+    let
+      Caddyfile = pkgs.writeText "Caddyfile" ''
+        {
+          ${optionalString (cfg.email != null) "email ${cfg.email}"}
+          ${optionalString (cfg.acmeCA != null) "acme_ca ${cfg.acmeCA}"}
+          log {
+            ${cfg.logFormat}
+          }
+        }
+        ${cfg.extraConfig}
+      '';
+
+      Caddyfile-formatted = pkgs.runCommand "Caddyfile-formatted" { nativeBuildInputs = [ cfg.package ]; } ''
+        ${cfg.package}/bin/caddy fmt ${Caddyfile} > $out
+      '';
+    in
+      if pkgs.stdenv.buildPlatform == pkgs.stdenv.hostPlatform then Caddyfile-formatted else Caddyfile;
 in
 {
  imports = [
    (mkRemovedOptionModule [ "services" "caddy" "agree" ] "this option is no longer necessary for Caddy 2")
+    (mkRenamedOptionModule [ "services" "caddy" "ca" ] [ "services" "caddy" "acmeCA" ])
+    (mkRenamedOptionModule [ "services" "caddy" "config" ] [ "services" "caddy" "extraConfig" ])
  ];

+  # interface
  options.services.caddy = {
    enable = mkEnableOption "Caddy web server";

-    config = mkOption {
-      default = "";
-      example = ''
-        example.com {
-          encode gzip
-          log
-          root /srv/http
-        }
-      '';
-      type = types.lines;
-      description = ''
-        Verbatim Caddyfile to use.
-        Caddy v2 supports multiple config formats via adapters (see <option>services.caddy.adapter</option>).
-      '';
-    };
-
-    virtualHosts = mkOption {
-      type = types.attrsOf (types.submodule (import ./vhost-options.nix {
-        inherit config lib;
-      }));
-      default = { };
-      example = literalExpression ''
-        {
-          "hydra.example.com" = {
-            serverAliases = [ "www.hydra.example.com" ];
-            extraConfig = ''''''
-              encode gzip
-              log
-              root /srv/http
-            '''''';
-          };
-        };
-      '';
-      description = "Declarative vhost config";
-    };
-
-
    user = mkOption {
      default = "caddy";
      type = types.str;
-      description = "User account under which caddy runs.";
+      description = ''
+        User account under which caddy runs.
+
+        <note><para>
+          If left as the default value this user will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the user exists before the Caddy service starts.
+        </para></note>
+      '';
    };

    group = mkOption {
      default = "caddy";
      type = types.str;
-      description = "Group account under which caddy runs.";
-    };
-
-    adapter = mkOption {
-      default = "caddyfile";
-      example = "nginx";
-      type = types.str;
      description = ''
-        Name of the config adapter to use.
-        See https://caddyserver.com/docs/config-adapters for the full list.
-      '';
-    };
+        Group account under which caddy runs.

-    resume = mkOption {
-      default = false;
-      type = types.bool;
-      description = ''
-        Use saved config, if any (and prefer over configuration passed with <option>services.caddy.config</option>).
-      '';
-    };
-
-    ca = mkOption {
-      default = "https://acme-v02.api.letsencrypt.org/directory";
-      example = "https://acme-staging-v02.api.letsencrypt.org/directory";
-      type = types.nullOr types.str;
-      description = ''
-        Certificate authority ACME server. The default (Let's Encrypt
-        production server) should be fine for most people. Set it to null if
-        you don't want to include any authority (or if you want to write a more
-        fine-graned configuration manually)
-      '';
-    };
-
-    email = mkOption {
-      default = "";
-      type = types.str;
-      description = "Email address (for Let's Encrypt certificate)";
-    };
-
-    dataDir = mkOption {
-      default = "/var/lib/caddy";
-      type = types.path;
-      description = ''
-        The data directory, for storing certificates. Before 17.09, this
-        would create a .caddy directory. With 17.09 the contents of the
-        .caddy directory are in the specified data directory instead.
-
-        Caddy v2 replaced CADDYPATH with XDG directories.
-        See https://caddyserver.com/docs/conventions#file-locations.
+        <note><para>
+          If left as the default value this user will automatically be created
+          on system activation, otherwise you are responsible for
+          ensuring the user exists before the Caddy service starts.
+        </para></note>
      '';
    };

@ -168,11 +90,176 @@ in
        Caddy package to use.
      '';
    };
+
+    dataDir = mkOption {
+      type = types.path;
+      default = "/var/lib/caddy";
+      description = ''
+        The data directory for caddy.
+
+        <note>
+          <para>
+            If left as the default value this directory will automatically be created
+            before the Caddy server starts, otherwise you are responsible for ensuring
+            the directory exists with appropriate ownership and permissions.
+          </para>
+          <para>
+            Caddy v2 replaced <literal>CADDYPATH</literal> with XDG directories.
+            See <link xlink:href="https://caddyserver.com/docs/conventions#file-locations"/>.
+          </para>
+        </note>
+      '';
+    };
+
+    logDir = mkOption {
+      type = types.path;
+      default = "/var/log/caddy";
+      description = ''
+        Directory for storing Caddy access logs.
+
+        <note><para>
+          If left as the default value this directory will automatically be created
+          before the Caddy server starts, otherwise the sysadmin is responsible for
+          ensuring the directory exists with appropriate ownership and permissions.
+        </para></note>
+      '';
+    };
+
+    logFormat = mkOption {
+      type = types.lines;
+      default = ''
+        level ERROR
+      '';
+      example = literalExpression ''
+        mkForce "level INFO";
+      '';
+      description = ''
+        Configuration for the default logger. See
+        <link xlink:href="https://caddyserver.com/docs/caddyfile/options#log"/>
+        for details.
+      '';
+    };
+
+    configFile = mkOption {
+      type = types.path;
+      default = configFile;
+      defaultText = "A Caddyfile automatically generated by values from services.caddy.*";
+      example = literalExpression ''
+        pkgs.writeText "Caddyfile" '''
+          example.com
+
+          root * /var/www/wordpress
+          php_fastcgi unix//run/php/php-version-fpm.sock
+          file_server
+        ''';
+      '';
+      description = ''
+        Override the configuration file used by Caddy. By default,
+        NixOS generates one automatically.
+      '';
+    };
+
+    adapter = mkOption {
+      default = "caddyfile";
+      example = "nginx";
+      type = types.str;
+      description = ''
+        Name of the config adapter to use.
+        See <link xlink:href="https://caddyserver.com/docs/config-adapters"/>
+        for the full list.
+
+        <note><para>
+          Any value other than <literal>caddyfile</literal> is only valid when
+          providing your own <option>configFile</option>.
+        </para></note>
+      '';
+    };
+
+    resume = mkOption {
+      default = false;
+      type = types.bool;
+      description = ''
+        Use saved config, if any (and prefer over any specified configuration passed with <literal>--config</literal>).
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = types.lines;
+      default = "";
+      example = ''
+        example.com {
+          encode gzip
+          log
+          root /srv/http
+        }
+      '';
+      description = ''
+        Additional lines of configuration appended to the automatically
+        generated <literal>Caddyfile</literal>.
+      '';
+    };
+
+    virtualHosts = mkOption {
+      type = with types; attrsOf (submodule (import ./vhost-options.nix { inherit cfg; }));
+      default = {};
+      example = literalExpression ''
+        {
+          "hydra.example.com" = {
+            serverAliases = [ "www.hydra.example.com" ];
+            extraConfig = '''
+              encode gzip
+              root /srv/http
+            ''';
+          };
+        };
+      '';
+      description = ''
+        Declarative specification of virtual hosts served by Caddy.
+      '';
+    };
+
+    acmeCA = mkOption {
+      default = "https://acme-v02.api.letsencrypt.org/directory";
+      example = "https://acme-staging-v02.api.letsencrypt.org/directory";
+      type = with types; nullOr str;
+      description = ''
+        The URL to the ACME CA's directory. It is strongly recommended to set
+        this to Let's Encrypt's staging endpoint for testing or development.
+
+        Set it to <literal>null</literal> if you want to write a more
+        fine-grained configuration manually.
+      '';
+    };
+
+    email = mkOption {
+      default = null;
+      type = with types; nullOr str;
+      description = ''
+        Your email address. Mainly used when creating an ACME account with your
+        CA, and is highly recommended in case there are problems with your
+        certificates.
+      '';
+    };
+
  };

+  # implementation
  config = mkIf cfg.enable {
+
+    assertions = [
+      { assertion = cfg.adapter != "caddyfile" -> cfg.configFile != configFile;
+        message = "Any value other than 'caddyfile' is only valid when providing your own `services.caddy.configFile`";
+      }
+    ];
+
+    services.caddy.extraConfig = concatMapStringsSep "\n" mkVHostConf virtualHosts;
+
    systemd.packages = [ cfg.package ];
    systemd.services.caddy = {
+      wants = map (hostOpts: "acme-finished-${hostOpts.useACMEHost}.target") acmeVHosts;
+      after = map (hostOpts: "acme-selfsigned-${hostOpts.useACMEHost}.service") acmeVHosts;
+      before = map (hostOpts: "acme-${hostOpts.useACMEHost}.service") acmeVHosts;
+
      wantedBy = [ "multi-user.target" ];
      startLimitIntervalSec = 14400;
      startLimitBurst = 10;
@ -180,13 +267,17 @@ in
      serviceConfig = {
        # https://www.freedesktop.org/software/systemd/man/systemd.service.html#ExecStart=
        # If the empty string is assigned to this option, the list of commands to start is reset, prior assignments of this option will have no effect.
-        ExecStart = [ "" "${cfg.package}/bin/caddy run ${optionalString cfg.resume "--resume"} --config ${configJSON}" ];
-        ExecReload = [ "" "${cfg.package}/bin/caddy reload --config ${configJSON}" ];
+        ExecStart = [ "" "${cfg.package}/bin/caddy run --config ${cfg.configFile} --adapter ${cfg.adapter} ${optionalString cfg.resume "--resume"}" ];
+        ExecReload = [ "" "${cfg.package}/bin/caddy reload --config ${cfg.configFile} --adapter ${cfg.adapter}" ];

+        ExecStartPre = "${cfg.package}/bin/caddy validate --config ${cfg.configFile} --adapter ${cfg.adapter}";
        User = cfg.user;
        Group = cfg.group;
        ReadWriteDirectories = cfg.dataDir;
+        StateDirectory = mkIf (cfg.dataDir == "/var/lib/caddy") [ "caddy" ];
+        LogsDirectory = mkIf (cfg.logDir == "/var/log/caddy") [ "caddy" ];
        Restart = "on-abnormal";
+        SupplementaryGroups = mkIf (length acmeVHosts != 0) [ "acme" ];

        # TODO: attempt to upstream these options
        NoNewPrivileges = true;
@ -200,7 +291,6 @@ in
        group = cfg.group;
        uid = config.ids.uids.caddy;
        home = cfg.dataDir;
-        createHome = true;
      };
    };

@ -208,5 +298,12 @@ in
      caddy.gid = config.ids.gids.caddy;
    };

+    security.acme.certs =
+      let
+        eachACMEHost = unique (catAttrs "useACMEHost" acmeVHosts);
+        reloads = map (useACMEHost: nameValuePair useACMEHost { reloadServices = [ "caddy.service" ]; }) eachACMEHost;
+      in
+        listToAttrs reloads;
+
  };
 }
--- a/nixos/modules/services/web-servers/caddy/vhost-options.nix
+++ b/nixos/modules/services/web-servers/caddy/vhost-options.nix
@ -1,15 +1,19 @@
-# This file defines the options that can be used both for the Nginx
-# main server configuration, and for the virtual hosts.  (The latter
-# has additional options that affect the web server as a whole, like
-# the user/group to run under.)
-
-{ lib, ... }:
-
-with lib;
+{ cfg }:
+{ config, lib, name, ... }:
+let
+  inherit (lib) literalExpression mkOption types;
+in
 {
  options = {
+
+    hostName = mkOption {
+      type = types.str;
+      default = name;
+      description = "Canonical hostname for the server.";
+    };
+
    serverAliases = mkOption {
-      type = types.listOf types.str;
+      type = with types; listOf str;
      default = [ ];
      example = [ "www.example.org" "example.org" ];
      description = ''
@ -17,12 +21,59 @@ with lib;
      '';
    };

+    listenAddresses = mkOption {
+      type = with types; listOf str;
+      description = ''
+        A list of host interfaces to bind to for this virtual host.
+      '';
+      default = [ ];
+      example = [ "127.0.0.1" "::1" ];
+    };
+
+    useACMEHost = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        A host of an existing Let's Encrypt certificate to use.
+        This is mostly useful if you use DNS challenges but Caddy does not
+        currently support your provider.
+
+        <emphasis>Note that this option does not create any certificates, nor
+        does it add subdomains to existing ones – you will need to create them
+        manually using <xref linkend="opt-security.acme.certs"/>. Additionally,
+        you should probably add the <literal>caddy</literal> user to the
+        <literal>acme</literal> group to grant access to the certificates.</emphasis>
+      '';
+    };
+
+    logFormat = mkOption {
+      type = types.lines;
+      default = ''
+        output file ${cfg.logDir}/access-${config.hostName}.log
+      '';
+      defaultText = ''
+        output file ''${config.services.caddy.logDir}/access-''${hostName}.log
+      '';
+      example = literalExpression ''
+        mkForce '''
+          output discard
+        ''';
+      '';
+      description = ''
+        Configuration for HTTP request logging (also known as access logs). See
+        <link xlink:href="https://caddyserver.com/docs/caddyfile/directives/log#log"/>
+        for details.
+      '';
+    };
+
    extraConfig = mkOption {
      type = types.lines;
      default = "";
      description = ''
-        These lines go into the vhost verbatim
+        Additional lines of configuration appended to this virtual host in the
+        automatically generated <literal>Caddyfile</literal>.
      '';
    };
+
  };
 }
--- a/nixos/modules/virtualisation/kubevirt.nix
+++ b/nixos/modules/virtualisation/kubevirt.nix
@ -0,0 +1,30 @@
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    ../profiles/qemu-guest.nix
+  ];
+
+  config = {
+    fileSystems."/" = {
+      device = "/dev/disk/by-label/nixos";
+      fsType = "ext4";
+      autoResize = true;
+    };
+
+    boot.growPartition = true;
+    boot.kernelParams = [ "console=ttyS0" ];
+    boot.loader.grub.device = "/dev/vda";
+    boot.loader.timeout = 0;
+
+    services.qemuGuest.enable = true;
+    services.openssh.enable = true;
+    services.cloud-init.enable = true;
+    systemd.services."serial-getty@ttyS0".enable = true;
+
+    system.build.kubevirtImage = import ../../lib/make-disk-image.nix {
+      inherit lib config pkgs;
+      format = "qcow2";
+    };
+  };
+}
--- a/pkgs/applications/audio/hydrogen/default.nix
+++ b/pkgs/applications/audio/hydrogen/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "hydrogen";
-  version = "1.1.0";
+  version = "1.1.1";

  src = fetchFromGitHub {
    owner = "hydrogen-music";
    repo = pname;
    rev = version;
-    sha256 = "sha256-G+7vTUxYiPNKJ0Qxf/E/t0d6vC/lDs9vNfSbvUXTQgI=";
+    sha256 = "sha256-to24PB9cs4vun93uXEWNVsmSLFRuLGfC4hCh7+mbvIo=";
  };

  nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
--- a/pkgs/applications/audio/praat/default.nix
+++ b/pkgs/applications/audio/praat/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "praat";
-  version = "6.1.55";
+  version = "6.2.03";

  src = fetchFromGitHub {
    owner = "praat";
    repo = "praat";
    rev = "v${version}";
-    sha256 = "sha256-PQVbrohIlmzKcG/8TzOBgyQWWaMH88voMNWAqEfyUWI=";
+    sha256 = "sha256-0WTbLEPEqPm7BI02mjlwcsewkrmIsHtNlhccqK1d6SI=";
  };

  configurePhase = ''
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@ -247,12 +247,12 @@ in

  clion = buildClion rec {
    name = "clion-${version}";
-    version = "2021.3"; /* updated by script */
+    version = "2021.3.1"; /* updated by script */
    description  = "C/C++ IDE. New. Intelligent. Cross-platform";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/cpp/CLion-${version}.tar.gz";
-      sha256 = "0rvq0k99c4kniw2k0a8m2hq27v9nvn7qg6yg9dwxlmadsrx6as29"; /* updated by script */
+      sha256 = "0nf1r02i51pplrazlyavc6xs6mi91spa92srfqpsgb78ar9vn027"; /* updated by script */
    };
    wmClass = "jetbrains-clion";
    update-channel = "CLion RELEASE"; # channel's id as in http://www.jetbrains.com/updates/updates.xml
@ -260,12 +260,12 @@ in

  datagrip = buildDataGrip rec {
    name = "datagrip-${version}";
-    version = "2021.3.1"; /* updated by script */
+    version = "2021.3.2"; /* updated by script */
    description = "Your Swiss Army Knife for Databases and SQL";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/datagrip/${name}.tar.gz";
-      sha256 = "18drbddcjbbv6q6j95wy7ila8d7imi0gh5nnf0lhj4gkkxhszmii"; /* updated by script */
+      sha256 = "0m0nc988w2a2p0l3a9cirnk2vbrsas4wb3fc4pwiml5bz5vwh255"; /* updated by script */
    };
    wmClass = "jetbrains-datagrip";
    update-channel = "DataGrip RELEASE";
@ -273,12 +273,12 @@ in

  goland = buildGoland rec {
    name = "goland-${version}";
-    version = "2021.3"; /* updated by script */
+    version = "2021.3.1"; /* updated by script */
    description = "Up and Coming Go IDE";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/go/${name}.tar.gz";
-      sha256 = "0bdsvfsx0vhmvlqvy9phw6yz98la8qw2avm4p0yl9j8y9zplbhl0"; /* updated by script */
+      sha256 = "1kl1sg2fjh8wpx47984vw6zrqf7nakbji606cl52brkxik7py0d3"; /* updated by script */
    };
    wmClass = "jetbrains-goland";
    update-channel = "GoLand RELEASE";
@ -365,12 +365,12 @@ in

  rider = buildRider rec {
    name = "rider-${version}";
-    version = "2021.3.1"; /* updated by script */
+    version = "2021.3.2"; /* updated by script */
    description = "A cross-platform .NET IDE based on the IntelliJ platform and ReSharper";
    license = lib.licenses.unfree;
    src = fetchurl {
      url = "https://download.jetbrains.com/rider/JetBrains.Rider-${version}.tar.gz";
-      sha256 = "0c788xvcd5b9jafz2yyllj1pzgc9ry3pg82qi8glghvimjnk1cfd"; /* updated by script */
+      sha256 = "0arnh9wlw874jqlgad00q0nf1kjp7pvb4xixwrb6v1l9fbr9nsan"; /* updated by script */
    };
    wmClass = "jetbrains-rider";
    update-channel = "Rider RELEASE";
--- a/pkgs/applications/finance/odoo/default.nix
+++ b/pkgs/applications/finance/odoo/default.nix
@ -56,6 +56,7 @@ buildPythonApplication rec {
    libsass
    lxml
    markupsafe
+    mock
    num2words
    ofxparse
    passlib
@ -76,7 +77,7 @@ buildPythonApplication rec {
    reportlab
    requests
    vobject
-    werkzeug1
+    werkzeug
    xlrd
    XlsxWriter
    xlwt
@ -92,6 +93,6 @@ buildPythonApplication rec {
    description = "Open Source ERP and CRM";
    homepage = "https://www.odoo.com/";
    license = licenses.lgpl3Only;
-    maintainers = [ maintainers.mkg20001 ];
+    maintainers = with maintainers; [ mkg20001 ];
  };
 }
--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@ -11,11 +11,11 @@

 stdenv.mkDerivation rec {
  pname = "drawio";
-  version = "16.0.0";
+  version = "16.0.2";

  src = fetchurl {
    url = "https://github.com/jgraph/drawio-desktop/releases/download/v${version}/drawio-x86_64-${version}.rpm";
-    sha256 = "4fae34cf49ece02dd4c7a3cd6c9bf3a3cbda0d555b819482edf886afb164ba4d";
+    sha256 = "980af60ea53fd0c255cfa3faa9407b146658074ea411bc491f53a047352b5b66";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/azuredatastudio/default.nix
+++ b/pkgs/applications/misc/azuredatastudio/default.nix
@ -66,14 +66,14 @@ in
 stdenv.mkDerivation rec {

  pname = "azuredatastudio";
-  version = "1.33.0";
+  version = "1.33.1";

  desktopItems = [ desktopItem urlHandlerDesktopItem ];

  src = fetchurl {
    name = "${pname}-${version}.tar.gz";
    url = "https://azuredatastudio-update.azurewebsites.net/${version}/linux-x64/stable";
-    sha256 = "0593xs44ryfyxy0hc31hdbj706q16h58jb0qyfyncn7ngybm3423";
+    sha256 = "sha256-jgZ8iZkic26JSgFTXpu1u1+MM4G5AqyW6Mj1tx5QwcY=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/binance/default.nix
+++ b/pkgs/applications/misc/binance/default.nix
@ -3,11 +3,11 @@

 stdenv.mkDerivation rec {
  pname = "binance";
-  version = "1.28.0";
+  version = "1.29.0";

  src = fetchurl {
    url = "https://github.com/binance/desktop/releases/download/v${version}/${pname}-${version}-amd64-linux.deb";
-    sha256 = "sha256-qJuD+O4M9U8P6JhFUFc92yllX1vgZZvTlTd0bph3Vo4=";
+    sha256 = "sha256-LQX5RUTVm6lBdRzCFMBq1NLGGiLBVyykJ1LY9FqINnY=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/joplin-desktop/default.nix
+++ b/pkgs/applications/misc/joplin-desktop/default.nix
@ -2,7 +2,7 @@

 let
  pname = "joplin-desktop";
-  version = "2.5.12";
+  version = "2.6.10";
  name = "${pname}-${version}";

  inherit (stdenv.hostPlatform) system;
@ -16,8 +16,8 @@ let
  src = fetchurl {
    url = "https://github.com/laurent22/joplin/releases/download/v${version}/Joplin-${version}.${suffix}";
    sha256 = {
-      x86_64-linux = "sha256-/S/paqMKVerSQFjA4wQ9fLV0WaqKm4CzQfy+0OdH7c8=";
-      x86_64-darwin = "sha256-5eKTfZRpW7IYwFt8TeJiytrwEpiHBgN4k9kth+Lh0Bo=";
+      x86_64-linux = "sha256-2/QYEzQjB9n/4k5I/fry3ol8Fpsb5+tc1ttVdf2ID+4=";
+      x86_64-darwin = "sha256-BwBpq78hYJVUItUgs9lonBTV4YWJ+qvML6VTj5M4BQ4=";
    }.${system} or throwSystem;
  };

--- a/pkgs/applications/misc/moolticute/default.nix
+++ b/pkgs/applications/misc/moolticute/default.nix
@ -9,13 +9,13 @@

 mkDerivation rec {
  pname = "moolticute";
-  version = "0.52.0";
+  version = "0.53.2";

  src = fetchFromGitHub {
    owner = "mooltipass";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-6o0Tf6qBxCEOvfSuEP2Qz72T9Oexp95knRCtwImlpsA=";
+    sha256 = "sha256-CJVOmFX2wqftQt8j9Tlw93YBiTWE8l1RLprG0cmHeUE=";
  };

  outputs = [ "out" "udev" ];
--- a/pkgs/applications/misc/obsidian/default.nix
+++ b/pkgs/applications/misc/obsidian/default.nix
@ -31,11 +31,11 @@ let

 in stdenv.mkDerivation rec {
  pname = "obsidian";
-  version = "0.12.19";
+  version = "0.13.14";

  src = fetchurl {
    url = "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/obsidian-${version}.tar.gz";
-    sha256 = "sha256-M9U67+mCL/CziTprCAhfrZTWl6i7HRfH24l/xqUqkIg=";
+    sha256 = "0d55lk643yqjz4s6j5lbrdkf9f7wmwlz9ahjx760rzqpzy5190nr";
  };

  nativeBuildInputs = [ makeWrapper graphicsmagick ];
--- a/pkgs/applications/misc/prusa-slicer/super-slicer.nix
+++ b/pkgs/applications/misc/prusa-slicer/super-slicer.nix
@ -5,8 +5,8 @@ let
  description = "PrusaSlicer fork with more features and faster development cycle";

  versions = {
-    stable = { version = "2.3.57.7"; sha256 = "sha256-qYvHNGuA2YDatrY/K2g5PE2gD53VXNptCaa7TpWGV7g="; };
-    latest = { version = "2.3.57.7"; sha256 = "sha256-qYvHNGuA2YDatrY/K2g5PE2gD53VXNptCaa7TpWGV7g="; };
+    stable = { version = "2.3.57.8"; sha256 = "sha256-k1G9sFukYyCqVeJIbYgjJX9T8zqmFTmjmj9OXZ78+LY="; };
+    latest = { version = "2.3.57.8"; sha256 = "sha256-k1G9sFukYyCqVeJIbYgjJX9T8zqmFTmjmj9OXZ78+LY="; };
  };

  override = { version, sha256 }: super: {
--- a/pkgs/applications/misc/pwsafe/default.nix
+++ b/pkgs/applications/misc/pwsafe/default.nix
@ -1,4 +1,5 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, zip, gettext, perl
+{ lib, stdenv, fetchFromGitHub
+, cmake, pkg-config, zip, gettext, perl
 , wxGTK30, libXext, libXi, libXt, libXtst, xercesc
 , qrencode, libuuid, libyubikey, yubikey-personalization
 , curl, openssl, file
@ -6,13 +7,14 @@

 stdenv.mkDerivation rec {
  pname = "pwsafe";
-  version = "3.56.0";
+  version = "1.14.0"; # do NOT update to 3.x Windows releases
+  # nixpkgs-update: no auto update

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = version;
-    sha256 = "sha256-ZLX/3cs1cdia5+32QEwE6q3V0uFNkkmiIGboKW6Xej8=";
+    hash = "sha256-s3IXe4gTwUOzQslNfWrcN/srrG9Jv02zfkGgiZN3C1s=";
  };

  nativeBuildInputs = [
@ -32,19 +34,19 @@ stdenv.mkDerivation rec {

  postPatch = ''
    # Fix perl scripts used during the build.
-    for f in `find . -type f -name '*.pl'`; do
+    for f in $(find . -type f -name '*.pl') ; do
      patchShebangs $f
    done

    # Fix hard coded paths.
-    for f in `grep -Rl /usr/share/ src`; do
+    for f in $(grep -Rl /usr/share/ src) ; do
      substituteInPlace $f --replace /usr/share/ $out/share/
    done

    # Fix hard coded zip path.
    substituteInPlace help/Makefile.linux --replace /usr/bin/zip ${zip}/bin/zip

-    for f in `grep -Rl /usr/bin/ .`; do
+    for f in $(grep -Rl /usr/bin/ .) ; do
      substituteInPlace $f --replace /usr/bin/ ""
    done
  '';
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -27,9 +27,8 @@
 , ltoSupport ? (stdenv.isLinux && stdenv.is64bit), overrideCC, buildPackages
 , gssSupport ? true, libkrb5
 , pipewireSupport ? waylandSupport && webrtcSupport, pipewire
-# Workaround: disabled since currently jemalloc causes crashes with LLVM 13.
-# https://bugzilla.mozilla.org/show_bug.cgi?id=1741454
-, jemallocSupport ? false, jemalloc
+# Jemalloc could reduce memory consumption.
+, jemallocSupport ? true, jemalloc

 ## privacy-related options

--- a/pkgs/applications/networking/cluster/helmfile/default.nix
+++ b/pkgs/applications/networking/cluster/helmfile/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "helmfile";
-  version = "0.141.0";
+  version = "0.142.0";

  src = fetchFromGitHub {
    owner = "roboll";
    repo = "helmfile";
    rev = "v${version}";
-    sha256 = "sha256-UwjV3xgnZa0Emzw4FP/+gHh1ES6MTihrrlGKUBH6O9Q=";
+    sha256 = "sha256-kz5U9MPpN+14Eb1D1hjwDfvTOygzg0unyIgrFTFhE0Q=";
  };

  vendorSha256 = "sha256-HKHMeDnIDmQ7AjuS2lYCMphTHGD1JgQuBYDJe2+PEk4=";
--- a/pkgs/applications/networking/protonmail-bridge/default.nix
+++ b/pkgs/applications/networking/protonmail-bridge/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "protonmail-bridge";
-  version = "1.8.10";
+  version = "1.8.12";

  src = fetchFromGitHub {
    owner = "ProtonMail";
    repo = "proton-bridge";
    rev = "br-${version}";
-    sha256 = "sha256-T6pFfGKG4VNcZ6EYEU5A5V91PlZZDylTNSNbah/pwS4=";
+    sha256 = "sha256-CkvD7PKx2Gm2KgsIIqQ9l1Z3tWlhqIbW0sxCV2UBYTE=";
  };

-  vendorSha256 = "sha256-hRGedgdQlky9UBqsVTSbgAgii1skF/MA21ZQ0+goaM4=";
+  vendorSha256 = "sha256-Pz3xRTwlnJGh1XvxIbyjvYcMywk/wdp4hYovPLBD494=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/applications/networking/remote/citrix-workspace/generic.nix
+++ b/pkgs/applications/networking/remote/citrix-workspace/generic.nix
@ -70,6 +70,7 @@ stdenv.mkDerivation rec {
    freetype
    gdk-pixbuf
    gnome2.gtkglext
+    glib-networking
    webkitgtk
    gtk2
    gtk2-x11
--- a/pkgs/applications/printing/pappl/default.nix
+++ b/pkgs/applications/printing/pappl/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "pappl";
-  version = "1.0.3";
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "michaelrsweet";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-B3g6R0/li+5D4odFG21qj+SR3K4PFnzzxIGCwbk1buo=";
+    sha256 = "sha256-FsmR0fFb9bU9G3oUyJU1eDLcoZ6OQ2//TINlPrW6lU0=";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/applications/radio/gnuradio/3.8.nix
+++ b/pkgs/applications/radio/gnuradio/3.8.nix
@ -248,6 +248,11 @@ stdenv.mkDerivation rec {
      url = "https://github.com/gnuradio/gnuradio/commit/9d7343526dd793120b6425cd9a6969416ed32503.patch";
      sha256 = "sha256-usSoRDDuClUfdX4yFbQNu8wDzve6UEhZYTFj1oZbFic=";
    })
+    # Fix compilation with boost 177
+    (fetchpatch {
+      url = "https://github.com/gnuradio/gnuradio/commit/2c767bb260a25b415e8c9c4b3ea37280b2127cec.patch";
+      sha256 = "sha256-l4dSzkXb5s3vcCeuKMMwiKfv83hFI9Yg+EMEX+sl+Uo=";
+    })
  ];
  passthru = shared.passthru // {
    # Deps that are potentially overriden and are used inside GR plugins - the same version must
--- a/pkgs/applications/radio/uhd/default.nix
+++ b/pkgs/applications/radio/uhd/default.nix
@ -6,14 +6,13 @@
 , pkg-config
 # See https://files.ettus.com/manual_archive/v3.15.0.0/html/page_build_guide.html for dependencies explanations
 , boost
-, enableLibuhd_C_api ? true
+, enableCApi ? true
 # requires numpy
-, enableLibuhd_Python_api ? false
+, enablePythonApi ? false
 , python3
 , enableExamples ? false
 , enableUtils ? false
-, enableLiberio ? false
-, liberio
+, enableSim ? false
 , libusb1
 , enableDpdk ? false
 , dpdk
@ -25,7 +24,6 @@
 , enableUsrp1 ? true
 , enableUsrp2 ? true
 , enableX300 ? true
-, enableN230 ? true
 , enableN300 ? true
 , enableN320 ? true
 , enableE300 ? true
@ -41,18 +39,18 @@ stdenv.mkDerivation rec {
  pname = "uhd";
  # UHD seems to use three different version number styles: x.y.z, xxx_yyy_zzz
  # and xxx.yyy.zzz. Hrmpf... style keeps changing
-  version = "4.0.0.0";
+  version = "4.1.0.5";

  src = fetchFromGitHub {
    owner = "EttusResearch";
    repo = "uhd";
    rev = "v${version}";
-    sha256 = "NCyiI4pIPw0nBRFdUGpgZ/x2mWz+Qm78ZGACUnSbGSs=";
+    sha256 = "sha256-XBq4GkLRR2SFunFRvpPOMiIbTuUkMYf8tPAoHCoveRA=";
  };
  # Firmware images are downloaded (pre-built) from the respective release on Github
  uhdImagesSrc = fetchurl {
    url = "https://github.com/EttusResearch/uhd/releases/download/v${version}/uhd-images_${version}.tar.xz";
-    sha256 = "Xfx0bsHUQ5+Dp+xk0sVWWP83oyXQcUH5AX4PNEE7fY4=";
+    sha256 = "HctHB90ikOMkrYNyWmjGE/2HvA7xXKCUezdtiqzN+1A=";
  };

  cmakeFlags = [
@ -61,9 +59,8 @@ stdenv.mkDerivation rec {
    "-DENABLE_TESTS=ON" # This installs tests as well so we delete them via postPhases
    "-DENABLE_EXAMPLES=${onOffBool enableExamples}"
    "-DENABLE_UTILS=${onOffBool enableUtils}"
-    "-DENABLE_LIBUHD_C_API=${onOffBool enableLibuhd_C_api}"
-    "-DENABLE_LIBUHD_PYTHON_API=${onOffBool enableLibuhd_Python_api}"
-    "-DENABLE_LIBERIO=${onOffBool enableLiberio}"
+    "-DENABLE_C_API=${onOffBool enableCApi}"
+    "-DENABLE_PYTHON_API=${onOffBool enablePythonApi}"
    "-DENABLE_DPDK=${onOffBool enableDpdk}"
    # Devices
    "-DENABLE_OCTOCLOCK=${onOffBool enableOctoClock}"
@ -73,7 +70,6 @@ stdenv.mkDerivation rec {
    "-DENABLE_USRP1=${onOffBool enableUsrp1}"
    "-DENABLE_USRP2=${onOffBool enableUsrp2}"
    "-DENABLE_X300=${onOffBool enableX300}"
-    "-DENABLE_N230=${onOffBool enableN230}"
    "-DENABLE_N300=${onOffBool enableN300}"
    "-DENABLE_N320=${onOffBool enableN320}"
    "-DENABLE_E300=${onOffBool enableE300}"
@ -87,7 +83,7 @@ stdenv.mkDerivation rec {

  # Python + Mako are always required for the build itself but not necessary for runtime.
  pythonEnv = python3.withPackages (ps: with ps; [ Mako ]
-    ++ optionals (enableLibuhd_Python_api) [ numpy setuptools ]
+    ++ optionals (enablePythonApi) [ numpy setuptools ]
    ++ optionals (enableUtils) [ requests six ]
  );

@ -98,7 +94,7 @@ stdenv.mkDerivation rec {
    # If both enableLibuhd_Python_api and enableUtils are off, we don't need
    # pythonEnv in buildInputs as it's a 'build' dependency and not a runtime
    # dependency
-    ++ optionals (!enableLibuhd_Python_api && !enableUtils) [ pythonEnv ]
+    ++ optionals (!enablePythonApi && !enableUtils) [ pythonEnv ]
  ;
  buildInputs = [
    boost
@ -107,12 +103,12 @@ stdenv.mkDerivation rec {
    # However, if enableLibuhd_Python_api *or* enableUtils is on, we need
    # pythonEnv for runtime as well. The utilities' runtime dependencies are
    # handled at the environment
-    ++ optionals (enableLibuhd_Python_api || enableUtils) [ pythonEnv ]
-    ++ optionals (enableLiberio) [ liberio ]
+    ++ optionals (enablePythonApi || enableUtils) [ pythonEnv ]
    ++ optionals (enableDpdk) [ dpdk ]
  ;

-  doCheck = true;
+  # many tests fails on darwin, according to ofborg
+  doCheck = !stdenv.isDarwin;

  # Build only the host software
  preConfigure = "cd host";
@ -154,6 +150,6 @@ stdenv.mkDerivation rec {
    homepage = "https://uhd.ettus.com/";
    license = licenses.gpl3Plus;
    platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ bjornfor fpletz tomberek ];
+    maintainers = with maintainers; [ bjornfor fpletz tomberek doronbehar ];
  };
 }
--- a/pkgs/applications/science/electronics/flatcam/default.nix
+++ b/pkgs/applications/science/electronics/flatcam/default.nix
@ -18,6 +18,7 @@ python3Packages.buildPythonApplication rec {
  propagatedBuildInputs = with python3Packages; [
    matplotlib
    numpy
+    packaging
    pyqt4
    Rtree
    scipy
--- a/pkgs/applications/science/geometry/gama/default.nix
+++ b/pkgs/applications/science/geometry/gama/default.nix
@ -1,11 +1,11 @@
 { stdenv, fetchurl, lib, expat, octave, libxml2, texinfo, zip }:
 stdenv.mkDerivation rec {
  pname = "gama";
-  version = "2.14";
+  version = "2.16";

  src = fetchurl {
    url = "mirror://gnu/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-ltYoJyo4b4Ys70nbZo5gxkjBw/RiEs5Rrdb6he9bsBI=";
+    sha256 = "sha256-fO2AHZnqRvCF1+AlKDeD3ygivW3zXCuF10O2nKL2CWs=";
  };

  buildInputs = [ expat ];
--- a/pkgs/applications/science/math/sage/patches/fonttools-deprecation-warnings.patch
+++ b/pkgs/applications/science/math/sage/patches/fonttools-deprecation-warnings.patch
@ -0,0 +1,39 @@
+diff --git a/src/doc/en/prep/Advanced-2DPlotting.rst b/src/doc/en/prep/Advanced-2DPlotting.rst
+index 337457afef..f7c76f4b56 100644
+--- a/src/doc/en/prep/Advanced-2DPlotting.rst
+++ b/src/doc/en/prep/Advanced-2DPlotting.rst
+@@ -695,6 +695,8 @@ by the cells.
+ 
+     sage: pdf_savename = name+'.pdf'
+     sage: p.save(pdf_savename)
+    ...
+    DeprecationWarning: The py23 module has been deprecated and will be removed in a future release. Please update your code.
+ 
+ Notably, we can export in formats ready for inclusion in web pages.
+ 
+diff --git a/src/sage/plot/disk.py b/src/sage/plot/disk.py
+index 8680a1c9b1..e83763b678 100644
+--- a/src/sage/plot/disk.py
+++ b/src/sage/plot/disk.py
+@@ -156,6 +156,8 @@ class Disk(GraphicPrimitive):
+             sage: f = tmp_filename(ext='.pdf')
+             sage: p = disk((0,0), 5, (0, pi/4), alpha=0.5)
+             sage: p.save(f)
+            ...
+            DeprecationWarning: The py23 module has been deprecated and will be removed in a future release. Please update your code.
+ 
+         """
+         import matplotlib.patches as patches
+diff --git a/src/sage/plot/text.py b/src/sage/plot/text.py
+index 04cbdedf76..a970f97b79 100644
+--- a/src/sage/plot/text.py
+++ b/src/sage/plot/text.py
+@@ -325,6 +325,8 @@ def text(string, xy, **options):
+     You can save text as part of PDF output::
+ 
+         sage: text("sage", (0,0), rgbcolor=(0,0,0)).save(os.path.join(SAGE_TMP, 'a.pdf'))
+        ...
+        DeprecationWarning: The py23 module has been deprecated and will be removed in a future release. Please update your code.
+ 
+     Some examples of bounding box::
+ 
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@ -109,6 +109,14 @@ stdenv.mkDerivation rec {
    # strictly necessary, but keeps us from littering in the user's HOME.
    ./patches/sympow-cache.patch

+    # fonttools 4.26.2, used by matplotlib, uses deprecated methods internally.
+    # This is fixed in fonttools 4.27.0, but since fonttools is a dependency of
+    # 2000+ packages and DeprecationWarnings are hidden almost everywhere by
+    # default (not on Sage's doctest harness, though), it doesn't make sense to
+    # backport the fix (see https://github.com/NixOS/nixpkgs/pull/151415).
+    # Let's just assume warnings are expected until we update to 4.27.0.
+    ./patches/fonttools-deprecation-warnings.patch
+
    # https://trac.sagemath.org/ticket/32305
    (fetchSageDiff {
      base = "9.4";
@ -140,6 +148,22 @@ stdenv.mkDerivation rec {
      rev = "f5f7a86908daf60b25e66e6a189c51ada7e0a732";
      sha256 = "sha256-H/caGx3q4KcdsyGe+ojV9bUTQ5y0siqM+QHgDbeEnbw=";
    })
+
+    # https://trac.sagemath.org/ticket/32909
+    (fetchSageDiff {
+      base = "9.5.beta7";
+      name = "matplotlib-3.5-deprecation-warnings.patch";
+      rev = "a5127dc56fdf5c2e82f6bc781cfe78dbd04e97b7";
+      sha256 = "sha256-p23qUu9mgEUbdbX6cy7ArxZAtpcFjCKbgyxN4jWvj1o=";
+    })
+
+    # https://trac.sagemath.org/ticket/32968
+    (fetchSageDiff {
+      base = "9.5.beta8";
+      name = "sphinx-4.3-update.patch";
+      rev = "fc84f82f52b6f05f512cb359ec7c100f93cf8841";
+      sha256 = "sha256-bBbfdcnw/9LUOlY8rHJRbFJEdMXK4shosqTNaobTS1Q=";
+    })
  ];

  patches = nixPatches ++ bugfixPatches ++ packageUpgradePatches;
--- a/pkgs/applications/version-management/git-and-tools/git/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git/default.nix
@ -25,7 +25,7 @@ assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;

 let
-  version = "2.34.0";
+  version = "2.34.1";
  svn = subversionClient.override { perlBindings = perlSupport; };

  gitwebPerlLibs = with perlPackages; [ CGI HTMLParser CGIFast FCGI FCGIProcManager HTMLTagCloud ];
@ -37,7 +37,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://www.kernel.org/pub/software/scm/git/git-${version}.tar.xz";
-    sha256 = "07s1c9lzlm4kpbb5lmxy0869phg7037pv4faz5hlqyb5csrbjv7x";
+    sha256 = "0b40vf315s1kz65x1wq47g8srl4wqac39pwnvlj1mdzs3kfma1rs";
  };

  outputs = [ "out" ] ++ lib.optional withManual "doc";
--- a/pkgs/applications/video/bombono/default.nix
+++ b/pkgs/applications/video/bombono/default.nix
@ -3,7 +3,7 @@
 , pkg-config
 , fetchpatch
 , scons
-, boost
+, boost172
 , dvdauthor
 , dvdplusrwtools
 , enca
@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ wrapGAppsHook scons pkg-config gettext ];

  buildInputs = [
-    boost
+    boost172
    dvdauthor
    dvdplusrwtools
    enca
--- a/pkgs/applications/video/clipgrab/default.nix
+++ b/pkgs/applications/video/clipgrab/default.nix
@ -5,10 +5,10 @@

 mkDerivation rec {
  pname = "clipgrab";
-  version = "3.9.6";
+  version = "3.9.7";

  src = fetchurl {
-    sha256 = "sha256-1rQu2Gh9PKSbC0tuQxLwFhzy280z4obpa+eXvDBzDW0=";
+    sha256 = "sha256-9H8raJd6MyyFICY8WUZQGLJ4teKPJUiQfqbu1HWAVIw=";
    # The .tar.bz2 "Download" link is a binary blob, the source is the .tar.gz!
    url = "https://download.clipgrab.org/${pname}-${version}.tar.gz";
  };
--- a/pkgs/applications/video/corrscope/default.nix
+++ b/pkgs/applications/video/corrscope/default.nix
@ -11,6 +11,7 @@
 mkDerivationWith python3Packages.buildPythonApplication rec {
  pname = "corrscope";
  version = "0.7.1";
+  format = "pyproject";

  src = fetchFromGitHub {
    owner = "corrscope";
@ -19,8 +20,6 @@ mkDerivationWith python3Packages.buildPythonApplication rec {
    sha256 = "0c9kmrw6pcda68li04b5j2kmsgdw1q463qlc32wn96zn9hl82v6m";
  };

-  format = "pyproject";
-
  patches = [
    # Remove when bumping past 0.7.1
    (fetchpatch {
@ -30,11 +29,28 @@ mkDerivationWith python3Packages.buildPythonApplication rec {
    })
  ];

-  nativeBuildInputs = [ wrapQtAppsHook ] ++ (with python3Packages; [ poetry-core ]);
+  nativeBuildInputs = [
+    wrapQtAppsHook
+  ] ++ (with python3Packages; [
+    poetry-core
+  ]);

-  buildInputs = [ ffmpeg qtbase ];
+  buildInputs = [
+    ffmpeg
+    qtbase
+  ];

-  propagatedBuildInputs = with python3Packages; [ appdirs atomicwrites attrs click matplotlib numpy pyqt5 ruamel-yaml ];
+  propagatedBuildInputs = with python3Packages; [
+    appdirs
+    atomicwrites
+    attrs
+    click
+    matplotlib
+    numpy
+    packaging
+    pyqt5
+    ruamel-yaml
+  ];

  dontWrapQtApps = true;

--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, fetchpatch, python, zlib, pkg-config, glib
 , perl, pixman, vde2, alsa-lib, texinfo, flex
 , bison, lzo, snappy, libaio, libtasn1, gnutls, nettle, curl, ninja, meson, sigtool
-, makeWrapper, autoPatchelfHook, runtimeShell
+, makeWrapper, runtimeShell
 , attr, libcap, libcap_ng
 , CoreServices, Cocoa, Hypervisor, rez, setfile
 , numaSupport ? stdenv.isLinux && !stdenv.isAarch32, numactl
@ -53,7 +53,6 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ makeWrapper python python.pkgs.sphinx python.pkgs.sphinx_rtd_theme pkg-config flex bison meson ninja ]
    ++ lib.optionals gtkSupport [ wrapGAppsHook ]
-    ++ lib.optionals stdenv.isLinux [ autoPatchelfHook ]
    ++ lib.optionals stdenv.isDarwin [ sigtool ];

  buildInputs = [ zlib glib perl pixman
@ -85,6 +84,7 @@ stdenv.mkDerivation rec {
  dontUseMesonConfigure = true; # meson's configurePhase isn't compatible with qemu build

  outputs = [ "out" "ga" ];
+  separateDebugInfo = true;

  patches = [
    ./fix-qemu-ga.patch
@ -180,6 +180,7 @@ stdenv.mkDerivation rec {

  configureFlags = [
    "--audio-drv-list=${audio}"
+    "--disable-strip" # We'll strip ourselves after separating debug info.
    "--enable-docs"
    "--enable-tools"
    "--enable-guest-agent"
--- a/pkgs/applications/window-managers/i3/status.nix
+++ b/pkgs/applications/window-managers/i3/status.nix
@ -1,24 +1,17 @@
-{ fetchurl, lib, stdenv, libconfuse, yajl, alsa-lib, libpulseaudio, libnl, pkg-config, asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl }:
+{ fetchurl, lib, stdenv, libconfuse, yajl, alsa-lib, libpulseaudio, libnl, meson, ninja, perl, pkg-config, asciidoc, xmlto, docbook_xml_dtd_45, docbook_xsl }:

 stdenv.mkDerivation rec {
  pname = "i3status";
-  version = "2.13";
+  version = "2.14";

  src = fetchurl {
-    url = "https://i3wm.org/i3status/i3status-${version}.tar.bz2";
-    sha256 = "0rhlzb96mw64z2jnhwz9nibc7pxg549626lz5642xxk5hpzwk2ff";
+    url = "https://i3wm.org/i3status/i3status-${version}.tar.xz";
+    sha256 = "0929chhvyq9hg4scpcz8r9zn3s9jvbg6a86k3wqa77qg85rh4kaw";
  };

-  nativeBuildInputs = [ pkg-config asciidoc xmlto docbook_xml_dtd_45 docbook_xsl ];
+  nativeBuildInputs = [ meson ninja perl pkg-config asciidoc xmlto docbook_xml_dtd_45 docbook_xsl ];
  buildInputs = [ libconfuse yajl alsa-lib libpulseaudio libnl ];

-  makeFlags = [ "all" "PREFIX=$(out)" ];
-
-  # This hack is needed because for unknown reasons configure generates a broken makefile on the 2.13 release under nixos
-  preBuild = ''
-    sed -i -e 's/\$(TEST_LOGS) \$(TEST_LOGS/\$(TEST_LOGS)/g' Makefile
-  '';
-
  meta = {
    description = "Generates a status line for i3bar, dzen2, xmobar or lemonbar";
    homepage = "https://i3wm.org";
--- a/pkgs/build-support/pkg-config-wrapper/default.nix
+++ b/pkgs/build-support/pkg-config-wrapper/default.nix
@ -47,6 +47,9 @@ stdenv.mkDerivation {
  dontBuild = true;
  dontConfigure = true;

+  # Additional flags passed to pkg-config.
+  addFlags = lib.optional stdenv.targetPlatform.isStatic "--static";
+
  unpackPhase = ''
    src=$PWD
  '';
--- a/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
+++ b/pkgs/build-support/pkg-config-wrapper/pkg-config-wrapper.sh
@ -12,10 +12,12 @@ if [ -z "${NIX_PKG_CONFIG_WRAPPER_FLAGS_SET_@suffixSalt@:-}" ]; then
    source @out@/nix-support/add-flags.sh
 fi

+set -- "$@" @addFlags@
+
 if (( ${#role_suffixes[@]} > 0 )); then
    # replace env var with nix-modified one
    PKG_CONFIG_PATH=$PKG_CONFIG_PATH_@suffixSalt@ exec @prog@ "$@"
 else
-    # pkg-config isn't a bonafied dependency so ignore setup hook entirely
+    # pkg-config isn't a real dependency so ignore setup hook entirely
    exec @prog@ "$@"
 fi
--- a/pkgs/build-support/setup-hooks/separate-debug-info.sh
+++ b/pkgs/build-support/setup-hooks/separate-debug-info.sh
@ -28,10 +28,16 @@ _separateDebugInfo() {
        # Extract the debug info.
        header "separating debug info from $i (build ID $id)"
        mkdir -p "$dst/${id:0:2}"
-        $OBJCOPY --only-keep-debug "$i" "$dst/${id:0:2}/${id:2}.debug"
-        $STRIP --strip-debug "$i"

-        # Also a create a symlink <original-name>.debug.
-        ln -sfn ".build-id/${id:0:2}/${id:2}.debug" "$dst/../$(basename "$i")"
+        # This may fail, e.g. if the binary is for a different
+        # architecture than we're building for.  (This happens with
+        # firmware blobs in QEMU.)
+        (
+            $OBJCOPY --only-keep-debug "$i" "$dst/${id:0:2}/${id:2}.debug"
+            $STRIP --strip-debug "$i"
+
+            # Also a create a symlink <original-name>.debug.
+            ln -sfn ".build-id/${id:0:2}/${id:2}.debug" "$dst/../$(basename "$i")"
+        ) || rmdir -p "$dst/${id:0:2}"
    done < <(find "$prefix" -type f -print0)
 }
--- a/pkgs/data/documentation/stdman/default.nix
+++ b/pkgs/data/documentation/stdman/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "stdman";
-  version = "2020.11.17";
+  version = "2021.12.21";

  src = fetchFromGitHub {
    owner = "jeaye";
    repo = "stdman";
    rev = version;
-    sha256 = "sha256-pzAVuXSuUfwI7gQpFqmH/+klSUH3KipZup2TgZs8XsY=";
+    sha256 = "sha256-wOMQzC5w8aDmxNxQ5HK8jMgoow1wXBfHGUwFBw2WiPA=";
  };

  outputDevdoc = "out";
--- a/pkgs/data/fonts/noto-fonts/default.nix
+++ b/pkgs/data/fonts/noto-fonts/default.nix
@ -124,11 +124,6 @@ in
      sha256 = "1d6zzk0ii43iqfnjbldwp8sasyx99lbjp1nfgqjla7ixld6yp98l";
    };

-    makeFlags = [
-      # TODO(@sternenseemann): remove if afdko is new enough to know about Unicode 14.0
-      "BYPASS_SEQUENCE_CHECK=True"
-    ];
-
    nativeBuildInputs = [
      cairo
      imagemagick
--- a/pkgs/data/fonts/scheherazade/default.nix
+++ b/pkgs/data/fonts/scheherazade/default.nix
@ -1,10 +1,10 @@
-{ lib, fetchzip, version ? "3.200" }:
+{ lib, fetchzip, version ? "3.300" }:

 let
  new = lib.versionAtLeast version "3.000";
  sha256 = {
    "2.100" = "1g5f5f9gzamkq3kqyf7vbzvl4rdj3wmjf6chdrbxksrm3rnb926z";
-    "3.200" = "0qvmpsn6ja3g2hlvq0vb9pjsyk6ibna7s3w3n6q7lnhk0rhjg8bv";
+    "3.300" = "1bja1ma1mnna0qlk3dis31cvq5z1kgcqj7wjp8ml03zc5mpa2wb2";
  }."${version}";

 in fetchzip rec {
@ -16,8 +16,9 @@ in fetchzip rec {
    mkdir -p $out/share/{doc,fonts}
    unzip -l $downloadedFile
    unzip -j $downloadedFile \*.ttf                        -d $out/share/fonts/truetype
+    unzip    $downloadedFile \*/documentation/\*           -d $out/share/doc/
+    mv $out/share/doc/* $out/share/doc/${name}
    unzip -j $downloadedFile \*/FONTLOG.txt  \*/README.txt -d $out/share/doc/${name}
-    unzip -j $downloadedFile \*/documentation/\*           -d $out/share/doc/${name}/documentation
  '';

  inherit sha256;
@ -30,7 +31,7 @@ in fetchzip rec {
      Scheherazade${lib.optionalString new " New"}, named after the heroine of
      the classic Arabian Nights tale, is designed in a similar style to
      traditional typefaces such as Monotype Naskh, extended to cover the
-      Unicode Arabic repertoire through Unicode ${if new then "13.0" else "8.0"}.
+      Unicode Arabic repertoire through Unicode ${if new then "14.0" else "8.0"}.

      Scheherazade provides a “simplified” rendering of Arabic script, using
      basic connecting glyphs but not including a wide variety of additional
--- a/pkgs/data/icons/numix-icon-theme-circle/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-circle/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "numix-icon-theme-circle";
-  version = "21.11.29";
+  version = "21.12.05";

  src = fetchFromGitHub {
    owner = "numixproject";
    repo = pname;
    rev = version;
-    sha256 = "sha256-0hGxgmNNYvNT1QQpA7SdOdN1VM8Iix+kZZFcO2R1V/Y=";
+    sha256 = "sha256-tmrysmg4jVPurNJy3AqzAIjd1QCXoH2nGuJhRinvqVQ=";
  };

  nativeBuildInputs = [ gtk3 ];
--- a/pkgs/data/icons/numix-icon-theme-square/default.nix
+++ b/pkgs/data/icons/numix-icon-theme-square/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "numix-icon-theme-square";
-  version = "21.11.29";
+  version = "21.12.05";

  src = fetchFromGitHub {
    owner = "numixproject";
    repo = pname;
    rev = version;
-    sha256 = "sha256-3zZ/LpjYhYOHPpgRysGYXFLvYux5GgurItuYm7zAZ2M=";
+    sha256 = "sha256-SVWIY7RGwk2AKruDkAYoZ5nDSAU8LPb9dtqxDFumZ5o=";
  };

  nativeBuildInputs = [ gtk3 ];
--- a/pkgs/data/misc/iana-etc/default.nix
+++ b/pkgs/data/misc/iana-etc/default.nix
@ -1,12 +1,12 @@
 { lib, fetchzip, stdenvNoCC, writeText }:

 let
-  version = "20210225";
+  version = "20211124";
 in stdenvNoCC.mkDerivation {
  name = "iana-etc-${version}";
  src = fetchzip {
    url = "https://github.com/Mic92/iana-etc/releases/download/${version}/iana-etc-${version}.tar.gz";
-    sha256 = "sha256:1bbbnj2ya0apyyhnw37521yl1hrz3zy3l8dw6sacmir0y6pmx9gi";
+    sha256 = "sha256-4mM/ZeGd91e1AklGHFK5UB4llg9IgCo9DKcM0iXcBls=";
  };

  installPhase = ''
--- a/pkgs/development/compilers/dictu/default.nix
+++ b/pkgs/development/compilers/dictu/default.nix
@ -80,5 +80,6 @@ stdenv.mkDerivation rec {
    license = licenses.mit;
    maintainers = with maintainers; [ luc65r ];
    platforms = platforms.all;
+    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/staging-next/dictu.x86_64-darwin
  };
 }
--- a/pkgs/development/compilers/flutter/patches/move-cache.patch
+++ b/pkgs/development/compilers/flutter/patches/move-cache.patch
@ -20,7 +20,7 @@ index ed42baea29..fee2fb1d62 100644
         final Uri entryUri = _fileSystem.path.toUri(asset);
         result.add(_Asset(
 -          baseDir: _fileSystem.path.join(Cache.flutterRoot!, 'bin', 'cache', 'artifacts', 'material_fonts'),
-+          baseDir: _fileSystem.path.join(globals.fsUtils.homeDirPath!, 'bin', 'cache', 'artifacts', 'material_fonts'),
+          baseDir: _fileSystem.path.join(globals.fsUtils.homeDirPath!, '.cache', 'flutter', 'artifacts', 'material_fonts'),
           relativeUri: Uri(path: entryUri.pathSegments.last),
           entryUri: entryUri,
           package: null,
--- a/pkgs/development/compilers/gcc/9/default.nix
+++ b/pkgs/development/compilers/gcc/9/default.nix
@ -63,6 +63,11 @@ with lib;
 with builtins;

 let majorVersion = "9";
+    /*
+      If you update, please build on aarch64-linux
+      and check braces adjacent to `cplusplus` lines in file
+      ./result/lib/gcc/aarch64-unknown-linux-gnu/9.*.0/include/arm_acle.h
+    */
    version = "${majorVersion}.3.0";

    inherit (stdenv) buildPlatform hostPlatform targetPlatform;
--- a/pkgs/development/compilers/ghc/head.nix
+++ b/pkgs/development/compilers/ghc/head.nix
@ -12,9 +12,10 @@
  libffi ? null

  # Libdw.c only supports x86_64, i686 and s390x
-, enableDwarf ? stdenv.targetPlatform.isx86 &&
-                !stdenv.targetPlatform.isDarwin &&
-                !stdenv.targetPlatform.isWindows
+, enableDwarf ? (stdenv.targetPlatform.isx86 ||
+                 (stdenv.targetPlatform.isS390 && stdenv.targetPlatform.is64bit)) &&
+                lib.meta.availableOn stdenv.hostPlatform elfutils &&
+                lib.meta.availableOn stdenv.targetPlatform elfutils
 , elfutils # for DWARF support

 , useLLVM ? !(stdenv.targetPlatform.isx86
--- a/pkgs/development/compilers/go/1.16.nix
+++ b/pkgs/development/compilers/go/1.16.nix
@ -54,11 +54,11 @@ in

 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.16.10";
+  version = "1.16.12";

  src = fetchurl {
    url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "sha256-qQVHIBFYXkA9ANKkHefO0puIhDCdc0gqMH9on9DzILU=";
+    sha256 = "sha256-Kv2Dnct20rsILFAsAaClzb/An9YwdXg1NjxP3o4vv+g=";
  };

  # perl is used for testing go vet
--- a/pkgs/development/compilers/gwt/2.4.0.nix
+++ b/pkgs/development/compilers/gwt/2.4.0.nix
@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, unzip }:

-stdenv.mkDerivation {
-  name = "gwt-java-2.4.0";
+stdenv.mkDerivation rec {
+  pname = "gwt-java";
+  version = "2.4.0";

  src = fetchurl {
-    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/google-web-toolkit/gwt-2.4.0.zip";
+    url = "https://storage.googleapis.com/google-code-archive-downloads/v2/code.google.com/google-web-toolkit/gwt-${version}.zip";
    sha256 = "1gvyg00vx7fdqgfl2w7nhql78clg3abs6fxxy7m03pprdm5qmm17";
  };

--- a/pkgs/development/compilers/koka/default.nix
+++ b/pkgs/development/compilers/koka/default.nix
@ -4,12 +4,12 @@
 , parsec, process, regex-compat, text, time }:

 let
-  version = "2.3.2";
+  version = "2.3.6";
  src = fetchFromGitHub {
    owner = "koka-lang";
    repo = "koka";
    rev = "v${version}";
-    sha256 = "sha256-+w99Jvsd1tccUUYaP2TRgCNyGnMINWamuNRumHGzFWA=";
+    sha256 = "sha256-AibS/HudJKFQZlTxGD5LfwjBawIy1xwO2Hm8qzAUP2M=";
    fetchSubmodules = true;
  };
  kklib = stdenv.mkDerivation {
--- a/pkgs/development/compilers/llvm/10/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/10/libcxx/default.nix
@ -21,6 +21,12 @@ stdenv.mkDerivation {
    ../../libcxx-0001-musl-hacks.patch
  ];

+  # Prevent errors like "error: 'foo' is unavailable: introduced in macOS yy.zz"
+  postPatch = ''
+    substituteInPlace include/__config \
+      --replace "#    define _LIBCPP_USE_AVAILABILITY_APPLE" ""
+  '';
+
  preConfigure = ''
    # Get headers from the cxxabi source so we can see private headers not installed by the cxxabi package
    cmakeFlagsArray=($cmakeFlagsArray -DLIBCXX_CXX_ABI_INCLUDE_PATHS="$LIBCXXABI_INCLUDE_DIR")
--- a/pkgs/development/compilers/llvm/11/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/11/libcxx/default.nix
@ -29,6 +29,12 @@ stdenv.mkDerivation {
    ../../libcxx-0001-musl-hacks.patch
  ];

+  # Prevent errors like "error: 'foo' is unavailable: introduced in macOS yy.zz"
+  postPatch = ''
+    substituteInPlace include/__config \
+      --replace "#    define _LIBCPP_USE_AVAILABILITY_APPLE" ""
+  '';
+
  preConfigure = lib.optionalString stdenv.hostPlatform.isMusl ''
    patchShebangs utils/cat_files.py
  '';
--- a/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/11/libcxxabi/default.nix
@ -1,5 +1,7 @@
 { lib, stdenv, llvm_meta, cmake, fetch, libcxx, libunwind, llvm, version
 , enableShared ? !stdenv.hostPlatform.isStatic
+, standalone ? stdenv.hostPlatform.useLLVM or false
+, withLibunwind ? !stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm
 }:

 stdenv.mkDerivation {
@ -29,10 +31,11 @@ stdenv.mkDerivation {
  ];

  nativeBuildInputs = [ cmake ];
-  buildInputs = lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm) libunwind;
+  buildInputs = lib.optional withLibunwind libunwind;

-  cmakeFlags = lib.optionals (stdenv.hostPlatform.useLLVM or false) [
+  cmakeFlags = lib.optionals standalone [
    "-DLLVM_ENABLE_LIBCXX=ON"
+  ] ++ lib.optionals (standalone && withLibunwind) [
    "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"
  ] ++ lib.optionals stdenv.hostPlatform.isWasm [
    "-DLIBCXXABI_ENABLE_THREADS=OFF"
--- a/pkgs/development/compilers/llvm/12/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/12/libcxx/default.nix
@ -23,6 +23,12 @@ stdenv.mkDerivation {
    ../../libcxx-0001-musl-hacks.patch
  ];

+  # Prevent errors like "error: 'foo' is unavailable: introduced in macOS yy.zz"
+  postPatch = ''
+    substituteInPlace include/__config \
+      --replace "#    define _LIBCPP_USE_AVAILABILITY_APPLE" ""
+  '';
+
  preConfigure = lib.optionalString stdenv.hostPlatform.isMusl ''
    patchShebangs utils/cat_files.py
  '';
--- a/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/12/libcxxabi/default.nix
@ -1,5 +1,7 @@
 { lib, stdenv, llvm_meta, cmake, python3, fetch, libcxx, libunwind, llvm, version
 , enableShared ? !stdenv.hostPlatform.isStatic
+, standalone ? stdenv.hostPlatform.useLLVM or false
+, withLibunwind ? !stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm
 }:

 stdenv.mkDerivation {
@ -28,9 +30,9 @@ stdenv.mkDerivation {
  ];

  nativeBuildInputs = [ cmake python3 ];
-  buildInputs = lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm) libunwind;
+  buildInputs = lib.optional withLibunwind libunwind;

-  cmakeFlags = lib.optionals (stdenv.hostPlatform.useLLVM or false) [
+  cmakeFlags = lib.optionals standalone [
    "-DLLVM_ENABLE_LIBCXX=ON"
    "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"
  ] ++ lib.optionals stdenv.hostPlatform.isWasm [
@ -47,7 +49,7 @@ stdenv.mkDerivation {
        # the magic combination of necessary CMake variables
        # if you fancy a try, take a look at
        # https://gitlab.kitware.com/cmake/community/-/wikis/doc/cmake/RPATH-handling
-        install_name_tool -id $out/$file $file
+        ${stdenv.cc.targetPrefix}install_name_tool -id $out/$file $file
      done
      make install
      install -d 755 $out/include
--- a/pkgs/development/compilers/llvm/13/clang/default.nix
+++ b/pkgs/development/compilers/llvm/13/clang/default.nix
@ -37,6 +37,11 @@ let
      ./purity.patch
      # https://reviews.llvm.org/D51899
      ./gnu-install-dirs.patch
+      # Revert of https://reviews.llvm.org/D100879
+      # The malloc alignment assumption is incorrect for jemalloc and causes
+      # mis-compilation in firefox.
+      # See: https://bugzilla.mozilla.org/show_bug.cgi?id=1741454
+      ./revert-malloc-alignment-assumption.patch
      (substituteAll {
        src = ../../clang-11-12-LLVMgold-path.patch;
        libllvmLibdir = "${libllvm.lib}/lib";
--- a/pkgs/development/compilers/llvm/13/clang/revert-malloc-alignment-assumption.patch
+++ b/pkgs/development/compilers/llvm/13/clang/revert-malloc-alignment-assumption.patch
@ -0,0 +1,78 @@
+--- b/include/clang/Basic/TargetInfo.h
+++ a/include/clang/Basic/TargetInfo.h
+@@ -612,8 +612,8 @@
+   }
+ 
+   /// Return the largest alignment for which a suitably-sized allocation with
+  /// '::operator new(size_t)' is guaranteed to produce a correctly-aligned
+  /// pointer.
+-  /// '::operator new(size_t)' or 'malloc' is guaranteed to produce a
+-  /// correctly-aligned pointer.
+   unsigned getNewAlign() const {
+     return NewAlign ? NewAlign : std::max(LongDoubleAlign, LongLongAlign);
+   }
+--- b/lib/CodeGen/CGCall.cpp
+++ a/lib/CodeGen/CGCall.cpp
+@@ -2048,24 +2048,6 @@
+       // allows it to work on indirect virtual function calls.
+       if (AttrOnCallSite && TargetDecl->hasAttr<NoMergeAttr>())
+         FuncAttrs.addAttribute(llvm::Attribute::NoMerge);
+-
+-      // Add known guaranteed alignment for allocation functions.
+-      if (unsigned BuiltinID = Fn->getBuiltinID()) {
+-        switch (BuiltinID) {
+-        case Builtin::BIaligned_alloc:
+-        case Builtin::BIcalloc:
+-        case Builtin::BImalloc:
+-        case Builtin::BImemalign:
+-        case Builtin::BIrealloc:
+-        case Builtin::BIstrdup:
+-        case Builtin::BIstrndup:
+-          RetAttrs.addAlignmentAttr(Context.getTargetInfo().getNewAlign() /
+-                                    Context.getTargetInfo().getCharWidth());
+-          break;
+-        default:
+-          break;
+-        }
+-      }
+     }
+ 
+     // 'const', 'pure' and 'noalias' attributed functions are also nounwind.
+--- b/test/CodeGen/alloc-fns-alignment.c
+++ /dev/null
+@@ -1,35 +0,0 @@
+-// RUN: %clang_cc1 -triple x86_64-unknown-linux-gnu -emit-llvm < %s | FileCheck %s --check-prefix=ALIGN16
+-// RUN: %clang_cc1 -triple x86_64-windows-msvc      -emit-llvm < %s | FileCheck %s --check-prefix=ALIGN16
+-// RUN: %clang_cc1 -triple i386-apple-darwin        -emit-llvm < %s | FileCheck %s --check-prefix=ALIGN16
+-// RUN: %clang_cc1 -triple i386-unknown-linux-gnu   -emit-llvm < %s | FileCheck %s --check-prefix=ALIGN8
+-// RUN: %clang_cc1 -triple x86_64-unknown-linux-gnu -fno-builtin-malloc  -emit-llvm < %s  | FileCheck %s --check-prefix=NOBUILTIN-MALLOC
+-// RUN: %clang_cc1 -triple x86_64-unknown-linux-gnu -fno-builtin-calloc  -emit-llvm < %s  | FileCheck %s --check-prefix=NOBUILTIN-CALLOC
+-// RUN: %clang_cc1 -triple x86_64-unknown-linux-gnu -fno-builtin-realloc -emit-llvm < %s  | FileCheck %s --check-prefix=NOBUILTIN-REALLOC
+-
+-typedef __SIZE_TYPE__ size_t;
+-
+-void *malloc(size_t);
+-void *calloc(size_t, size_t);
+-void *realloc(void *, size_t);
+-
+-void *malloc_test(size_t n) {
+-  return malloc(n);
+-}
+-
+-void *calloc_test(size_t n) {
+-  return calloc(1, n);
+-}
+-
+-void *raalloc_test(void *p, size_t n) {
+-  return realloc(p, n);
+-}
+-
+-// ALIGN16: align 16 i8* @malloc
+-// ALIGN16: align 16 i8* @calloc
+-// ALIGN16: align 16 i8* @realloc
+-// ALIGN8: align 8 i8* @malloc
+-// ALIGN8: align 8 i8* @calloc
+-// ALIGN8: align 8 i8* @realloc
+-// NOBUILTIN-MALLOC: declare i8* @malloc
+-// NOBUILTIN-CALLOC: declare i8* @calloc
+-// NOBUILTIN-REALLOC: declare i8* @realloc
--- a/pkgs/development/compilers/llvm/13/default.nix
+++ b/pkgs/development/compilers/llvm/13/default.nix
@ -252,11 +252,18 @@ let
               );
    };

-    libcxxabi = callPackage ./libcxxabi {
-      inherit llvm_meta;
-      stdenv = if stdenv.hostPlatform.useLLVM or false
+    libcxxabi = let
+      stdenv_ = if stdenv.hostPlatform.useLLVM or false
               then overrideCC stdenv buildLlvmTools.clangNoLibcxx
               else stdenv;
+      cxx-headers = callPackage ./libcxx {
+        inherit llvm_meta;
+        stdenv = stdenv_;
+        headersOnly = true;
+      };
+    in callPackage ./libcxxabi {
+      stdenv = stdenv_;
+      inherit llvm_meta cxx-headers;
    };

    libunwind = callPackage ./libunwind {
--- a/pkgs/development/compilers/llvm/13/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/13/libcxx/default.nix
@ -1,15 +1,23 @@
 { lib, stdenv, llvm_meta, src, cmake, python3, fixDarwinDylibNames, version
+, libcxxabi
 , enableShared ? !stdenv.hostPlatform.isStatic
+
+# If headersOnly is true, the resulting package would only include the headers.
+# Use this to break the circular dependency between libcxx and libcxxabi.
+#
+# Some context:
+# https://reviews.llvm.org/rG1687f2bbe2e2aaa092f942d4a97d41fad43eedfb
+, headersOnly ? false
 }:

 stdenv.mkDerivation rec {
-  pname = "libcxx";
+  pname = if headersOnly then "cxx-headers" else "libcxx";
  inherit version;

  inherit src;
-  sourceRoot = "source/${pname}";
+  sourceRoot = "source/libcxx";

-  outputs = [ "out" "dev" ];
+  outputs = [ "out" ] ++ lib.optional (!headersOnly) "dev";

  patches = [
    ./gnu-install-dirs.patch
@ -17,6 +25,12 @@ stdenv.mkDerivation rec {
    ../../libcxx-0001-musl-hacks.patch
  ];

+  # Prevent errors like "error: 'foo' is unavailable: introduced in macOS yy.zz"
+  postPatch = ''
+    substituteInPlace include/__config \
+      --replace "#    define _LIBCPP_USE_AVAILABILITY_APPLE" ""
+  '';
+
  preConfigure = lib.optionalString stdenv.hostPlatform.isMusl ''
    patchShebangs utils/cat_files.py
  '';
@ -24,15 +38,29 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ cmake python3 ]
    ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;

-  cmakeFlags = [
-  ] ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
+  buildInputs = lib.optionals (!headersOnly) [ libcxxabi ];
+
+  cmakeFlags = [ "-DLIBCXX_CXX_ABI=libcxxabi" ]
+    ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
    ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
-    ++ lib.optional stdenv.hostPlatform.isWasm [
+    ++ lib.optionals stdenv.hostPlatform.isWasm [
      "-DLIBCXX_ENABLE_THREADS=OFF"
      "-DLIBCXX_ENABLE_FILESYSTEM=OFF"
      "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
    ] ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF";

+  buildFlags = lib.optional headersOnly "generate-cxx-headers";
+  installTargets = lib.optional headersOnly "install-cxx-headers";
+
+  # At this point, cxxabi headers would be installed in the dev output, which
+  # prevents moveToOutput from doing its job later in the build process.
+  postInstall = lib.optionalString (!headersOnly) ''
+    mv "$dev/include/c++/v1/"* "$out/include/c++/v1/"
+    pushd "$dev"
+    rmdir -p include/c++/v1
+    popd
+  '';
+
  passthru = {
    isLLVM = true;
  };
@ -45,9 +73,6 @@ stdenv.mkDerivation rec {
      C++14 and above.
    '';

-    # https://github.com/NixOS/nixpkgs/pull/133217#issuecomment-895742807
-    broken = stdenv.isDarwin;
-
    # "All of the code in libc++ is dual licensed under the MIT license and the
    # UIUC License (a BSD-like license)":
    license = with lib.licenses; [ mit ncsa ];
--- a/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/13/libcxxabi/default.nix
@ -1,6 +1,7 @@
-{ lib, stdenv, llvm_meta, cmake, python3, src, libunwind, version
+{ lib, stdenv, llvm_meta, cmake, python3, src, cxx-headers, libunwind, version
 , enableShared ? !stdenv.hostPlatform.isStatic
-, libcxx
+, standalone ? stdenv.hostPlatform.useLLVM or false
+, withLibunwind ? !stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm
 }:

 stdenv.mkDerivation rec {
@ -23,12 +24,13 @@ stdenv.mkDerivation rec {
  ];

  nativeBuildInputs = [ cmake python3 ];
-  buildInputs = lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm) libunwind;
+  buildInputs = lib.optional withLibunwind libunwind;

  cmakeFlags = [
-    "-DLIBCXXABI_LIBCXX_INCLUDES=${libcxx.dev}/include/c++/v1"
-  ] ++ lib.optionals (stdenv.hostPlatform.useLLVM or false) [
+    "-DLIBCXXABI_LIBCXX_INCLUDES=${cxx-headers}/include/c++/v1"
+  ] ++ lib.optionals standalone [
    "-DLLVM_ENABLE_LIBCXX=ON"
+  ] ++ lib.optionals (standalone && withLibunwind) [
    "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"
  ] ++ lib.optionals stdenv.hostPlatform.isWasm [
    "-DLIBCXXABI_ENABLE_THREADS=OFF"
--- a/pkgs/development/compilers/llvm/6/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/6/libcxx/default.nix
@ -19,6 +19,12 @@ stdenv.mkDerivation {
    ../../libcxx-0001-musl-hacks.patch
  ];

+  # Prevent errors like "error: 'foo' is unavailable: introduced in macOS yy.zz"
+  postPatch = ''
+    substituteInPlace include/__config \
+      --replace "#define _LIBCPP_USE_AVAILABILITY_APPLE" ""
+  '';
+
  prePatch = ''
    substituteInPlace lib/CMakeLists.txt --replace "/usr/lib/libc++" "\''${LIBCXX_LIBCXXABI_LIB_PATH}/libc++"
  '';
--- a/pkgs/development/compilers/llvm/7/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/7/libcxx/default.nix
@ -21,6 +21,12 @@ stdenv.mkDerivation {
    ../../libcxx-0001-musl-hacks.patch
  ];

+  # Prevent errors like "error: 'foo' is unavailable: introduced in macOS yy.zz"
+  postPatch = ''
+    substituteInPlace include/__config \
+      --replace "#    define _LIBCPP_USE_AVAILABILITY_APPLE" ""
+  '';
+
  prePatch = ''
    substituteInPlace lib/CMakeLists.txt --replace "/usr/lib/libc++" "\''${LIBCXX_LIBCXXABI_LIB_PATH}/libc++"
  '';
--- a/pkgs/development/compilers/llvm/8/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/8/libcxx/default.nix
@ -21,6 +21,12 @@ stdenv.mkDerivation {
    ../../libcxx-0001-musl-hacks.patch
  ];

+  # Prevent errors like "error: 'foo' is unavailable: introduced in macOS yy.zz"
+  postPatch = ''
+    substituteInPlace include/__config \
+      --replace "#    define _LIBCPP_USE_AVAILABILITY_APPLE" ""
+  '';
+
  prePatch = ''
    substituteInPlace lib/CMakeLists.txt --replace "/usr/lib/libc++" "\''${LIBCXX_LIBCXXABI_LIB_PATH}/libc++"
  '';
--- a/pkgs/development/compilers/llvm/9/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/9/libcxx/default.nix
@ -21,6 +21,12 @@ stdenv.mkDerivation {
    ../../libcxx-0001-musl-hacks.patch
  ];

+  # Prevent errors like "error: 'foo' is unavailable: introduced in macOS yy.zz"
+  postPatch = ''
+    substituteInPlace include/__config \
+      --replace "#    define _LIBCPP_USE_AVAILABILITY_APPLE" ""
+  '';
+
  preConfigure = ''
    # Get headers from the cxxabi source so we can see private headers not installed by the cxxabi package
    cmakeFlagsArray=($cmakeFlagsArray -DLIBCXX_CXX_ABI_INCLUDE_PATHS="$LIBCXXABI_INCLUDE_DIR")
--- a/pkgs/development/compilers/llvm/git/default.nix
+++ b/pkgs/development/compilers/llvm/git/default.nix
@ -247,11 +247,18 @@ let
               else stdenv;
    };

-    libcxxabi = callPackage ./libcxxabi {
-      inherit llvm_meta;
-      stdenv = if stdenv.hostPlatform.useLLVM or false
+    libcxxabi = let
+      stdenv_ = if stdenv.hostPlatform.useLLVM or false
               then overrideCC stdenv buildLlvmTools.clangNoLibcxx
               else stdenv;
+      cxx-headers = callPackage ./libcxx {
+        inherit llvm_meta;
+        stdenv = stdenv_;
+        headersOnly = true;
+      };
+    in callPackage ./libcxxabi {
+      stdenv = stdenv_;
+      inherit llvm_meta cxx-headers;
    };

    libunwind = callPackage ./libunwind {
--- a/pkgs/development/compilers/llvm/git/libcxx/default.nix
+++ b/pkgs/development/compilers/llvm/git/libcxx/default.nix
@ -1,15 +1,23 @@
 { lib, stdenv, llvm_meta, src, cmake, python3, fixDarwinDylibNames, version
+, libcxxabi
 , enableShared ? !stdenv.hostPlatform.isStatic
+
+# If headersOnly is true, the resulting package would only include the headers.
+# Use this to break the circular dependency between libcxx and libcxxabi.
+#
+# Some context:
+# https://reviews.llvm.org/rG1687f2bbe2e2aaa092f942d4a97d41fad43eedfb
+, headersOnly ? false
 }:

 stdenv.mkDerivation rec {
-  pname = "libcxx";
+  pname = if headersOnly then "cxx-headers" else "libcxx";
  inherit version;

  inherit src;
-  sourceRoot = "source/${pname}";
+  sourceRoot = "source/libcxx";

-  outputs = [ "out" "dev" ];
+  outputs = [ "out" ] ++ lib.optional (!headersOnly) "dev";

  patches = [
    ./gnu-install-dirs.patch
@ -17,6 +25,12 @@ stdenv.mkDerivation rec {
    ../../libcxx-0001-musl-hacks.patch
  ];

+  # Prevent errors like "error: 'foo' is unavailable: introduced in macOS yy.zz"
+  postPatch = ''
+    substituteInPlace include/__config \
+      --replace "#    define _LIBCPP_USE_AVAILABILITY_APPLE" ""
+  '';
+
  preConfigure = lib.optionalString stdenv.hostPlatform.isMusl ''
    patchShebangs utils/cat_files.py
  '';
@ -24,15 +38,29 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ cmake python3 ]
    ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;

-  cmakeFlags = [
-  ] ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
+  buildInputs = lib.optionals (!headersOnly) [ libcxxabi ];
+
+  cmakeFlags = [ "-DLIBCXX_CXX_ABI=libcxxabi" ]
+    ++ lib.optional (stdenv.hostPlatform.isMusl || stdenv.hostPlatform.isWasi) "-DLIBCXX_HAS_MUSL_LIBC=1"
    ++ lib.optional (stdenv.hostPlatform.useLLVM or false) "-DLIBCXX_USE_COMPILER_RT=ON"
-    ++ lib.optional stdenv.hostPlatform.isWasm [
+    ++ lib.optionals stdenv.hostPlatform.isWasm [
      "-DLIBCXX_ENABLE_THREADS=OFF"
      "-DLIBCXX_ENABLE_FILESYSTEM=OFF"
      "-DLIBCXX_ENABLE_EXCEPTIONS=OFF"
    ] ++ lib.optional (!enableShared) "-DLIBCXX_ENABLE_SHARED=OFF";

+  buildFlags = lib.optional headersOnly "generate-cxx-headers";
+  installTargets = lib.optional headersOnly "install-cxx-headers";
+
+  # At this point, cxxabi headers would be installed in the dev output, which
+  # prevents moveToOutput from doing its job later in the build process.
+  postInstall = lib.optionalString (!headersOnly) ''
+    mv "$dev/include/c++/v1/"* "$out/include/c++/v1/"
+    pushd "$dev"
+    rmdir -p include/c++/v1
+    popd
+  '';
+
  passthru = {
    isLLVM = true;
  };
--- a/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
+++ b/pkgs/development/compilers/llvm/git/libcxxabi/default.nix
@ -1,6 +1,5 @@
-{ lib, stdenv, llvm_meta, cmake, python3, src, libunwind, version
+{ lib, stdenv, llvm_meta, cmake, python3, src, cxx-headers, libunwind, version
 , enableShared ? !stdenv.hostPlatform.isStatic
-, libcxx
 }:

 stdenv.mkDerivation rec {
@ -26,7 +25,7 @@ stdenv.mkDerivation rec {
  buildInputs = lib.optional (!stdenv.isDarwin && !stdenv.isFreeBSD && !stdenv.hostPlatform.isWasm) libunwind;

  cmakeFlags = [
-    "-DLIBCXXABI_LIBCXX_INCLUDES=${libcxx.dev}/include/c++/v1"
+    "-DLIBCXXABI_LIBCXX_INCLUDES=${cxx-headers}/include/c++/v1"
  ] ++ lib.optionals (stdenv.hostPlatform.useLLVM or false) [
    "-DLLVM_ENABLE_LIBCXX=ON"
    "-DLIBCXXABI_USE_LLVM_UNWINDER=ON"
--- a/pkgs/development/compilers/mozart/default.nix
+++ b/pkgs/development/compilers/mozart/default.nix
@ -4,7 +4,8 @@
 , cmake
 , unzip
 , makeWrapper
-, boost
+, boost169
+, pinnedBoost ? boost169
 , llvmPackages
 , llvmPackages_5
 , gmp
@ -67,7 +68,7 @@ in stdenv.mkDerivation rec {
  '';

  buildInputs = [
-    boost
+    pinnedBoost
    llvmPackages_5.llvm
    llvmPackages_5.clang
    llvmPackages_5.clang-unwrapped
--- a/pkgs/development/compilers/opendylan/bin.nix
+++ b/pkgs/development/compilers/opendylan/bin.nix
@ -2,15 +2,16 @@
 # The binaries can also be used as is.
 {lib, stdenv, fetchurl, patchelf, boehmgc, gnused, gcc, makeWrapper}:

-stdenv.mkDerivation {
-  name = "opendylan-2013.2";
+stdenv.mkDerivation rec {
+  pname = "opendylan";
+  version = "2013.2";

  src = if stdenv.hostPlatform.system == "x86_64-linux" then fetchurl {
-      url = "https://opendylan.org/downloads/opendylan/2013.2/opendylan-2013.2-x86_64-linux.tar.bz2";
+      url = "https://opendylan.org/downloads/opendylan/${version}/opendylan-${version}-x86_64-linux.tar.bz2";
      sha256 = "035brbw3hm7zrs593q4zc42yglj1gmmkw3b1r7zzlw3ks4i2lg7h";
    }
    else if stdenv.hostPlatform.system == "i686-linux" then fetchurl {
-      url = "https://opendylan.org/downloads/opendylan/2013.2/opendylan-2013.2-x86-linux.tar.bz2";
+      url = "https://opendylan.org/downloads/opendylan/${version}/opendylan-${version}-x86-linux.tar.bz2";
      sha256 = "0c61ihvblcsjrw6ncr8x8ylhskcrqs8pajs4mg5di36cvqw12nq5";
    }
    else throw "platform ${stdenv.hostPlatform.system} not supported.";
--- a/pkgs/development/compilers/rust/1_57.nix
+++ b/pkgs/development/compilers/rust/1_57.nix
@ -20,8 +20,8 @@
 } @ args:

 import ./default.nix {
-  rustcVersion = "1.56.1";
-  rustcSha256 = "04cmqx7nn63hzz7z27b2b0dj2qx18rck9ifvip43s6dampx8v2f3";
+  rustcVersion = "1.57.0";
+  rustcSha256 = "06jw8ka2p3kls8p0gd4p0chhhb1ia1mlvj96zn78n7qvp71zjiim";

  llvmSharedForBuild = pkgsBuildBuild.llvmPackages_13.libllvm.override { enableSharedLibraries = true; };
  llvmSharedForHost = pkgsBuildHost.llvmPackages_13.libllvm.override { enableSharedLibraries = true; };
@ -37,24 +37,24 @@ import ./default.nix {

  # Note: the version MUST be one version prior to the version we're
  # building
-  bootstrapVersion = "1.55.0";
+  bootstrapVersion = "1.56.1";

  # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
  bootstrapHashes = {
-    i686-unknown-linux-gnu = "6e42b6c44d2eb4170f4144423fa3c33338d8d5c3ea00b03bbac200c877bc9e98";
-    x86_64-unknown-linux-gnu = "2080253a2ec36ac8ed6e060d30802d888533124b8d16545cfd4af898b365eaac";
-    x86_64-unknown-linux-musl = "f24f68587253c4bfbe59d3d10fe4897068d9130538de6b2d02097a25718030c2";
-    arm-unknown-linux-gnueabihf = "483444153d35cda51c6aec2c24bc4c97fa4fd30b28df4b60bf9763bd6e06da3a";
-    armv7-unknown-linux-gnueabihf = "8c72f0eb75b10db970fb546c3b41f5e97df294d5dbbf0b8fa96e17f2b281ee9c";
-    aarch64-unknown-linux-gnu = "eebdb2e659ed14884a49f0457d44e5e8c9f89fca3414533752c6dbb96232c156";
-    aarch64-unknown-linux-musl = "2ce36a7d34f1f2aa43b4cbc0b437d96eefb45743828bf9ae699ff581ae257f28";
-    x86_64-apple-darwin = "2e345ac7724c192c9487a2c6bd4f6c52c884d791981510288830d27d9a0bf2f3";
-    aarch64-apple-darwin = "70c71d30d0de76912fcd88d503a6cb4323cfe6250c1a255be7e0d4e644b3d40a";
-    powerpc64le-unknown-linux-gnu = "12bf6447d338cbe2b55539b84e6369b17e7eefe938d1ba7e3dd69781c9cc9812";
-    riscv64gc-unknown-linux-gnu = "effceb45346fef3b0b54b357336e6f374f788b803bb1bee4084f25eace8907f3";
+    i686-unknown-linux-gnu = "84db34603ce22d93312ff8bccd5580fe112e932bbeb0361e7cc37668a9803a27";
+    x86_64-unknown-linux-gnu = "a6be5d045183a0b12dddf0d81633e2a64e63e4c2dfa44eb7593970c1ef93a98f";
+    x86_64-unknown-linux-musl = "3c09058d104d9a88943fb343af1fb70422f9c4a987e6703666ee8a8051211190";
+    arm-unknown-linux-gnueabihf = "c445706d109bb74de4c889687ae08a48af5808676fda15b84b7ef5970a82a5f6";
+    armv7-unknown-linux-gnueabihf = "29ec65af502370c0c1a49faecd7131f1243fe3005b419ead4b40b267af2b2db0";
+    aarch64-unknown-linux-gnu = "69792887357c8dd78c5424f0b4a624578296796d99edf6c30ebe2acc2b939aa3";
+    aarch64-unknown-linux-musl = "971d13d41657e50e3ac54f17f52b4198c3d8bc25ec489a6a9e6d12c18226dda5";
+    x86_64-apple-darwin = "8d65ef02a123c23be00101fb204d28b60498b9145dd2ee8edabf0afde6e01e55";
+    aarch64-apple-darwin = "e71c14c1368048a22e4d1851f301872ac2e6f4c574f04d2a7ae4d64b0e7c7235";
+    powerpc64le-unknown-linux-gnu = "fa78b28fe1ef3cd4add9ec151e5eab756dfc83c8bc3e5a576a6eddd350c4de7a";
+    riscv64gc-unknown-linux-gnu = "5ec327d1bd3ba8d00afbe9be4a1f0fb8ab845063fcf9be479be9493c52a4dbb6";
  };

-  selectRustPackage = pkgs: pkgs.rust_1_56;
+  selectRustPackage = pkgs: pkgs.rust_1_57;

  rustcPatches = [
  ];
--- a/pkgs/development/compilers/vala/default.nix
+++ b/pkgs/development/compilers/vala/default.nix
@ -114,8 +114,8 @@ in rec {
  };

  vala_0_54 = generic {
-    version = "0.54.2";
-    sha256 = "iE3nRTF9TVbk6M7emT3I8E1Qz8o2z2DS8vJ4wwwrExE=";
+    version = "0.54.3";
+    sha256 = "7R1f5MvAzShF0N5PH/77Fa+waJLSMMfMppV4FnLo+2A=";
  };

  vala = vala_0_54;
--- a/pkgs/development/haskell-modules/lib/compose.nix
+++ b/pkgs/development/haskell-modules/lib/compose.nix
@ -288,7 +288,11 @@ rec {
    enableLibraryProfiling = false;
    isLibrary = false;
    doHaddock = false;
-    postFixup = "rm -rf $out/lib $out/nix-support $out/share/doc";
+    postFixup = drv.postFixup or "" + ''
+
+      # Remove every directory which could have links to other store paths.
+      rm -rf $out/lib $out/nix-support $out/share/doc
+    '';
  });

  /* Build a source distribution tarball instead of using the source files
--- a/pkgs/development/interpreters/dzaima-apl/default.nix
+++ b/pkgs/development/interpreters/dzaima-apl/default.nix
@ -64,6 +64,7 @@ stdenv.mkDerivation rec {
    license = licenses.mit;
    maintainers = with maintainers; [ AndersonTorres ];
    inherit (jdk.meta) platforms;
+    broken = stdenv.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/staging-next/dapl-native.x86_64-darwin
  };
 }
 # TODO: Processing app
--- a/pkgs/development/interpreters/love/0.7.nix
+++ b/pkgs/development/interpreters/love/0.7.nix
@ -6,9 +6,11 @@
 }:

 stdenv.mkDerivation rec {
-  name = "love-0.7.2";
+  pname = "love";
+  version = "0.7.2";
+
  src = fetchurl {
-    url = "https://bitbucket.org/rude/love/downloads/${name}-linux-src.tar.gz";
+    url = "https://bitbucket.org/rude/love/downloads/love-${version}-linux-src.tar.gz";
    sha256 = "0s7jywkvydlshlgy11ilzngrnybmq5xlgzp2v2dhlffwrfqdqym5";
  };

--- a/pkgs/development/interpreters/love/0.9.nix
+++ b/pkgs/development/interpreters/love/0.9.nix
@ -5,9 +5,11 @@
 }:

 stdenv.mkDerivation rec {
-  name = "love-0.9.1";
+  pname = "love";
+  version = "0.9.1";
+
  src = fetchurl {
-    url = "https://bitbucket.org/rude/love/downloads/${name}-linux-src.tar.gz";
+    url = "https://bitbucket.org/rude/love/downloads/love-${version}-linux-src.tar.gz";
    sha256 = "1pikd0bzb44r4bf0jbgn78whz1yswpq1n5jc8nf87v42pm30kp84";
  };

--- a/pkgs/development/interpreters/python/cpython/3.11/no-ldconfig.patch
+++ b/pkgs/development/interpreters/python/cpython/3.11/no-ldconfig.patch
@ -0,0 +1,107 @@
+From 5330b6af9f832af59aa5c61d9ef6971053a8e709 Mon Sep 17 00:00:00 2001
+From: Jonathan Ringer <jonringer117@gmail.com>
+Date: Mon, 9 Nov 2020 10:24:35 -0800
+Subject: [PATCH] CPython: Don't use ldconfig
+
+---
+ Lib/ctypes/util.py | 77 ++--------------------------------------------
+ 1 file changed, 2 insertions(+), 75 deletions(-)
+
+diff --git a/Lib/ctypes/util.py b/Lib/ctypes/util.py
+index 0c2510e161..7fb98af308 100644
+--- a/Lib/ctypes/util.py
+++ b/Lib/ctypes/util.py
+@@ -100,53 +100,7 @@ def _is_elf(filename):
+             return thefile.read(4) == elf_header
+ 
+     def _findLib_gcc(name):
+-        # Run GCC's linker with the -t (aka --trace) option and examine the
+-        # library name it prints out. The GCC command will fail because we
+-        # haven't supplied a proper program with main(), but that does not
+-        # matter.
+-        expr = os.fsencode(r'[^\(\)\s]*lib%s\.[^\(\)\s]*' % re.escape(name))
+-
+-        c_compiler = shutil.which('gcc')
+-        if not c_compiler:
+-            c_compiler = shutil.which('cc')
+-        if not c_compiler:
+-            # No C compiler available, give up
+-            return None
+-
+-        temp = tempfile.NamedTemporaryFile()
+-        try:
+-            args = [c_compiler, '-Wl,-t', '-o', temp.name, '-l' + name]
+-
+-            env = dict(os.environ)
+-            env['LC_ALL'] = 'C'
+-            env['LANG'] = 'C'
+-            try:
+-                proc = subprocess.Popen(args,
+-                                        stdout=subprocess.PIPE,
+-                                        stderr=subprocess.STDOUT,
+-                                        env=env)
+-            except OSError:  # E.g. bad executable
+-                return None
+-            with proc:
+-                trace = proc.stdout.read()
+-        finally:
+-            try:
+-                temp.close()
+-            except FileNotFoundError:
+-                # Raised if the file was already removed, which is the normal
+-                # behaviour of GCC if linking fails
+-                pass
+-        res = re.findall(expr, trace)
+-        if not res:
+-            return None
+-
+-        for file in res:
+-            # Check if the given file is an elf file: gcc can report
+-            # some files that are linker scripts and not actual
+-            # shared objects. See bpo-41976 for more details
+-            if not _is_elf(file):
+-                continue
+-            return os.fsdecode(file)
+        return None
+ 
+ 
+     if sys.platform == "sunos5":
+@@ -268,34 +222,7 @@ def find_library(name, is64 = False):
+     else:
+ 
+         def _findSoname_ldconfig(name):
+-            import struct
+-            if struct.calcsize('l') == 4:
+-                machine = os.uname().machine + '-32'
+-            else:
+-                machine = os.uname().machine + '-64'
+-            mach_map = {
+-                'x86_64-64': 'libc6,x86-64',
+-                'ppc64-64': 'libc6,64bit',
+-                'sparc64-64': 'libc6,64bit',
+-                's390x-64': 'libc6,64bit',
+-                'ia64-64': 'libc6,IA-64',
+-                }
+-            abi_type = mach_map.get(machine, 'libc6')
+-
+-            # XXX assuming GLIBC's ldconfig (with option -p)
+-            regex = r'\s+(lib%s\.[^\s]+)\s+\(%s'
+-            regex = os.fsencode(regex % (re.escape(name), abi_type))
+-            try:
+-                with subprocess.Popen(['/sbin/ldconfig', '-p'],
+-                                      stdin=subprocess.DEVNULL,
+-                                      stderr=subprocess.DEVNULL,
+-                                      stdout=subprocess.PIPE,
+-                                      env={'LC_ALL': 'C', 'LANG': 'C'}) as p:
+-                    res = re.search(regex, p.stdout.read())
+-                    if res:
+-                        return os.fsdecode(res.group(1))
+-            except OSError:
+-                pass
+            return None
+ 
+         def _findLib_ld(name):
+             # See issue #9998 for why this is needed
+-- 
+2.33.1
+
--- a/pkgs/development/interpreters/python/cpython/docs/2.7-html.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/2.7-html.nix
@ -2,10 +2,12 @@

 { stdenv, fetchurl, lib }:

-stdenv.mkDerivation {
-  name = "python27-docs-html-2.7.16";
+stdenv.mkDerivation rec {
+  pname = "python27-docs-html";
+  version = "2.7.16";
+
  src = fetchurl {
-    url = "http://docs.python.org/ftp/python/doc/2.7.16/python-2.7.16-docs-html.tar.bz2";
+    url = "http://docs.python.org/ftp/python/doc/${version}/python-${version}-docs-html.tar.bz2";
    sha256 = "1razs1grzhai65ihaiyph8kz6ncjkgp1gsn3c8v7kanf13lqim02";
  };
  installPhase = ''
--- a/pkgs/development/interpreters/python/cpython/docs/2.7-pdf-a4.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/2.7-pdf-a4.nix
@ -2,10 +2,12 @@

 { stdenv, fetchurl, lib }:

-stdenv.mkDerivation {
-  name = "python27-docs-pdf-a4-2.7.16";
+stdenv.mkDerivation rec {
+  pname = "python27-docs-pdf-a4";
+  version = "2.7.16";
+
  src = fetchurl {
-    url = "http://docs.python.org/ftp/python/doc/2.7.16/python-2.7.16-docs-pdf-a4.tar.bz2";
+    url = "http://docs.python.org/ftp/python/doc/${version}/python-${version}-docs-pdf-a4.tar.bz2";
    sha256 = "14ml1ynrlbhg43737bdsb8k5y39wsffqj4iwhylhb8n8l5dplfdq";
  };
  installPhase = ''
--- a/pkgs/development/interpreters/python/cpython/docs/2.7-pdf-letter.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/2.7-pdf-letter.nix
@ -2,10 +2,12 @@

 { stdenv, fetchurl, lib }:

-stdenv.mkDerivation {
-  name = "python27-docs-pdf-letter-2.7.16";
+stdenv.mkDerivation rec {
+  pname = "python27-docs-pdf-letter";
+  version = "2.7.16";
+
  src = fetchurl {
-    url = "http://docs.python.org/ftp/python/doc/2.7.16/python-2.7.16-docs-pdf-letter.tar.bz2";
+    url = "http://docs.python.org/ftp/python/doc/${version}/python-${version}-docs-pdf-letter.tar.bz2";
    sha256 = "019i8n48m71mn31v8d85kkwyqfgcgqnqh506y4a7fcgf656bajs0";
  };
  installPhase = ''
--- a/pkgs/development/interpreters/python/cpython/docs/2.7-text.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/2.7-text.nix
@ -2,10 +2,12 @@

 { stdenv, fetchurl, lib }:

-stdenv.mkDerivation {
-  name = "python27-docs-text-2.7.16";
+stdenv.mkDerivation rec {
+  pname = "python27-docs-text";
+  version = "2.7.16";
+
  src = fetchurl {
-    url = "http://docs.python.org/ftp/python/doc/2.7.16/python-2.7.16-docs-text.tar.bz2";
+    url = "http://docs.python.org/ftp/python/doc/${version}/python-${version}-docs-text.tar.bz2";
    sha256 = "1da7swlykvc013684nywycinfz3v8dqkcmv0zj8p7l5lyi5mq03r";
  };
  installPhase = ''
--- a/pkgs/development/interpreters/python/cpython/docs/3.7-html.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/3.7-html.nix
@ -2,10 +2,12 @@

 { stdenv, fetchurl, lib }:

-stdenv.mkDerivation {
-  name = "python37-docs-html-3.7.2";
+stdenv.mkDerivation rec {
+  pname = "python37-docs-html";
+  version = "3.7.2";
+
  src = fetchurl {
-    url = "http://docs.python.org/ftp/python/doc/3.7.2/python-3.7.2-docs-html.tar.bz2";
+    url = "http://docs.python.org/ftp/python/doc/${version}/python-${version}-docs-html.tar.bz2";
    sha256 = "19wbrawpdam09fmyipfy92sxwn1rl93v8jkfqsfx028qhvzf0422";
  };
  installPhase = ''
--- a/pkgs/development/interpreters/python/cpython/docs/3.7-pdf-a4.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/3.7-pdf-a4.nix
@ -2,10 +2,12 @@

 { stdenv, fetchurl, lib }:

-stdenv.mkDerivation {
-  name = "python37-docs-pdf-a4-3.7.2";
+stdenv.mkDerivation rec {
+  pname = "python37-docs-pdf-a4";
+  version = "3.7.2";
+
  src = fetchurl {
-    url = "http://docs.python.org/ftp/python/doc/3.7.2/python-3.7.2-docs-pdf-a4.tar.bz2";
+    url = "http://docs.python.org/ftp/python/doc/${version}/python-${version}-docs-pdf-a4.tar.bz2";
    sha256 = "0vdx762m30hjaabn6w88awcj2qpbz0b6z59zn9wmamd35k59lfba";
  };
  installPhase = ''
--- a/pkgs/development/interpreters/python/cpython/docs/3.7-pdf-letter.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/3.7-pdf-letter.nix
@ -2,10 +2,12 @@

 { stdenv, fetchurl, lib }:

-stdenv.mkDerivation {
-  name = "python37-docs-pdf-letter-3.7.2";
+stdenv.mkDerivation rec {
+  pname = "python37-docs-pdf-letter";
+  version = "3.7.2";
+
  src = fetchurl {
-    url = "http://docs.python.org/ftp/python/doc/3.7.2/python-3.7.2-docs-pdf-letter.tar.bz2";
+    url = "http://docs.python.org/ftp/python/doc/${version}/python-${version}-docs-pdf-letter.tar.bz2";
    sha256 = "17g57vlyvqx0k916q84q2pcx7y8myw0fda9fvg9kh0ph930c837x";
  };
  installPhase = ''
--- a/pkgs/development/interpreters/python/cpython/docs/3.7-text.nix
+++ b/pkgs/development/interpreters/python/cpython/docs/3.7-text.nix
@ -2,10 +2,12 @@

 { stdenv, fetchurl, lib }:

-stdenv.mkDerivation {
-  name = "python37-docs-text-3.7.2";
+stdenv.mkDerivation rec {
+  pname = "python37-docs-text";
+  version = "3.7.2";
+
  src = fetchurl {
-    url = "http://docs.python.org/ftp/python/doc/3.7.2/python-3.7.2-docs-text.tar.bz2";
+    url = "http://docs.python.org/ftp/python/doc/${version}/python-${version}-docs-text.tar.bz2";
    sha256 = "0h50rlr8jclwfxa106b42q2vn2ynp219c4zsy5qz65n5m3b7y1g2";
  };
  installPhase = ''
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@ -95,6 +95,7 @@ with pkgs;
        isPy38 = pythonVersion == "3.8";
        isPy39 = pythonVersion == "3.9";
        isPy310 = pythonVersion == "3.10";
+        isPy311 = pythonVersion == "3.11";
        isPy2 = lib.strings.substring 0 1 pythonVersion == "2";
        isPy3 = lib.strings.substring 0 1 pythonVersion == "3";
        isPy3k = isPy3;
@ -132,10 +133,10 @@ with pkgs;
      sourceVersion = {
        major = "3";
        minor = "9";
-        patch = "6";
+        patch = "9";
        suffix = "";
      };
-      sha256 = "12hhw2685i68pwfx5hdkqngzhbji4ccyjmqb5rzvkigg6fpj0y9r";
+      sha256 = "sha256-BoKMBKVzwHOk5RxCkqJ8G+SuJmIcPtx8+TGEGM47bSc=";
    };
  };

@ -192,6 +193,19 @@ in {
    inherit passthruFun;
  };

+  python311 = callPackage ./cpython {
+    self = python311;
+    sourceVersion = {
+      major = "3";
+      minor = "11";
+      patch = "0";
+      suffix = "a2";
+    };
+    sha256 = "sha256-aKjE1s4lSKe2F9aZ+9s0iTe9rODPltsaoIOEnfXa0T8=";
+    inherit (darwin) configd;
+    inherit passthruFun;
+  };
+
  # Minimal versions of Python (built without optional dependencies)
  python3Minimal = (callPackage ./cpython ({
    self = python3Minimal;
--- a/pkgs/development/interpreters/python/hooks/python-namespaces-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-namespaces-hook.sh
@ -24,6 +24,17 @@ pythonNamespacesHook() {
                rm -v "$pathToRemove"
            fi

+            # remove ${pname}-${version}-${python-interpeter}-nspkg.pth
+            #
+            # Still need to check that parent directory exists in the
+            # event of a "meta-package" package, which will just install
+            # other packages, but not produce anything in site-packages
+            # besides meta information
+            if [ -d "${constructedPath}/../" -a -z ${dontRemovePth-} ]; then
+                # .pth files are located in the parent directory of a module
+                @findutils@/bin/find ${constructedPath}/../ -name '*-nspkg.pth' -exec rm -v "{}" +
+            fi
+
            # remove __pycache__/ entry, can be interpreter specific. E.g. __init__.cpython-38.pyc
            # use null characters to perserve potential whitespace in filepath
            if [ -d "$pycachePath" ]; then
--- a/pkgs/development/libraries/aalib/default.nix
+++ b/pkgs/development/libraries/aalib/default.nix
@ -1,10 +1,11 @@
 {lib, stdenv, fetchurl, ncurses, automake}:

-stdenv.mkDerivation {
-  name = "aalib-1.4rc5";
+stdenv.mkDerivation rec {
+  pname = "aalib";
+  version = "1.4rc5";

  src = fetchurl {
-    url = "mirror://sourceforge/aa-project/aalib-1.4rc5.tar.gz";
+    url = "mirror://sourceforge/aa-project/aalib-${version}.tar.gz";
    sha256 = "1vkh19gb76agvh4h87ysbrgy82hrw88lnsvhynjf4vng629dmpgv";
  };

--- a/pkgs/development/libraries/acl/default.nix
+++ b/pkgs/development/libraries/acl/default.nix
@ -6,10 +6,11 @@
 # files.

 stdenv.mkDerivation rec {
-  name = "acl-2.3.1";
+  pname = "acl";
+  version = "2.3.1";

  src = fetchurl {
-    url = "mirror://savannah/acl/${name}.tar.gz";
+    url = "mirror://savannah/acl/acl-${version}.tar.gz";
    sha256 = "sha256-dgxhxokBs3/dXu/ur0wMeia9/disdHoe3/HODiQ8Ea8=";
  };

--- a/pkgs/development/libraries/aubio/default.nix
+++ b/pkgs/development/libraries/aubio/default.nix
@ -3,10 +3,11 @@
 }:

 stdenv.mkDerivation rec {
-  name = "aubio-0.4.9";
+  pname = "aubio";
+  version = "0.4.9";

  src = fetchurl {
-    url = "https://aubio.org/pub/${name}.tar.bz2";
+    url = "https://aubio.org/pub/aubio-${version}.tar.bz2";
    sha256 = "1npks71ljc48w6858l9bq30kaf5nph8z0v61jkfb70xb9np850nl";
  };

--- a/pkgs/development/libraries/audio/rtmidi/default.nix
+++ b/pkgs/development/libraries/audio/rtmidi/default.nix
@ -42,6 +42,9 @@ stdenv.mkDerivation rec {
      url = "https://github.com/thestk/rtmidi/pull/230/commits/892fe5492f0e787484fa4a37027b08c265ce001f.patch";
      sha256 = "0ca9m42xa3gmycimzvzvl67wa266xq9pfp1b4v555rh2fp52kbcj";
    })
+
+    # https://github.com/thestk/rtmidi/pull/277
+    ./macos_include_targetconditionals.patch
  ];

  postPatch = ''
--- a/pkgs/development/libraries/audio/rtmidi/macos_include_targetconditionals.patch
+++ b/pkgs/development/libraries/audio/rtmidi/macos_include_targetconditionals.patch
@ -0,0 +1,13 @@
+diff -ru a/RtMidi.cpp b/RtMidi.cpp
+--- a/RtMidi.cpp	2021-12-23 16:46:33.000000000 -0500
+++ b/RtMidi.cpp	2021-12-23 16:48:19.000000000 -0500
+@@ -39,6 +39,9 @@
+ 
+ #include "RtMidi.h"
+ #include <sstream>
+#if defined(__APPLE__)
+#include <TargetConditionals.h>
+#endif
+ 
+ #if defined(__MACOSX_CORE__)
+   #if TARGET_OS_IPHONE
--- a/pkgs/development/libraries/audiofile/default.nix
+++ b/pkgs/development/libraries/audiofile/default.nix
@ -11,7 +11,8 @@ let
 in

 stdenv.mkDerivation rec {
-  name = "audiofile-0.3.6";
+  pname = "audiofile";
+  version = "0.3.6";

  buildInputs =
    lib.optionals stdenv.isLinux [
@ -21,7 +22,7 @@ stdenv.mkDerivation rec {
    ];

  src = fetchurl {
-    url = "https://audiofile.68k.org/${name}.tar.gz";
+    url = "https://audiofile.68k.org/audiofile-${version}.tar.gz";
    sha256 = "0rb927zknk9kmhprd8rdr4azql4gn2dp75a36iazx2xhkbqhvind";
  };

--- a/pkgs/development/libraries/beecrypt/default.nix
+++ b/pkgs/development/libraries/beecrypt/default.nix
@ -1,9 +1,11 @@
 {lib, stdenv, fetchurl, m4}:

-stdenv.mkDerivation {
-  name = "beecrypt-4.2.1";
+stdenv.mkDerivation rec {
+  pname = "beecrypt";
+  version = "4.2.1";
+
  src = fetchurl {
-    url = "mirror://sourceforge/beecrypt/beecrypt-4.2.1.tar.gz";
+    url = "mirror://sourceforge/beecrypt/beecrypt-${version}.tar.gz";
    sha256 = "0pf5k1c4nsj77jfq5ip0ra1gzx2q47xaa0s008fnn6hd11b1yvr8";
  };
  buildInputs = [ m4 ];
--- a/pkgs/development/libraries/boost-process/default.nix
+++ b/pkgs/development/libraries/boost-process/default.nix
@ -1,18 +1,19 @@
 { lib, stdenv, fetchurl, unzip }:

-stdenv.mkDerivation {
-  name = "boost-process-0.5";
+stdenv.mkDerivation rec {
+  pname = "boost-process";
+  version = "0.5";

  src = fetchurl {
-    url = "http://www.highscore.de/boost/process0.5/process.zip";
+    url = "http://www.highscore.de/boost/process${version}/process.zip";
    sha256 = "1v9y9pffb2b7p642kp9ic4z6kg42ziizmyvbgrqd1ci0i4gn0831";
  };

  nativeBuildInputs = [ unzip ];

  unpackPhase = ''
-    mkdir $name
-    cd $name
+    mkdir boost-process-$version
+    cd boost-process-$version
    unzip $src
  '';

--- a/pkgs/development/libraries/boost/1.55.nix
+++ b/pkgs/development/libraries/boost/1.55.nix
@ -1,12 +1,12 @@
 { callPackage, fetchurl, ... } @ args:

-callPackage ./generic.nix (args // {
+callPackage ./generic.nix (args // rec {
  version = "1.55.0";

  patches = [ ./clang-math.patch ./clang-math-2.patch ./gcc-5.patch ];

  src = fetchurl {
-    url = "mirror://sourceforge/boost/boost_1_55_0.tar.bz2";
+    url = "mirror://sourceforge/boost/boost_${builtins.replaceStrings ["."] ["_"] version}.tar.bz2";
    sha256 = "0lkv5dzssbl5fmh2nkaszi8x9qbj80pr4acf9i26sj3rvlih1w7z";
  };
 })
--- a/pkgs/development/libraries/boost/1.59.nix
+++ b/pkgs/development/libraries/boost/1.59.nix
@ -1,10 +1,10 @@
 { callPackage, fetchurl, ... } @ args:

-callPackage ./generic.nix (args // {
+callPackage ./generic.nix (args // rec {
  version = "1.59.0";

  src = fetchurl {
-    url = "mirror://sourceforge/boost/boost_1_59_0.tar.bz2";
+    url = "mirror://sourceforge/boost/boost_${builtins.replaceStrings ["."] ["_"] version}.tar.bz2";
    sha256 = "1jj1aai5rdmd72g90a3pd8sw9vi32zad46xv5av8fhnr48ir6ykj";
  };
 })
--- a/Show More
+++ b/Show More