Merge branch 'release-21.05' into staging-21.05

2021-05-30 20:21:58 +02:00 · 2021-05-30 20:21:58 +02:00 · 013a9ad03b
commit 013a9ad03b
parent 35b4a78d9a 0e2b7ebdde
146 changed files with 2547 additions and 3426 deletions
--- a/doc/contributing/coding-conventions.chapter.md
+++ b/doc/contributing/coding-conventions.chapter.md
@ -526,6 +526,16 @@ If you do need to do create this sort of patch file, one way to do so is with gi
    $ git diff > nixpkgs/pkgs/the/package/0001-changes.patch
    ```

+If a patch is available online but does not cleanly apply, it can be modified in some fixed ways by using additional optional arguments for `fetchpatch`:
+
+- `stripLen`: Remove the first `stripLen` components of pathnames in the patch.
+- `extraPrefix`: Prefix pathnames by this string.
+- `excludes`: Exclude files matching this pattern.
+- `includes`: Include only files matching this pattern.
+- `revert`: Revert the patch.
+
+Note that because the checksum is computed after applying these effects, using or modifying these arguments will have no effect unless the `sha256` argument is changed as well.
+
 ## Package tests {#sec-package-tests}

 Tests are important to ensure quality and make reviews and automatic updates easy.
--- a/nixos/doc/manual/installation/installing.xml
+++ b/nixos/doc/manual/installation/installing.xml
@ -46,6 +46,12 @@
   to increase the font size.
  </para>

+  <para>
+    To install over a serial port connect with <literal>115200n8</literal>
+    (e.g. <command>picocom -b 115200 /dev/ttyUSB0</command>). When the
+    bootloader lists boot entries, select the serial console boot entry.
+  </para>
+
  <section xml:id="sec-installation-booting-networking">
   <title>Networking in the installer</title>

--- a/nixos/doc/manual/release-notes/rl-2105.xml
+++ b/nixos/doc/manual/release-notes/rl-2105.xml
@ -25,6 +25,7 @@
   </listitem>
   <listitem>
    <para>The default Linux kernel was updated to the 5.10 LTS series, coming from the 5.4 LTS series.</para>
+    <para>The <package>linux_latest</package> kernel was updated to the 5.12 series. It currently is not officially supported for use with the zfs filesystem. If you use zfs, you should use a different kernel version (either the LTS kernel, or track a specific one). </para>
   </listitem>
   <listitem>
    <para>GNOME desktop environment was upgraded to 40, see the release notes for <link xlink:href="https://help.gnome.org/misc/release-notes/40.0/">40.0</link> and <link xlink:href="https://help.gnome.org/misc/release-notes/3.38/">3.38</link>. The <code>gnome3</code> attribute set has been renamed to <code>gnome</code> and so have been the NixOS options.</para>
@ -305,6 +306,24 @@
      <literal>/var/lib/powerdns</literal> to <literal>/run/pdns</literal>.
    </para>
   </listitem>
+   <listitem>
+     <para>
+       The <literal>mediatomb</literal> service is
+       now using by default the new and maintained fork
+       <literal>gerbera</literal> package instead of the unmaintained
+       <literal>mediatomb</literal> package. If you want to keep the old
+       behavior, you must declare it with:
+       <programlisting>
+       services.mediatomb.package = pkgs.mediatomb;
+       </programlisting>
+       One new option <literal>openFirewall</literal> has been introduced which
+       defaults to false. If you relied on the service declaration to add the
+       firewall rules itself before, you should now declare it with:
+       <programlisting>
+       services.mediatomb.openFirewall = true;
+       </programlisting>
+     </para>
+   </listitem>
   <listitem>
     <para>
       xfsprogs was update from 4.19 to 5.11. It now enables reflink support by default on filesystem creation.
@ -427,7 +446,7 @@
    </para>
    <programlisting>
      TMPDIR=$(mktemp -d)
-      slaptest -f /path/to/slapd.conf $TMPDIR
+      slaptest -f /path/to/slapd.conf -F $TMPDIR
      slapcat -F $TMPDIR -n0 -H 'ldap:///???(!(objectClass=olcSchemaConfig))'
    </programlisting>
    <para>
@ -835,6 +854,29 @@ environment.systemPackages = [
     All services should use <xref linkend="opt-systemd.services._name_.startLimitIntervalSec" /> or <literal>StartLimitIntervalSec</literal> in <xref linkend="opt-systemd.services._name_.unitConfig" /> instead.
    </para>
   </listitem>
+   <listitem>
+     <para>
+       The <literal>mediatomb</literal> service
+       declares new options. It also adapts existing options so the
+       configuration generation is now lazy. The existing option
+       <literal>customCfg</literal> (defaults to false), when enabled, stops
+       the service configuration generation completely. It then expects the
+       users to provide their own correct configuration at the right location
+       (whereas the configuration was generated and not used at all before).
+       The new option <literal>transcodingOption</literal> (defaults to no)
+       allows a generated configuration. It makes the mediatomb service pulls
+       the necessary runtime dependencies in the nix store (whereas it was
+       generated with hardcoded values before). The new option
+       <literal>mediaDirectories</literal> allows the users to declare autoscan
+       media directories from their nixos configuration:
+       <programlisting>
+       services.mediatomb.mediaDirectories = [
+         { path = "/var/lib/mediatomb/pictures"; recursive = false; hidden-files = false; }
+         { path = "/var/lib/mediatomb/audio"; recursive = true; hidden-files = false; }
+       ];
+       </programlisting>
+     </para>
+   </listitem>
   <listitem>
    <para>
     The Unbound DNS resolver service (<literal>services.unbound</literal>) has been refactored to allow reloading, control sockets and to fix startup ordering issues.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -472,7 +472,6 @@
  ./services/misc/cgminer.nix
  ./services/misc/confd.nix
  ./services/misc/couchpotato.nix
-  ./services/misc/dendrite.nix
  ./services/misc/devmon.nix
  ./services/misc/dictd.nix
  ./services/misc/duckling.nix
--- a/nixos/modules/services/misc/dendrite.nix
+++ b/nixos/modules/services/misc/dendrite.nix
@ -1,181 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.services.dendrite;
-  settingsFormat = pkgs.formats.yaml { };
-  configurationYaml = settingsFormat.generate "dendrite.yaml" cfg.settings;
-  workingDir = "/var/lib/dendrite";
-in
-{
-  options.services.dendrite = {
-    enable = lib.mkEnableOption "matrix.org dendrite";
-    httpPort = lib.mkOption {
-      type = lib.types.nullOr lib.types.port;
-      default = 8008;
-      description = ''
-        The port to listen for HTTP requests on.
-      '';
-    };
-    httpsPort = lib.mkOption {
-      type = lib.types.nullOr lib.types.port;
-      default = null;
-      description = ''
-        The port to listen for HTTPS requests on.
-      '';
-    };
-    tlsCert = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      example = "/var/lib/dendrite/server.cert";
-      default = null;
-      description = ''
-        The path to the TLS certificate.
-
-        <programlisting>
-          nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"
-        </programlisting>
-      '';
-    };
-    tlsKey = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      example = "/var/lib/dendrite/server.key";
-      default = null;
-      description = ''
-        The path to the TLS key.
-
-        <programlisting>
-          nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"
-        </programlisting>
-      '';
-    };
-    environmentFile = lib.mkOption {
-      type = lib.types.nullOr lib.types.path;
-      example = "/var/lib/dendrite/registration_secret";
-      default = null;
-      description = ''
-        Environment file as defined in <citerefentry>
-        <refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum>
-        </citerefentry>.
-        Secrets may be passed to the service without adding them to the world-readable
-        Nix store, by specifying placeholder variables as the option value in Nix and
-        setting these variables accordingly in the environment file. Currently only used
-        for the registration secret to allow secure registration when
-        client_api.registration_disabled is true.
-
-        <programlisting>
-          # snippet of dendrite-related config
-          services.dendrite.settings.client_api.registration_shared_secret = "$REGISTRATION_SHARED_SECRET";
-        </programlisting>
-
-        <programlisting>
-          # content of the environment file
-          REGISTRATION_SHARED_SECRET=verysecretpassword
-        </programlisting>
-
-        Note that this file needs to be available on the host on which
-        <literal>dendrite</literal> is running.
-      '';
-    };
-    settings = lib.mkOption {
-      type = lib.types.submodule {
-        freeformType = settingsFormat.type;
-        options.global = {
-          server_name = lib.mkOption {
-            type = lib.types.str;
-            example = "example.com";
-            description = ''
-              The domain name of the server, with optional explicit port.
-              This is used by remote servers to connect to this server.
-              This is also the last part of your UserID.
-            '';
-          };
-          private_key = lib.mkOption {
-            type = lib.types.path;
-            example = "${workingDir}/matrix_key.pem";
-            description = ''
-              The path to the signing private key file, used to sign
-              requests and events.
-
-              <programlisting>
-                nix-shell -p dendrite --command "generate-keys --private-key matrix_key.pem"
-              </programlisting>
-            '';
-          };
-          trusted_third_party_id_servers = lib.mkOption {
-            type = lib.types.listOf lib.types.str;
-            example = [ "matrix.org" ];
-            default = [ "matrix.org" "vector.im" ];
-            description = ''
-              Lists of domains that the server will trust as identity
-              servers to verify third party identifiers such as phone
-              numbers and email addresses
-            '';
-          };
-        };
-        options.client_api = {
-          registration_disabled = lib.mkOption {
-            type = lib.types.bool;
-            default = true;
-            description = ''
-              Whether to disable user registration to the server
-              without the shared secret.
-            '';
-          };
-        };
-      };
-      default = { };
-      description = ''
-        Configuration for dendrite, see:
-        <link xlink:href="https://github.com/matrix-org/dendrite/blob/master/dendrite-config.yaml"/>
-        for available options with which to populate settings.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    assertions = [{
-      assertion = cfg.httpsPort != null -> (cfg.tlsCert != null && cfg.tlsKey != null);
-      message = ''
-        If Dendrite is configured to use https, tlsCert and tlsKey must be provided.
-
-        nix-shell -p dendrite --command "generate-keys --tls-cert server.crt --tls-key server.key"
-      '';
-    }];
-
-    systemd.services.dendrite = {
-      description = "Dendrite Matrix homeserver";
-      after = [
-        "network.target"
-      ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        Type = "simple";
-        DynamicUser = true;
-        StateDirectory = "dendrite";
-        WorkingDirectory = workingDir;
-        RuntimeDirectory = "dendrite";
-        RuntimeDirectoryMode = "0700";
-        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
-        ExecStartPre =
-          if (cfg.environmentFile != null) then ''
-            ${pkgs.envsubst}/bin/envsubst \
-              -i ${configurationYaml} \
-              -o /run/dendrite/dendrite.yaml
-          '' else ''
-            ${pkgs.coreutils}/bin/cp ${configurationYaml} /run/dendrite/dendrite.yaml
-          '';
-        ExecStart = lib.strings.concatStringsSep " " ([
-          "${pkgs.dendrite}/bin/dendrite-monolith-server"
-          "--config /run/dendrite/dendrite.yaml"
-        ] ++ lib.optionals (cfg.httpPort != null) [
-          "--http-bind-address :${builtins.toString cfg.httpPort}"
-        ] ++ lib.optionals (cfg.httpsPort != null) [
-          "--https-bind-address :${builtins.toString cfg.httpsPort}"
-          "--tls-cert ${cfg.tlsCert}"
-          "--tls-key ${cfg.tlsKey}"
-        ]);
-        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
-        Restart = "on-failure";
-      };
-    };
-  };
-  meta.maintainers = lib.teams.matrix.members;
-}
--- a/nixos/modules/services/misc/nix-daemon.nix
+++ b/nixos/modules/services/misc/nix-daemon.nix
@ -12,8 +12,6 @@ let

  isNix23 = versionAtLeast nixVersion "2.3pre";

-  isNix24 = versionAtLeast nixVersion "2.4pre";
-
  makeNixBuildUser = nr: {
    name  = "nixbld${toString nr}";
    value = {
@ -43,11 +41,7 @@ let
        max-jobs = ${toString (cfg.maxJobs)}
        cores = ${toString (cfg.buildCores)}
        sandbox = ${if (builtins.isBool cfg.useSandbox) then boolToString cfg.useSandbox else cfg.useSandbox}
-        ${if isNix24 then ''
-          sandbox-paths = ${toString cfg.sandboxPaths}
-        '' else ''
-          extra-sandbox-paths = ${toString cfg.sandboxPaths}
-        ''}
+        extra-sandbox-paths = ${toString cfg.sandboxPaths}
        substituters = ${toString cfg.binaryCaches}
        trusted-substituters = ${toString cfg.trustedBinaryCaches}
        trusted-public-keys = ${toString cfg.binaryCachePublicKeys}
--- a/nixos/modules/services/networking/kresd.nix
+++ b/nixos/modules/services/networking/kresd.nix
@ -115,6 +115,8 @@ in {
  config = mkIf cfg.enable {
    environment.etc."knot-resolver/kresd.conf".source = configFile; # not required

+    networking.resolvconf.useLocalResolver = mkDefault true;
+
    users.users.knot-resolver =
      { isSystemUser = true;
        group = "knot-resolver";
--- a/nixos/modules/services/networking/wireguard.nix
+++ b/nixos/modules/services/networking/wireguard.nix
@ -219,17 +219,6 @@ let

  };

-  generatePathUnit = name: values:
-    assert (values.privateKey == null);
-    assert (values.privateKeyFile != null);
-    nameValuePair "wireguard-${name}"
-      {
-        description = "WireGuard Tunnel - ${name} - Private Key";
-        requiredBy = [ "wireguard-${name}.service" ];
-        before = [ "wireguard-${name}.service" ];
-        pathConfig.PathExists = values.privateKeyFile;
-      };
-
  generateKeyServiceUnit = name: values:
    assert values.generatePrivateKeyFile;
    nameValuePair "wireguard-${name}-key"
@ -448,9 +437,6 @@ in
      // (mapAttrs' generateKeyServiceUnit
      (filterAttrs (name: value: value.generatePrivateKeyFile) cfg.interfaces));

-    systemd.paths = mapAttrs' generatePathUnit
-      (filterAttrs (name: value: value.privateKeyFile != null) cfg.interfaces);
-
  });

 }
--- a/nixos/modules/services/security/bitwarden_rs/default.nix
+++ b/nixos/modules/services/security/bitwarden_rs/default.nix
@ -121,7 +121,6 @@ in {
        EnvironmentFile = [ configFile ] ++ optional (cfg.environmentFile != null) cfg.environmentFile;
        ExecStart = "${bitwarden_rs}/bin/bitwarden_rs";
        LimitNOFILE = "1048576";
-        LimitNPROC = "64";
        PrivateTmp = "true";
        PrivateDevices = "true";
        ProtectHome = "true";
--- a/nixos/modules/services/web-apps/discourse.nix
+++ b/nixos/modules/services/web-apps/discourse.nix
@ -5,11 +5,16 @@ let

  cfg = config.services.discourse;

+  # Keep in sync with https://github.com/discourse/discourse_docker/blob/master/image/base/Dockerfile#L5
+  upstreamPostgresqlVersion = lib.getVersion pkgs.postgresql_13;
+
  postgresqlPackage = if config.services.postgresql.enable then
                        config.services.postgresql.package
                      else
                        pkgs.postgresql;

+  postgresqlVersion = lib.getVersion postgresqlPackage;
+
  # We only want to create a database if we're actually going to connect to it.
  databaseActuallyCreateLocally = cfg.database.createLocally && cfg.database.host == null;

@ -263,6 +268,17 @@ in
            Discourse database user.
          '';
        };
+
+        ignorePostgresqlVersion = lib.mkOption {
+          type = lib.types.bool;
+          default = false;
+          description = ''
+            Whether to allow other versions of PostgreSQL than the
+            recommended one. Only effective when
+            <option>services.discourse.database.createLocally</option>
+            is enabled.
+          '';
+        };
      };

      redis = {
@ -398,6 +414,14 @@ in
              How OpenSSL checks the certificate, see http://api.rubyonrails.org/classes/ActionMailer/Base.html
            '';
          };
+
+          forceTLS = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = ''
+              Force implicit TLS as per RFC 8314 3.3.
+            '';
+          };
        };

        incoming = {
@ -497,6 +521,12 @@ in
        assertion = cfg.hostname != "";
        message = "Could not automatically determine hostname, set service.discourse.hostname manually.";
      }
+      {
+        assertion = cfg.database.ignorePostgresqlVersion || (databaseActuallyCreateLocally -> upstreamPostgresqlVersion == postgresqlVersion);
+        message = "The PostgreSQL version recommended for use with Discourse is ${upstreamPostgresqlVersion}, you're using ${postgresqlVersion}. "
+                  + "Either update your PostgreSQL package to the correct version or set services.discourse.database.ignorePostgresqlVersion. "
+                  + "See https://nixos.org/manual/nixos/stable/index.html#module-postgresql for details on how to upgrade PostgreSQL.";
+      }
    ];


@ -530,6 +560,7 @@ in
      smtp_authentication = cfg.mail.outgoing.authentication;
      smtp_enable_start_tls = cfg.mail.outgoing.enableStartTLSAuto;
      smtp_openssl_verify_mode = cfg.mail.outgoing.opensslVerifyMode;
+      smtp_force_tls = cfg.mail.outgoing.forceTLS;

      load_mini_profiler = true;
      mini_profiler_snapshots_period = 0;
@ -542,8 +573,8 @@ in

      redis_host = cfg.redis.host;
      redis_port = 6379;
-      redis_slave_host = null;
-      redis_slave_port = 6379;
+      redis_replica_host = null;
+      redis_replica_port = 6379;
      redis_db = cfg.redis.dbNumber;
      redis_password = cfg.redis.passwordFile;
      redis_skip_client_commands = false;
@ -552,8 +583,8 @@ in
      message_bus_redis_enabled = false;
      message_bus_redis_host = "localhost";
      message_bus_redis_port = 6379;
-      message_bus_redis_slave_host = null;
-      message_bus_redis_slave_port = 6379;
+      message_bus_redis_replica_host = null;
+      message_bus_redis_replica_port = 6379;
      message_bus_redis_db = 0;
      message_bus_redis_password = null;
      message_bus_redis_skip_client_commands = false;
@ -606,6 +637,7 @@ in
      allowed_theme_repos = null;
      enable_email_sync_demon = false;
      max_digests_enqueued_per_30_mins_per_site = 10000;
+      cluster_name = null;
    };

    services.redis.enable = lib.mkDefault (cfg.redis.host == "localhost");
@ -667,6 +699,7 @@ in
      environment = cfg.package.runtimeEnv // {
        UNICORN_TIMEOUT = builtins.toString cfg.unicornTimeout;
        UNICORN_SIDEKIQS = builtins.toString cfg.sidekiqProcesses;
+        MALLOC_ARENA_MAX = "2";
      };

      preStart =
--- a/nixos/modules/services/web-apps/wordpress.nix
+++ b/nixos/modules/services/web-apps/wordpress.nix
@ -61,8 +61,10 @@ let
    ?>
  '';

-  secretsVars = [ "AUTH_KEY" "SECURE_AUTH_KEY" "LOOGGED_IN_KEY" "NONCE_KEY" "AUTH_SALT" "SECURE_AUTH_SALT" "LOGGED_IN_SALT" "NONCE_SALT" ];
+  secretsVars = [ "AUTH_KEY" "SECURE_AUTH_KEY" "LOGGED_IN_KEY" "NONCE_KEY" "AUTH_SALT" "SECURE_AUTH_SALT" "LOGGED_IN_SALT" "NONCE_SALT" ];
  secretsScript = hostStateDir: ''
+    # The match in this line is not a typo, see https://github.com/NixOS/nixpkgs/pull/124839
+    grep -q "LOOGGED_IN_KEY" "${hostStateDir}/secret-keys.php" && rm "${hostStateDir}/secret-keys.php"
    if ! test -e "${hostStateDir}/secret-keys.php"; then
      umask 0177
      echo "<?php" >> "${hostStateDir}/secret-keys.php"
--- a/nixos/modules/tasks/filesystems.nix
+++ b/nixos/modules/tasks/filesystems.nix
@ -321,6 +321,7 @@ in
            RemainAfterExit = true;
          };
          unitConfig = {
+            ConditionPathIsMountPoint = "!/sys/fs/pstore";
            ConditionVirtualization = "!container";
            DefaultDependencies = false; # needed to prevent a cycle
          };
--- a/nixos/modules/virtualisation/libvirtd.nix
+++ b/nixos/modules/virtualisation/libvirtd.nix
@ -159,7 +159,7 @@ in {
      etc."qemu/bridge.conf".text = lib.concatMapStringsSep "\n" (e:
        "allow ${e}") cfg.allowedBridges;
      systemPackages = with pkgs; [ libressl.nc iptables cfg.package cfg.qemuPackage ];
-      etc.ethertypes.source = "${pkgs.iptables}/etc/ethertypes";
+      etc.ethertypes.source = "${pkgs.ebtables}/etc/ethertypes";
    };

    boot.kernelModules = [ "tun" ];
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -53,7 +53,7 @@ in
  caddy = handleTest ./caddy.nix {};
  cadvisor = handleTestOn ["x86_64-linux"] ./cadvisor.nix {};
  cage = handleTestOn ["x86_64-linux"] ./cage.nix {};
-  cagebreak = handleTest ./cagebreak.nix {};
+  cagebreak = handleTestOn ["x86_64-linux"] ./cagebreak.nix {};
  calibre-web = handleTest ./calibre-web.nix {};
  cassandra_2_1 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_2_1; };
  cassandra_2_2 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_2_2; };
@ -93,7 +93,6 @@ in
  custom-ca = handleTest ./custom-ca.nix {};
  croc = handleTest ./croc.nix {};
  deluge = handleTest ./deluge.nix {};
-  dendrite = handleTest ./dendrite.nix {};
  dhparams = handleTest ./dhparams.nix {};
  discourse = handleTest ./discourse.nix {};
  dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {};
@ -395,7 +394,7 @@ in
  sssd-ldap = handleTestOn ["x86_64-linux"] ./sssd-ldap.nix {};
  strongswan-swanctl = handleTest ./strongswan-swanctl.nix {};
  sudo = handleTest ./sudo.nix {};
-  sway = handleTest ./sway.nix {};
+  sway = handleTestOn ["x86_64-linux"] ./sway.nix {};
  switchTest = handleTest ./switch-test.nix {};
  sympa = handleTest ./sympa.nix {};
  syncthing = handleTest ./syncthing.nix {};
--- a/nixos/tests/dendrite.nix
+++ b/nixos/tests/dendrite.nix
@ -1,99 +0,0 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-    let
-      homeserverUrl = "http://homeserver:8008";
-
-      private_key = pkgs.runCommand "matrix_key.pem" {
-        buildInputs = [ pkgs.dendrite ];
-      } "generate-keys --private-key $out";
-    in
-      {
-        name = "dendrite";
-        meta = with pkgs.lib; {
-          maintainers = teams.matrix.members;
-        };
-
-        nodes = {
-          homeserver = { pkgs, ... }: {
-            services.dendrite = {
-              enable = true;
-              settings = {
-                global.server_name = "test-dendrite-server.com";
-                global.private_key = private_key;
-                client_api.registration_disabled = false;
-              };
-            };
-
-            networking.firewall.allowedTCPPorts = [ 8008 ];
-          };
-
-          client = { pkgs, ... }: {
-            environment.systemPackages = [
-              (
-                pkgs.writers.writePython3Bin "do_test"
-                  { libraries = [ pkgs.python3Packages.matrix-nio ]; } ''
-                  import asyncio
-
-                  from nio import AsyncClient
-
-
-                  async def main() -> None:
-                      # Connect to dendrite
-                      client = AsyncClient("http://homeserver:8008", "alice")
-
-                      # Register as user alice
-                      response = await client.register("alice", "my-secret-password")
-
-                      # Log in as user alice
-                      response = await client.login("my-secret-password")
-
-                      # Create a new room
-                      response = await client.room_create(federate=False)
-                      room_id = response.room_id
-
-                      # Join the room
-                      response = await client.join(room_id)
-
-                      # Send a message to the room
-                      response = await client.room_send(
-                          room_id=room_id,
-                          message_type="m.room.message",
-                          content={
-                              "msgtype": "m.text",
-                              "body": "Hello world!"
-                          }
-                      )
-
-                      # Sync responses
-                      response = await client.sync(timeout=30000)
-
-                      # Check the message was received by dendrite
-                      last_message = response.rooms.join[room_id].timeline.events[-1].body
-                      assert last_message == "Hello world!"
-
-                      # Leave the room
-                      response = await client.room_leave(room_id)
-
-                      # Close the client
-                      await client.close()
-
-                  asyncio.get_event_loop().run_until_complete(main())
-                ''
-              )
-            ];
-          };
-        };
-
-        testScript = ''
-          start_all()
-
-          with subtest("start the homeserver"):
-              homeserver.wait_for_unit("dendrite.service")
-              homeserver.wait_for_open_port(8008)
-
-          with subtest("ensure messages can be exchanged"):
-              client.succeed("do_test")
-        '';
-
-      }
-)
--- a/nixos/tests/discourse.nix
+++ b/nixos/tests/discourse.nix
@ -51,6 +51,8 @@ import ./make-test-python.nix (

        environment.systemPackages = [ pkgs.jq ];

+        services.postgresql.package = pkgs.postgresql_13;
+
        services.discourse = {
          enable = true;
          inherit admin;
--- a/pkgs/applications/audio/bjumblr/default.nix
+++ b/pkgs/applications/audio/bjumblr/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "BJumblr";
-  version = "1.4.2";
+  version = "1.6.6";

  src = fetchFromGitHub {
    owner = "sjaehn";
    repo = pname;
    rev = version;
-    sha256 = "0kl6hrxmqrdf0195bfnzsa2h1073fgiqrfhg2276fm1954sm994v";
+    sha256 = "1nbxi54023vck3qgmr385cjzinmdnvz62ywb6bcksmc3shl080mg";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/applications/audio/goattracker/default.nix
+++ b/pkgs/applications/audio/goattracker/default.nix
@ -27,16 +27,16 @@ let
 in stdenv.mkDerivation rec {
  inherit pname;
  version = if isStereo
-    then "2.76"  # stereo
-    else "2.75"; # normal
+    then "2.77"  # stereo
+    else "2.76"; # normal

  src = fetchurl {
    url = "mirror://sourceforge/goattracker2/GoatTracker_${version}${optionalString isStereo "_Stereo"}.zip";
    sha256 = if isStereo
-      then "12cz3780x5k047jqdv69n6rjgbfiwv67z850kfl4i37lxja432l7"  # stereo
-      else "1km97nl7qvk6qc5l5j69wncbm76hf86j47sgzgr968423g0bxxlk"; # normal
+      then "1hiig2d152sv9kazwz33i56x1c54h5sh21ipkqnp6qlnwj8x1ksy"  # stereo
+      else "0d7a3han4jw4bwiba3j87racswaajgl3pj4sb5lawdqdxicv3dn1"; # normal
  };
-  sourceRoot = (if isStereo then "gt2stereo/trunk" else "goattrk2") + "/src";
+  sourceRoot = "src";

  nativeBuildInputs = [ copyDesktopItems unzip imagemagick ];
  buildInputs = [ SDL ];
--- a/pkgs/applications/audio/gxplugins-lv2/default.nix
+++ b/pkgs/applications/audio/gxplugins-lv2/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "GxPlugins.lv2";
-  version = "0.8";
+  version = "0.9";

  src = fetchFromGitHub {
    owner = "brummer10";
    repo = pname;
    rev = "v${version}";
-    sha256 = "11iv7bwvvspm74pisqvcpsxpg9xi6b08hq4i8q67mri4mvy9hmal";
+    sha256 = "02fksl8wr443ygwgcd1c2zab8kp67a6ps12k71ysqx7szv4zq877";
    fetchSubmodules = true;
  };

@ -29,6 +29,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/brummer10/GxPlugins.lv2";
    description = "A set of extra lv2 plugins from the guitarix project";
    maintainers = [ maintainers.magnetophon ];
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
  };
 }
--- a/pkgs/applications/audio/whipper/default.nix
+++ b/pkgs/applications/audio/whipper/default.nix
@ -1,7 +1,17 @@
-{ lib, fetchFromGitHub, python3, cdparanoia, cdrdao, flac
-, sox, accuraterip-checksum, libsndfile, util-linux, substituteAll }:
+{ lib
+, python3
+, fetchFromGitHub
+, libcdio-paranoia
+, cdrdao
+, libsndfile
+, flac
+, sox
+, util-linux
+}:

-python3.pkgs.buildPythonApplication rec {
+let
+  bins = [ libcdio-paranoia cdrdao flac sox util-linux ];
+in python3.pkgs.buildPythonApplication rec {
  pname = "whipper";
  version = "0.10.0";

@ -12,44 +22,43 @@ python3.pkgs.buildPythonApplication rec {
    sha256 = "00cq03cy5dyghmibsdsq5sdqv3bzkzhshsng74bpnb5lasxp3ia5";
  };

-  pythonPath = with python3.pkgs; [
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools_scm
+    docutils
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
    musicbrainzngs
    mutagen
    pycdio
    pygobject3
-    requests
    ruamel_yaml
-    setuptools
-    setuptools_scm
+    discid
+    pillow
  ];

  buildInputs = [ libsndfile ];

  checkInputs = with python3.pkgs; [
    twisted
-  ];
-
-  patches = [
-    (substituteAll {
-      src = ./paths.patch;
-      inherit cdparanoia;
-    })
-  ];
+  ] ++ bins;

  makeWrapperArgs = [
-    "--prefix" "PATH" ":" (lib.makeBinPath [ accuraterip-checksum cdrdao util-linux flac sox ])
+    "--prefix" "PATH" ":" (lib.makeBinPath bins)
  ];

  preBuild = ''
    export SETUPTOOLS_SCM_PRETEND_VERSION="${version}"
  '';

-  # some tests require internet access
-  # https://github.com/JoeLametta/whipper/issues/291
-  doCheck = false;
-
-  preCheck = ''
-    HOME=$TMPDIR
+  checkPhase = ''
+    runHook preCheck
+    # disable tests that require internet access
+    # https://github.com/JoeLametta/whipper/issues/291
+    substituteInPlace whipper/test/test_common_accurip.py \
+      --replace "test_AccurateRipResponse" "dont_test_AccurateRipResponse"
+    HOME=$TMPDIR ${python3.interpreter} -m unittest discover
+    runHook postCheck
  '';

  meta = with lib; {
--- a/pkgs/applications/audio/whipper/paths.patch
+++ b/pkgs/applications/audio/whipper/paths.patch
@ -1,32 +0,0 @@
--- a/whipper/program/cdparanoia.py
-+++ b/whipper/program/cdparanoia.py
-@@ -280,10 +280,10 @@
- 
-         bufsize = 1024
-         if self._overread:
-            argv = ["cd-paranoia", "--stderr-progress",
-+            argv = ["@cdparanoia@/bin/cdparanoia", "--stderr-progress",
-                     "--sample-offset=%d" % self._offset, "--force-overread", ]
-         else:
-            argv = ["cd-paranoia", "--stderr-progress",
-+            argv = ["@cdparanoia@/bin/cdparanoia", "--stderr-progress",
-                     "--sample-offset=%d" % self._offset, ]
-         if self._device:
-             argv.extend(["--force-cdrom-device", self._device, ])
-@@ -560,7 +560,7 @@
- 
- def getCdParanoiaVersion():
-     getter = common.VersionGetter('cd-paranoia',
-                                  ["cd-paranoia", "-V"],
-+                                  ["@cdparanoia@/bin/cdparanoia", "-V"],
-                                   _VERSION_RE,
-                                   "%(version)s %(release)s")
- 
-@@ -585,7 +585,7 @@
-     def __init__(self, device=None):
-         # cdparanoia -A *always* writes cdparanoia.log
-         self.cwd = tempfile.mkdtemp(suffix='.whipper.cache')
-        self.command = ['cd-paranoia', '-A']
-+        self.command = ['@cdparanoia@/bin/cdparanoia', '-A']
-         if device:
-             self.command += ['-d', device]
--- a/pkgs/applications/backup/pika-backup/default.nix
+++ b/pkgs/applications/backup/pika-backup/default.nix
@ -19,20 +19,20 @@

 stdenv.mkDerivation rec {
  pname = "pika-backup";
-  version = "0.3.1";
+  version = "0.3.2";

  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    owner = "World";
    repo = "pika-backup";
    rev = "v${version}";
-    sha256 = "0cr3axfp15nzwmsqyz6j781qhr2gsn9p69m0jfzy89pl83d6vcz0";
+    sha256 = "sha256-dKVyvB4s1MZHri0dFJDBUXQKsi2KgP30ZhsJ486M+og=";
  };

  cargoDeps = rustPlatform.fetchCargoTarball {
    inherit src;
    name = "${pname}-${version}";
-    sha256 = "1z0cbrkhxyzwf7vjjsvdppb7zhflpkw4m5cy90a2315nbll3hpbp";
+    sha256 = "1vsh8vqgmfady82d7wfxkknmrp7mq7nizpif2zwg3kqbl964mp3y";
  };

  patches = [
--- a/pkgs/applications/blockchains/stellar-core-dirty-version.patch
+++ b/pkgs/applications/blockchains/stellar-core-dirty-version.patch
@ -1,15 +0,0 @@
-Subject: Prevent "-dirty" from being erroneously added to the version
-
-diff --git a/src/Makefile.am b/src/Makefile.am
-index d36d1a3..00048fc 100644
--- a/src/Makefile.am
-+++ b/src/Makefile.am
-@@ -28,7 +28,7 @@ always:
- # Always rebuild because .git/HEAD is a symbolic ref one can't depend on
- StellarCoreVersion.h: always
- 	@vers=$$(cd "$(srcdir)" \
-		&& git describe --always --dirty --tags 2>/dev/null \
-+		&& git describe --always --tags 2>/dev/null \
- 		|| echo "$(PACKAGE) $(VERSION)"); \
- 	    echo "#define STELLAR_CORE_VERSION \"$$vers\"" > $@~
- 	@if cmp -s $@~ $@; then rm -f $@~; else \
--- a/pkgs/applications/blockchains/stellar-core.nix
+++ b/pkgs/applications/blockchains/stellar-core.nix
@ -1,31 +1,30 @@
-{ lib, stdenv, fetchgit, autoconf, libtool, automake, pkg-config, git
-, bison, flex, postgresql }:
+{ lib, stdenv, fetchFromGitHub, autoconf, libtool, automake, pkg-config, git
+, bison, flex, postgresql, ripgrep }:

-let
+stdenv.mkDerivation rec {
  pname = "stellar-core";
-  version = "0.5.1";
+  version = "17.0.0";

-in stdenv.mkDerivation {
-  name = "${pname}-${version}";
-
-  src = fetchgit {
-    url = "https://github.com/stellar/stellar-core.git";
-    rev = "refs/tags/v${version}";
-    sha256 = "0ldw3qr0sajgam38z2w2iym0214ial6iahbzx3b965cw92n8n88z";
+  src = fetchFromGitHub {
+    owner = "stellar";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1ngl8yjqb8xzhdwzlxzzxf14q2hgwy2ysb17sn5380rrn0jswin1";
    fetchSubmodules = true;
-    leaveDotGit = true;
  };

-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ autoconf automake libtool git ];
+  nativeBuildInputs = [ automake autoconf git libtool pkg-config ripgrep ];

  propagatedBuildInputs = [ bison flex postgresql ];

-  patches = [ ./stellar-core-dirty-version.patch ];
-
  preConfigure = ''
+    # Due to https://github.com/NixOS/nixpkgs/issues/8567 we cannot rely on
+    # having the .git directory present, so directly provide the version
+    substituteInPlace src/Makefile.am --replace '$$vers' '${pname} ${version}';
+
    # Everything needs to be staged in git because the build uses
    # `git ls-files` to search for source files to compile.
+    git init
    git add .

    ./autogen.sh
--- a/pkgs/applications/editors/neovim/neovide/default.nix
+++ b/pkgs/applications/editors/neovim/neovide/default.nix
@ -66,7 +66,7 @@ rustPlatform.buildRustPackage rec {

  SKIA_OFFLINE_NINJA_COMMAND = "${ninja}/bin/ninja";
  SKIA_OFFLINE_GN_COMMAND = "${gn}/bin/gn";
-  LIBCLANG_PATH = "${llvmPackages.libclang}/lib";
+  LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";

  # test needs a valid fontconfig file
  FONTCONFIG_FILE = makeFontsConf { fontDirectories = [ ]; };
--- a/pkgs/applications/misc/girara/default.nix
+++ b/pkgs/applications/misc/girara/default.nix
@ -12,9 +12,10 @@ stdenv.mkDerivation rec {
    sha256 = "1n3i960b458172mc3pkq7m9dn5qxry6fms3c3k06v27cjp5whsyf";
  };

-  nativeBuildInputs = [ meson ninja pkg-config gettext check dbus xvfb-run ];
+  nativeBuildInputs = [ meson ninja pkg-config gettext check dbus ];
  buildInputs = [ libintl libiconv json_c ];
  propagatedBuildInputs = [ glib gtk ];
+  checkInputs = [ xvfb-run ];

  doCheck = !stdenv.isDarwin;

--- a/pkgs/applications/misc/tellico/default.nix
+++ b/pkgs/applications/misc/tellico/default.nix
@ -24,15 +24,15 @@

 mkDerivation rec {
  pname = "tellico";
-  version = "3.4";
+  version = "3.4.1";

  src = fetchurl {
-    # version 3.3.0 just uses 3.3 in its name
+    # version 3.3.0 just uses 3.3 in its file name
    urls = [
      "https://tellico-project.org/files/tellico-${version}.tar.xz"
      "https://tellico-project.org/files/tellico-${lib.versions.majorMinor version}.tar.xz"
    ];
-    sha256 = "sha256-YXMJrAkfehe3ox4WZ19igyFbXwtjO5wxN3bmgP01jPs=";
+    sha256 = "sha256-+FFN6sO0mvlage8JazyrqNZk4onejz1XJPiOK3gnhWE=";
  };

  nativeBuildInputs = [
@ -63,7 +63,7 @@ mkDerivation rec {
  meta = with lib; {
    description = "Collection management software, free and simple";
    homepage = "https://tellico-project.org/";
-    license = with licenses; [ gpl2 gpl3 ];
+    license = with licenses; [ gpl2Only gpl3Only lgpl2Only ];
    maintainers = with maintainers; [ numkem ];
    platforms = platforms.linux;
  };
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -1,20 +1,20 @@
 {
  "stable": {
-    "version": "90.0.4430.212",
-    "sha256": "17nmhrkl81qqvzbh861k2mmifncx4wg1mv1fmn52f8gzn461vqdb",
-    "sha256bin64": "1y33c5829s22yfj0qmsj8fpcxnjhcm3fsxz7744csfsa9cy4fjr7",
+    "version": "91.0.4472.77",
+    "sha256": "0c8vj3gq3nmb7ssiwj6875g0a8hcprss1a4gqw9h7llqywza9ma5",
+    "sha256bin64": "0caf47xam5igdnbhipal1iyicnxxvadhi61k199rwysrvyv5sdad",
    "deps": {
      "gn": {
-        "version": "2021-02-09",
+        "version": "2021-04-06",
        "url": "https://gn.googlesource.com/gn",
-        "rev": "dfcbc6fed0a8352696f92d67ccad54048ad182b3",
-        "sha256": "1941bzg37c4dpsk3sh6ga3696gpq6vjzpcw9rsnf6kdr9mcgdxvn"
+        "rev": "dba01723a441c358d843a575cb7720d54ddcdf92",
+        "sha256": "199xkks67qrn0xa5fhp24waq2vk8qb78a96cb3kdd8v1hgacgb8x"
      }
    },
    "chromedriver": {
-      "version": "90.0.4430.24",
-      "sha256_linux": "0byibxrs4ggid8qn5h72mmnw8l4y8xya2q1jbc6z74pmw8r9hkj7",
-      "sha256_darwin": "0psll7vahj43jkj1wqq7mygf18l7ivp56ckc8wv4w5bnfmqv660k"
+      "version": "91.0.4472.19",
+      "sha256_linux": "0pg9y55644i87qxa0983lvfizbmfiak9bg9249xhifl5kykghrb2",
+      "sha256_darwin": "07v5k07100vrzsbm6r59xg8j80ffzs3gnnf2kcfgqrzprx284gf2"
    }
  },
  "beta": {
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -440,10 +440,10 @@
    "owner": "DeterminateSystems",
    "provider-source-address": "registry.terraform.io/DeterminateSystems/hydra",
    "repo": "terraform-provider-hydra",
-    "rev": "v0.1.0",
-    "sha256": "18c9j54fy1f2sfz317rlv8z7fb18bpc1a0baw1bgl72x5sgil5kv",
+    "rev": "v0.1.2",
+    "sha256": "1a1ah5pzng9ik8f18kqx87fdh1c5wqbn2bsbhqrzd1nb8fc5xl03",
    "vendorSha256": null,
-    "version": "0.1.0"
+    "version": "0.1.2"
  },
  "ibm": {
    "owner": "IBM-Cloud",
--- a/pkgs/applications/networking/feedreaders/newsflash/default.nix
+++ b/pkgs/applications/networking/feedreaders/newsflash/default.nix
@ -35,6 +35,12 @@ stdenv.mkDerivation rec {
    hash = "sha256-qq8cZplt5YWUwsXUShMDhQm3RGH2kCEBk64x6bOa50E=";
  };

+  # https://github.com/CasualX/obfstr/blob/v0.2.4/build.rs#L5
+  # obfstr 0.2.4 fails to set RUSTC_BOOTSTRAP in its build script because cargo
+  # build scripts are forbidden from setting RUSTC_BOOTSTRAP since rustc 1.52.0
+  # https://github.com/rust-lang/rust/blob/1.52.0/RELEASES.md#compatibility-notes
+  RUSTC_BOOTSTRAP = 1;
+
  patches = [
    # Post install tries to generate an icon cache & update the
    # desktop database. The gtk setup hook drop-icon-theme-cache.sh
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json
@ -2,7 +2,7 @@
  "name": "element-desktop",
  "productName": "Element",
  "main": "src/electron-main.js",
-  "version": "1.7.28",
+  "version": "1.7.29",
  "description": "A feature-rich client for Matrix.org",
  "author": "Element",
  "repository": {
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
@ -8,12 +8,12 @@

 let
  executableName = "element-desktop";
-  version = "1.7.28";
+  version = "1.7.29";
  src = fetchFromGitHub {
    owner = "vector-im";
    repo = "element-desktop";
    rev = "v${version}";
-    sha256 = "0p88gw1y37q35qqf94w3qlb84s2shm41n1pw5fgx0c0ymlzpl636";
+    sha256 = "sha256-nCtgVVOdjZ/OK8gMInBbNeuJadchDYUO2UQxEmcOm4s=";
  };
 in mkYarnPackage rec {
  name = "element-desktop-${version}";
@ -45,8 +45,7 @@ in mkYarnPackage rec {

    # executable wrapper
    makeWrapper '${electron}/bin/electron' "$out/bin/${executableName}" \
-      --add-flags "$out/share/element/electron" \
-      --set-default MOZ_DBUS_REMOTE 1
+      --add-flags "$out/share/element/electron"
  '';

  # Do not attempt generating a tarball for element-web again.
--- a/pkgs/applications/networking/instant-messengers/element/element-web.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-web.nix
@ -12,11 +12,11 @@ let

 in stdenv.mkDerivation rec {
  pname = "element-web";
-  version = "1.7.28";
+  version = "1.7.29";

  src = fetchurl {
    url = "https://github.com/vector-im/element-web/releases/download/v${version}/element-v${version}.tar.gz";
-    sha256 = "1adlpwq37yzmd3fq1pzbi476p4kr5hn5b5kwyd6cr5by0gsgkgyk";
+    sha256 = "sha256-wFC0B9v0V3JK9sLKH7GviVO/JEjePOJ06PwRq/MVqDE=";
  };

  installPhase = ''
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/db-reencryption-wrapper.py
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/db-reencryption-wrapper.py
@ -1,92 +0,0 @@
-#!@PYTHON@
-
-import json
-import os
-import re
-import shlex
-import sqlite3
-import subprocess
-import sys
-
-
-DB_PATH = os.path.join(os.environ['HOME'], '.config/Signal/sql/db.sqlite')
-DB_COPY = os.path.join(os.environ['HOME'], '.config/Signal/sql/db.tmp')
-CONFIG_PATH = os.path.join(os.environ['HOME'], '.config/Signal/config.json')
-
-
-def zenity_askyesno(title, text):
-    args = [
-        '@ZENITY@',
-        '--question',
-        '--title',
-        shlex.quote(title),
-        '--text',
-        shlex.quote(text)
-    ]
-    return subprocess.run(args).returncode == 0
-
-
-def start_signal():
-    os.execvp('@SIGNAL-DESKTOP@', ['@SIGNAL-DESKTOP@'] + sys.argv[1:])
-
-
-def copy_pragma(name):
-    result = subprocess.run([
-        '@SQLCIPHER@',
-        DB_PATH,
-        f"PRAGMA {name};"
-    ], check=True, capture_output=True).stdout
-    result = re.search(r'[0-9]+', result.decode()).group(0)
-    subprocess.run([
-        '@SQLCIPHER@',
-        DB_COPY,
-        f"PRAGMA key = \"x'{key}'\"; PRAGMA {name} = {result};"
-    ], check=True, capture_output=True)
-
-
-try:
-    # Test if DB is encrypted:
-    con = sqlite3.connect(f'file:{DB_PATH}?mode=ro', uri=True)
-    cursor = con.cursor()
-    cursor.execute("SELECT name FROM sqlite_master WHERE type='table';")
-    con.close()
-except:
-    # DB is encrypted, everything ok:
-    start_signal()
-
-
-# DB is unencrypted!
-answer = zenity_askyesno(
-        "Error: Signal-Desktop database is not encrypted",
-        "Should we try to fix this automatically?"
-        + "You likely want to backup ~/.config/Signal/ first."
-)
-if not answer:
-    answer = zenity_askyesno(
-            "Launch Signal-Desktop",
-            "DB is unencrypted, should we still launch Signal-Desktop?"
-            + "Warning: This could result in data loss!"
-    )
-    if not answer:
-        print('Aborted')
-        sys.exit(0)
-    start_signal()
-
-# Re-encrypt the DB:
-with open(CONFIG_PATH) as json_file:
-    key = json.load(json_file)['key']
-result = subprocess.run([
-    '@SQLCIPHER@',
-    DB_PATH,
-    f" ATTACH DATABASE '{DB_COPY}' AS signal_db KEY \"x'{key}'\";"
-    + " SELECT sqlcipher_export('signal_db');"
-    + " DETACH DATABASE signal_db;"
-]).returncode
-if result != 0:
-    print('DB encryption failed')
-    sys.exit(1)
-# Need to copy user_version and schema_version manually:
-copy_pragma('user_version')
-copy_pragma('schema_version')
-os.rename(DB_COPY, DB_PATH)
-start_signal()
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@ -10,9 +10,6 @@
 , hunspellDicts, spellcheckerLanguage ? null # E.g. "de_DE"
 # For a full list of available languages:
 # $ cat pkgs/development/libraries/hunspell/dictionaries.nix | grep "dictFileName =" | awk '{ print $3 }'
-, python3
-, gnome
-, sqlcipher
 }:

 let
@ -28,7 +25,7 @@ let
      else "");
 in stdenv.mkDerivation rec {
  pname = "signal-desktop";
-  version = "5.2.1"; # Please backport all updates to the stable channel.
+  version = "5.3.0"; # Please backport all updates to the stable channel.
  # All releases have a limited lifetime and "expire" 90 days after the release.
  # When releases "expire" the application becomes unusable until an update is
  # applied. The expiration date for the current release can be extracted with:
@ -38,7 +35,7 @@ in stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "0hkl8h49565kncvczv5fv4gak55lycygwb8i8igkgc4my0ykzs2z";
+    sha256 = "15lclxw3njih90zlh2n90v8ljg0wnglw5w8jrpa7rbd789yagvq7";
  };

  nativeBuildInputs = [
@ -115,7 +112,7 @@ in stdenv.mkDerivation rec {

    # Symlink to bin
    mkdir -p $out/bin
-    ln -s $out/lib/Signal/signal-desktop $out/bin/signal-desktop-unwrapped
+    ln -s $out/lib/Signal/signal-desktop $out/bin/signal-desktop

    runHook postInstall
  '';
@ -137,17 +134,7 @@ in stdenv.mkDerivation rec {
      --replace /opt/Signal/signal-desktop $out/bin/signal-desktop

    autoPatchelf --no-recurse -- $out/lib/Signal/
-    patchelf --add-needed ${libpulseaudio}/lib/libpulse.so $out/lib/Signal/resources/app.asar.unpacked/node_modules/ringrtc/build/linux/libringrtc.node
-  '';
-
-  postFixup = ''
-    # This hack is temporarily required to avoid data-loss for users:
-    cp ${./db-reencryption-wrapper.py} $out/bin/signal-desktop
-    substituteInPlace $out/bin/signal-desktop \
-      --replace '@PYTHON@' '${python3}/bin/python3' \
-      --replace '@ZENITY@' '${gnome.zenity}/bin/zenity' \
-      --replace '@SQLCIPHER@' '${sqlcipher}/bin/sqlcipher' \
-      --replace '@SIGNAL-DESKTOP@' "$out/bin/signal-desktop-unwrapped"
+    patchelf --add-needed ${libpulseaudio}/lib/libpulse.so $out/lib/Signal/resources/app.asar.unpacked/node_modules/ringrtc/build/linux/libringrtc-x64.node
  '';

  # Tests if the application launches and waits for "Link your phone to Signal Desktop":
--- a/pkgs/applications/networking/irc/catgirl/default.nix
+++ b/pkgs/applications/networking/irc/catgirl/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "catgirl";
-  version = "1.7";
+  version = "1.8";

  src = fetchurl {
    url = "https://git.causal.agency/catgirl/snapshot/${pname}-${version}.tar.gz";
-    sha256 = "sha256-3shSdeq4l6Y5DEJZEVMHAngp6vjnkPjzpLpcp407X/0=";
+    sha256 = "0svpd2nqsr55ac98vczyhihs6pvgw7chspf6bdlwl98gch39dxif";
  };

  nativeBuildInputs = [ ctags pkg-config ];
--- a/pkgs/applications/office/libreoffice/src-still/download.nix
+++ b/pkgs/applications/office/libreoffice/src-still/download.nix
@ -721,25 +721,25 @@
    md5name = "505e70834d35383537b6491e7ae8641f1a4bed1876dbfe361201fc80868d88ca-libpng-1.6.37.tar.xz";
  }
  {
-    name = "poppler-0.82.0.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/poppler-0.82.0.tar.xz";
-    sha256 = "234f8e573ea57fb6a008e7c1e56bfae1af5d1adf0e65f47555e1ae103874e4df";
+    name = "poppler-21.01.0.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/poppler-21.01.0.tar.xz";
+    sha256 = "016dde34e5f868ea98a32ca99b643325a9682281500942b7113f4ec88d20e2f3";
    md5 = "";
-    md5name = "234f8e573ea57fb6a008e7c1e56bfae1af5d1adf0e65f47555e1ae103874e4df-poppler-0.82.0.tar.xz";
+    md5name = "016dde34e5f868ea98a32ca99b643325a9682281500942b7113f4ec88d20e2f3-poppler-21.01.0.tar.xz";
  }
  {
-    name = "postgresql-9.2.24.tar.bz2";
-    url = "https://dev-www.libreoffice.org/src/postgresql-9.2.24.tar.bz2";
-    sha256 = "a754c02f7051c2f21e52f8669a421b50485afcde9a581674d6106326b189d126";
+    name = "postgresql-13.1.tar.bz2";
+    url = "https://dev-www.libreoffice.org/src/postgresql-13.1.tar.bz2";
+    sha256 = "12345c83b89aa29808568977f5200d6da00f88a035517f925293355432ffe61f";
    md5 = "";
-    md5name = "a754c02f7051c2f21e52f8669a421b50485afcde9a581674d6106326b189d126-postgresql-9.2.24.tar.bz2";
+    md5name = "12345c83b89aa29808568977f5200d6da00f88a035517f925293355432ffe61f-postgresql-13.1.tar.bz2";
  }
  {
-    name = "Python-3.7.7.tar.xz";
-    url = "https://dev-www.libreoffice.org/src/Python-3.7.7.tar.xz";
-    sha256 = "06a0a9f1bf0d8cd1e4121194d666c4e28ddae4dd54346de6c343206599f02136";
+    name = "Python-3.7.10.tar.xz";
+    url = "https://dev-www.libreoffice.org/src/Python-3.7.10.tar.xz";
+    sha256 = "f8d82e7572c86ec9d55c8627aae5040124fd2203af400c383c821b980306ee6b";
    md5 = "";
-    md5name = "06a0a9f1bf0d8cd1e4121194d666c4e28ddae4dd54346de6c343206599f02136-Python-3.7.7.tar.xz";
+    md5name = "f8d82e7572c86ec9d55c8627aae5040124fd2203af400c383c821b980306ee6b-Python-3.7.10.tar.xz";
  }
  {
    name = "QR-Code-generator-1.4.0.tar.gz";
--- a/pkgs/applications/office/libreoffice/src-still/primary.nix
+++ b/pkgs/applications/office/libreoffice/src-still/primary.nix
@ -8,7 +8,7 @@ rec {

  major = "7";
  minor = "0";
-  patch = "4";
+  patch = "6";
  tweak = "2";

  subdir = "${major}.${minor}.${patch}";
@ -17,13 +17,13 @@ rec {

  src = fetchurl {
    url = "https://download.documentfoundation.org/libreoffice/src/${subdir}/libreoffice-${version}.tar.xz";
-    sha256 = "1g9akxvm7fh6lnprnc3g184qdy8gbinhb4rb60gjpw82ip6d5acz";
+    sha256 = "0bk1dc6g8z5akrprfxxy3dm0vdmihaaxnsprxpqbqmqrqzkzg8cn";
  };

  # FIXME rename
  translations = fetchSrc {
    name = "translations";
-    sha256 = "1v3kpk56fm783d5wihx41jqidpclizkfxrg4n0pq95d79hdiljsl";
+    sha256 = "04f76r311hppil656ajab52x0xwqszazlgssyi5w97wak2zkmqgj";
  };

  # the "dictionaries" archive is not used for LO build because we already build hunspellDicts packages from
@ -31,6 +31,6 @@ rec {

  help = fetchSrc {
    name = "help";
-    sha256 = "1np9f799ww12kggl5az6piv5fi9rf737il5a5r47r4wl2li56qqb";
+    sha256 = "1xmvlj9nrmg8448k4zfaxn5qqxa4amnvvhs1l1smi2bz3xh4xn2d";
  };
 }
--- a/pkgs/applications/office/paperwork/paperwork-gtk.nix
+++ b/pkgs/applications/office/paperwork/paperwork-gtk.nix
@ -13,10 +13,24 @@
 , gettext
 , gobject-introspection
 , gdk-pixbuf
+, texlive
+, imagemagick
+, perlPackages
 }:

+let
+  documentation_deps = [
+    (texlive.combine {
+      inherit (texlive) scheme-small wrapfig was;
+    })
+    xvfb-run
+    imagemagick
+    perlPackages.Po4a
+  ];
+in
+
 python3Packages.buildPythonApplication rec {
-  inherit (import ./src.nix { inherit fetchFromGitLab; }) version src;
+  inherit (import ./src.nix { inherit fetchFromGitLab; }) version src sample_documents;
  pname = "paperwork";

  sourceRoot = "source/paperwork-gtk";
@ -52,9 +66,16 @@ python3Packages.buildPythonApplication rec {
    for i in $site/data/paperwork_*.png; do
      ln -s $i $site/icon/out;
    done
+
+    export XDG_DATA_DIRS=$XDG_DATA_DIRS:${gnome.adwaita-icon-theme}/share
+    # build the user manual
+    PATH=$out/bin:$PATH PAPERWORK_TEST_DOCUMENTS=${sample_documents} make data
+    for i in src/paperwork_gtk/model/help/out/*.pdf; do
+      install -Dt $site/model/help/out $i
+    done
  '';

-  checkInputs = [ xvfb-run dbus.daemon ];
+  checkInputs = [ dbus.daemon ];

  nativeBuildInputs = [
    wrapGAppsHook
@ -62,7 +83,7 @@ python3Packages.buildPythonApplication rec {
    (lib.getBin gettext)
    which
    gdk-pixbuf # for the setup hook
-  ];
+  ] ++ documentation_deps;

  buildInputs = [
    gnome.adwaita-icon-theme
@ -78,13 +99,20 @@ python3Packages.buildPythonApplication rec {
    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
  '';

-  # A few parts of chkdeps need to have a display and a dbus session, so we not
-  # only need to run a virtual X server + dbus but also have a large enough
-  # resolution, because the Cairo test tries to draw a 200x200 window.
-  preCheck = ''
+  checkPhase = ''
+    runHook preCheck
+
+    # A few parts of chkdeps need to have a display and a dbus session, so we not
+    # only need to run a virtual X server + dbus but also have a large enough
+    # resolution, because the Cairo test tries to draw a 200x200 window.
    xvfb-run -s '-screen 0 800x600x24' dbus-run-session \
      --config-file=${dbus.daemon}/share/dbus-1/session.conf \
      $out/bin/paperwork-gtk chkdeps
+
+    # content of make test, without the dep on make install
+    python -m unittest discover --verbose -s tests
+
+    runHook postCheck
  '';

  propagatedBuildInputs = with python3Packages; [
@ -98,6 +126,8 @@ python3Packages.buildPythonApplication rec {
    setuptools
  ];

+  disallowedRequisites = documentation_deps;
+
  meta = {
    description = "A personal document manager for scanned documents";
    homepage = "https://openpaper.work/";
--- a/pkgs/applications/office/paperwork/src.nix
+++ b/pkgs/applications/office/paperwork/src.nix
@ -1,12 +1,22 @@
 {fetchFromGitLab}:
 rec {
-  version = "2.0.2";
+  version = "2.0.3";
  src = fetchFromGitLab {
    domain = "gitlab.gnome.org";
    repo = "paperwork";
    group = "World";
    owner = "OpenPaperwork";
    rev = version;
-    sha256 = "1di7nnl8ywyiwfpl5m1kvip1m0hvijbmqmkdpviwqw7ajizrr1ly";
+    sha256 = "02c2ysca75j59v87n1axqfncvs167kmdr40m0f05asdh2akwrbi9";
  };
+  sample_documents = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    repo = "paperwork-test-documents";
+    group = "World";
+    owner = "OpenPaperwork";
+    # https://gitlab.gnome.org/World/OpenPaperwork/paperwork/-/blob/master/paperwork-gtk/src/paperwork_gtk/model/help/screenshot.sh see TEST_DOCS_TAG
+    rev = "1.0";
+    sha256 = "155nhw2jmlgfi6c3wm241vrr3yma6lw85k9lxn844z96kyi7wbpr";
+  };
+
 }
--- a/pkgs/applications/office/softmaker/softmaker_office.nix
+++ b/pkgs/applications/office/softmaker/softmaker_office.nix
@ -6,9 +6,9 @@
  # Softmaker Office or when the upstream archive was replaced and
  # nixpkgs is not in sync yet.
 , officeVersion ? {
-  version = "1030";
+  version = "1032";
  edition = "2021";
-  hash = "sha256-bpnyPyZnJc9RFVrFM2o3M7Gc4PSKFGpaM1Yo8ZKGHrE=";
+  hash = "sha256-LchSqLVBdkmWJQ8hCEvtwRPgIUSDE0URKPzCkEexGbc=";
 }

 , ... } @ args:
--- a/pkgs/applications/radio/welle-io/default.nix
+++ b/pkgs/applications/radio/welle-io/default.nix
@ -1,20 +1,17 @@
 { mkDerivation, lib, fetchFromGitHub, cmake, pkg-config
 , qtbase, qtcharts, qtmultimedia, qtquickcontrols, qtquickcontrols2, qtgraphicaleffects
-, faad2, rtl-sdr, soapysdr-with-plugins, libusb-compat-0_1, fftwSinglePrec, lame, mpg123 }:
-let
-
-  version = "2.2";
-
-in mkDerivation {
+, faad2, rtl-sdr, soapysdr-with-plugins, libusb-compat-0_1, fftwSinglePrec, lame, mpg123
+} :

+mkDerivation rec {
  pname = "welle-io";
-  inherit version;
+  version = "2.3";

  src = fetchFromGitHub {
    owner = "AlbrechtL";
    repo = "welle.io";
    rev = "v${version}";
-    sha256 = "04fpm6sc431dl9i5h53xpd6k85j22sv8aawl7b6wv2fzpfsd9fwa";
+    sha256 = "1xl1lanw0xgmgks67dbfb2h52jxnrd1i2zik56v0q8dwsr7f0daw";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@ -7,7 +7,11 @@ stdenv.mkDerivation rec {
  src = fetchFromGitHub {
    owner  = "leanprover-community";
    repo   = "lean";
-    rev    = "v${version}";
+    # lean's version string contains the commit sha1 it was built
+    # from. this is then used to check whether an olean file should be
+    # rebuilt. don't use a tag as rev because this will get replaced into
+    # src/githash.h.in in preConfigure.
+    rev    = "a5822ea47ebc52eec6323d8f1b60f6ec025daf99";
    sha256 = "sha256-gJhbkl19iilNyfCt2TfPmghYA3yCjg6kS+yk/x/k14Y=";
  };

@ -20,6 +24,13 @@ stdenv.mkDerivation rec {
  # library.
  doCheck = true;

+  preConfigure = assert builtins.stringLength src.rev == 40; ''
+     substituteInPlace src/githash.h.in \
+       --subst-var-by GIT_SHA1 "${src.rev}"
+     substituteInPlace library/init/version.lean.in \
+       --subst-var-by GIT_SHA1 "${src.rev}"
+  '';
+
  postPatch = "patchShebangs .";

  postInstall = lib.optionalString stdenv.isDarwin ''
--- a/pkgs/applications/version-management/git-and-tools/delta/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/delta/default.nix
@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "delta";
-  version = "0.7.1";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "dandavison";
    repo = pname;
    rev = version;
-    sha256 = "02gm3fxqq91gn1hffy9kc6dkc0y7p09sl6f8njfpsaficij4bs7a";
+    sha256 = "01s73ld3npdmrjbay1lmd13bn9lg2pbmj14gklxi3j9aj0y2q8w8";
  };

-  cargoSha256 = "1w1w98vhjd561mkiwv89zb8k0nf1p5fc67jb5dddwg9nj6mqjrhp";
+  cargoSha256 = "1pi4sm07nm1irigrfgysfw99vw96zzz07a1qw5m7bmj6aqp0r3fr";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/applications/version-management/git-repo/default.nix
+++ b/pkgs/applications/version-management/git-repo/default.nix
@ -1,10 +1,10 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper
+{ lib, stdenv, fetchFromGitHub, makeWrapper, nix-update-script
 , python3, git, gnupg, less
 }:

 stdenv.mkDerivation rec {
  pname = "git-repo";
-  version = "2.14.5";
+  version = "2.15.3";

  src = fetchFromGitHub {
    owner = "android";
@ -13,8 +13,6 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-3FSkWpHda1jVhy/633B+ippWcbKd83IlQcJYS9Qx5wQ=";
  };

-  patches = [ ./import-ssl-module.patch ];
-
  nativeBuildInputs = [ makeWrapper ];
  buildInputs = [ python3 ];

@ -25,8 +23,12 @@ stdenv.mkDerivation rec {
  '';

  installPhase = ''
+    runHook preInstall
+
    mkdir -p $out/bin
    cp repo $out/bin/repo
+
+    runHook postInstall
  '';

  # Important runtime dependencies
@ -35,6 +37,12 @@ stdenv.mkDerivation rec {
      "${lib.makeBinPath [ git gnupg less ]}"
  '';

+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "gitRepo";
+    };
+  };
+
  meta = with lib; {
    description = "Android's repo management tool";
    longDescription = ''
@ -45,7 +53,7 @@ stdenv.mkDerivation rec {
    '';
    homepage = "https://android.googlesource.com/tools/repo";
    license = licenses.asl20;
-    maintainers = [ ];
+    maintainers = with maintainers; [ otavio ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/applications/version-management/git-repo/import-ssl-module.patch
+++ b/pkgs/applications/version-management/git-repo/import-ssl-module.patch
@ -1,12 +0,0 @@
-diff --git a/repo b/repo
-index 8b05def..f394b3e 100755
--- a/repo
-+++ b/repo
-@@ -236,6 +236,7 @@ import optparse
- import re
- import shutil
- import stat
-+import ssl
- 
- if sys.version_info[0] == 3:
-   import urllib.request
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,13 +1,13 @@
 {
-  "version": "13.11.2",
-  "repo_hash": "0xian17q8h5qdcvndyd27w278zqi3455svwycqfcv830g27c0csh",
+  "version": "13.12.0",
+  "repo_hash": "060bmfvpqh6zdrwdh4lx4xr1nbg0f7hcp8zh6k9qplv48szhj8m9",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v13.11.2-ee",
+  "rev": "v13.12.0-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "13.11.2",
-    "GITLAB_PAGES_VERSION": "1.38.0",
-    "GITLAB_SHELL_VERSION": "13.17.0",
-    "GITLAB_WORKHORSE_VERSION": "13.11.2"
+    "GITALY_SERVER_VERSION": "13.12.0",
+    "GITLAB_PAGES_VERSION": "1.39.0",
+    "GITLAB_SHELL_VERSION": "13.18.0",
+    "GITLAB_WORKHORSE_VERSION": "13.12.0"
  }
 }
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@ -125,15 +125,6 @@ stdenv.mkDerivation {
  patches = [
    # Change hardcoded paths to the NixOS equivalent
    ./remove-hardcoded-locations.patch
-
-    # Use the exactly 32 byte long version of db_key_base with
-    # aes-256-gcm, see
-    # https://gitlab.com/gitlab-org/gitlab/-/merge_requests/53602
-    (fetchpatch {
-      name = "secrets_db_key_base_length.patch";
-      url = "https://gitlab.com/gitlab-org/gitlab/-/commit/a5c78650441c31a522b18e30177c717ffdd7f401.patch";
-      sha256 = "1qcxr5f59slgzmpcbiwabdhpz1lxnq98yngg1xkyihk2zhv0g1my";
-    })
  ];

  postPatch = ''
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -21,17 +21,17 @@ let
      };
  };
 in buildGoModule rec {
-  version = "13.11.2";
+  version = "13.12.0";
  pname = "gitaly";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitaly";
    rev = "v${version}";
-    sha256 = "sha256-qcrvNmnlrdJYXAlt65bA0Ij7zuX7QwVukC3A4KGL3sk=";
+    sha256 = "sha256-MGK0WjAeqApf2xUsbF1mtyzYMhJHC5LFtj8LSb0NQKI=";
  };

-  vendorSha256 = "sha256-VAXQPVyB+XdfOqGaT1H/83ed6xV+4Tr5fkBu1eyPe2k=";
+  vendorSha256 = "sha256-drS0L0olEFHYJVC0VYwEZeNYa8fjwrfxlhrEQa4pqzY=";

  passthru = {
    inherit rubyEnv;
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@ -2,19 +2,19 @@

 buildGoModule rec {
  pname = "gitlab-shell";
-  version = "13.17.0";
+  version = "13.18.0";
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-shell";
    rev = "v${version}";
-    sha256 = "sha256-j/80AIIJdRSisu2fNXcqazb4oIzAQP5CfxHX3l6yijY=";
+    sha256 = "sha256-TPe2quDg/ljI2v1HciDajosSPm4Z/iT2skeveNdrKdo=";
  };

  buildInputs = [ ruby ];

  patches = [ ./remove-hardcoded-locations.patch ];

-  vendorSha256 = "sha256-/jJTMtS5fcbQroWuaPPfvYxy6znNS0FOXVN7IcE/spQ=";
+  vendorSha256 = "sha256-MvWpZ/Z9ieNE0+p975BG302BPzFbCZD3cACXMW5fiTQ=";

  postInstall = ''
    cp -r "$NIX_BUILD_TOP/source"/bin/* $out/bin
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -5,7 +5,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "13.11.2";
+  version = "13.12.0";

  src = fetchFromGitLab {
    owner = data.owner;
@ -16,7 +16,7 @@ buildGoModule rec {

  sourceRoot = "source/workhorse";

-  vendorSha256 = "sha256-m/Mx4Nr4tPK6yfcHxAFbjh9DI/1WnKReaaylWpNSrc8=";
+  vendorSha256 = "sha256-JJN1KqqbP4fIW/k6LebIaWdYOmIzHqxCDgOKrkbB7Nw=";
  buildInputs = [ git ];
  buildFlagsArray = "-ldflags=-X main.Version=${version}";
  doCheck = false;
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@ -18,11 +18,14 @@ gem 'default_value_for', '~> 3.4.0'
 gem 'pg', '~> 1.1'

 gem 'rugged', '~> 1.1'
-gem 'grape-path-helpers', '~> 1.6.1'
+gem 'grape-path-helpers', '~> 1.6.3'

 gem 'faraday', '~> 1.0'
 gem 'marginalia', '~> 1.10.0'

+# Authorization
+gem 'declarative_policy', '~> 1.0.0'
+
 # Authentication libraries
 gem 'devise', '~> 4.7.2'
 gem 'bcrypt', '~> 3.1', '>= 3.1.14'
@ -46,7 +49,7 @@ gem 'omniauth-shibboleth', '~> 1.3.0'
 gem 'omniauth-twitter', '~> 1.4'
 gem 'omniauth_crowd', '~> 2.4.0'
 gem 'omniauth-authentiq', '~> 0.3.3'
-gem 'omniauth_openid_connect', '~> 0.3.5'
+gem 'gitlab-omniauth-openid-connect', '~> 0.4.0', require: 'omniauth_openid_connect'
 gem 'omniauth-salesforce', '~> 1.0.5'
 gem 'omniauth-atlassian-oauth2', '~> 0.2.0'
 gem 'rack-oauth2', '~> 1.16.0'
@ -89,7 +92,7 @@ gem 'net-ldap', '~> 0.16.3'

 # API
 gem 'grape', '~> 1.5.2'
-gem 'grape-entity', '~> 0.7.1'
+gem 'grape-entity', '~> 0.9.0'
 gem 'rack-cors', '~> 1.0.6', require: 'rack/cors'

 # GraphQL API
@ -264,7 +267,7 @@ gem 'kubeclient', '~> 4.9.1'

 # Sanitize user input
 gem 'sanitize', '~> 5.2.1'
-gem 'babosa', '~> 1.0.2'
+gem 'babosa', '~> 1.0.4'

 # Sanitizes SVG input
 gem 'loofah', '~> 2.2'
@ -297,7 +300,7 @@ gem 'gon', '~> 6.4.0'
 gem 'request_store', '~> 1.5'
 gem 'base32', '~> 0.3.0'

-gem "gitlab-license", "~> 1.4"
+gem 'gitlab-license', '~> 1.5'

 # Protect against bruteforcing
 gem 'rack-attack', '~> 6.3.0'
@ -306,12 +309,12 @@ gem 'rack-attack', '~> 6.3.0'
 gem 'sentry-raven', '~> 3.0'

 # PostgreSQL query parsing
-gem 'pg_query', '~> 1.3.0'
+gem 'pg_query', '~> 2.0.3'

 gem 'premailer-rails', '~> 1.10.3'

 # LabKit: Tracing and Correlation
-gem 'gitlab-labkit', '~> 0.16.2'
+gem 'gitlab-labkit', '~> 0.17.1'
 # Thrift is a dependency of gitlab-labkit, we want a version higher than 0.14.0
 # because of https://gitlab.com/gitlab-org/gitlab/-/issues/321900
 gem 'thrift', '>= 0.14.0'
@ -343,6 +346,7 @@ end

 group :development do
  gem 'lefthook', '~> 0.7.0', require: false
+  gem 'solargraph', '~> 0.40.4', require: false

  gem 'letter_opener_web', '~> 1.4.0'

@ -356,9 +360,9 @@ end
 group :development, :test do
  gem 'deprecation_toolkit', '~> 1.5.1', require: false
  gem 'bullet', '~> 6.1.3'
-  gem 'gitlab-pry-byebug', platform: :mri, require: ['pry-byebug', 'pry-byebug/pry_remote_ext']
+  gem 'pry-byebug'
  gem 'pry-rails', '~> 0.3.9'
-  gem 'pry-remote'
+  gem 'pry-shell', '~> 0.4.0'

  gem 'awesome_print', require: false

@ -399,7 +403,7 @@ group :development, :test do
 end

 group :development, :test, :danger do
-  gem 'gitlab-dangerfiles', '~> 1.1.1', require: false
+  gem 'gitlab-dangerfiles', '~> 2.0.0', require: false
 end

 group :development, :test, :coverage do
@ -413,13 +417,12 @@ group :development, :test, :omnibus do
 end

 group :test do
-  gem 'json-schema', '~> 2.8.0'
  gem 'fuubar', '~> 2.2.0'
  gem 'rspec-retry', '~> 0.6.1'
  gem 'rspec_profiling', '~> 0.0.6'
  gem 'rspec-parameterized', require: false

-  gem 'capybara', '~> 3.34.0'
+  gem 'capybara', '~> 3.35.3'
  gem 'capybara-screenshot', '~> 1.0.22'
  gem 'selenium-webdriver', '~> 3.142'

@ -474,12 +477,15 @@ group :ed25519 do
  gem 'bcrypt_pbkdf', '~> 1.0'
 end

+# Spamcheck GRPC protocol definitions
+gem 'spamcheck', '~> 0.1.0'
+
 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 13.11.0.pre.rc1'
+gem 'gitaly', '~> 13.12.0.pre.rc1'

 gem 'grpc', '~> 1.30.2'

-gem 'google-protobuf', '~> 3.14.0'
+gem 'google-protobuf', '~> 3.15.8'

 gem 'toml-rb', '~> 1.0.0'

@ -488,7 +494,7 @@ gem 'flipper', '~> 0.17.1'
 gem 'flipper-active_record', '~> 0.17.1'
 gem 'flipper-active_support_cache_store', '~> 0.17.1'
 gem 'unleash', '~> 0.1.5'
-gem 'gitlab-experiment', '~> 0.5.3'
+gem 'gitlab-experiment', '~> 0.5.4'

 # Structured logging
 gem 'lograge', '~> 0.5'
@ -512,6 +518,7 @@ gem 'erubi', '~> 1.9.0'
 # See https://gitlab.com/gitlab-org/gitlab/issues/197386
 gem 'mail', '= 2.7.1'

+
 # File encryption
 gem 'lockbox', '~> 0.6.2'

--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
@ -125,11 +125,13 @@ GEM
      faraday_middleware (~> 1.0.0.rc1)
      net-http-persistent (~> 4.0)
      nokogiri (~> 1.11.0.rc2)
-    babosa (1.0.2)
+    babosa (1.0.4)
+    backport (1.1.2)
    base32 (0.3.2)
    batch-loader (2.0.1)
    bcrypt (3.1.16)
    bcrypt_pbkdf (1.0.0)
+    benchmark (0.1.1)
    benchmark-ips (2.3.0)
    benchmark-memory (0.1.2)
      memory_profiler (~> 0.9)
@ -153,13 +155,13 @@ GEM
      bundler (>= 1.2.0, < 3)
      thor (>= 0.18, < 2)
    byebug (11.1.3)
-    capybara (3.34.0)
+    capybara (3.35.3)
      addressable
      mini_mime (>= 0.1.3)
      nokogiri (~> 1.8)
      rack (>= 1.6.0)
      rack-test (>= 0.6.3)
-      regexp_parser (~> 1.5)
+      regexp_parser (>= 1.5, < 3.0)
      xpath (~> 3.2)
    capybara-screenshot (1.0.22)
      capybara (>= 1.0, < 4)
@ -238,6 +240,7 @@ GEM
      html-pipeline
    declarative (0.0.20)
    declarative-option (0.1.0)
+    declarative_policy (1.0.0)
    default_value_for (3.4.0)
      activerecord (>= 3.2.0, < 7.0)
    deprecation_toolkit (1.5.1)
@ -299,6 +302,7 @@ GEM
      dry-equalizer (~> 0.3)
      dry-inflector (~> 0.1, >= 0.1.2)
      dry-logic (~> 1.0, >= 1.0.2)
+    e2mmap (0.1.0)
    ecma-re-validator (0.2.1)
      regexp_parser (~> 1.2)
    ed25519 (1.2.4)
@ -428,7 +432,7 @@ GEM
      rails (>= 3.2.0)
    git (1.7.0)
      rchardet (~> 1.8)
-    gitaly (13.11.0.pre.rc1)
+    gitaly (13.12.0.pre.rc1)
      grpc (~> 1.0)
    github-markup (1.7.0)
    gitlab (4.16.1)
@ -436,10 +440,11 @@ GEM
      terminal-table (~> 1.5, >= 1.5.1)
    gitlab-chronic (0.10.5)
      numerizer (~> 0.2)
-    gitlab-dangerfiles (1.1.1)
+    gitlab-dangerfiles (2.0.0)
      danger-gitlab
-    gitlab-experiment (0.5.3)
+    gitlab-experiment (0.5.4)
      activesupport (>= 3.0)
+      request_store (>= 1.0)
      scientist (~> 1.6, >= 1.6.0)
    gitlab-fog-azure-rm (1.0.1)
      azure-storage-blob (~> 2.0)
@ -455,21 +460,22 @@ GEM
      fog-xml (~> 0.1.0)
      google-api-client (>= 0.44.2, < 0.51)
      google-cloud-env (~> 1.2)
-    gitlab-labkit (0.16.2)
+    gitlab-labkit (0.17.1)
      actionpack (>= 5.0.0, < 7.0.0)
      activesupport (>= 5.0.0, < 7.0.0)
      grpc (~> 1.19)
      jaeger-client (~> 1.1)
      opentracing (~> 0.4)
-      pg_query (~> 1.3)
+      pg_query (~> 2.0)
      redis (> 3.0.0, < 5.0.0)
-    gitlab-license (1.4.0)
+    gitlab-license (1.5.0)
    gitlab-mail_room (0.0.9)
    gitlab-markup (1.7.1)
    gitlab-net-dns (0.9.1)
-    gitlab-pry-byebug (3.9.0)
-      byebug (~> 11.0)
-      pry (~> 0.13.0)
+    gitlab-omniauth-openid-connect (0.4.0)
+      addressable (~> 2.7)
+      omniauth (~> 1.9)
+      openid_connect (~> 1.2)
    gitlab-sidekiq-fetcher (0.5.6)
      sidekiq (~> 5)
    gitlab-styles (6.2.0)
@ -503,9 +509,9 @@ GEM
      signet (~> 0.12)
    google-cloud-env (1.4.0)
      faraday (>= 0.17.3, < 2.0)
-    google-protobuf (3.14.0)
-    googleapis-common-protos-types (1.0.5)
-      google-protobuf (~> 3.11)
+    google-protobuf (3.15.8)
+    googleapis-common-protos-types (1.0.6)
+      google-protobuf (~> 3.14)
    googleauth (0.14.0)
      faraday (>= 0.17.3, < 2.0)
      jwt (>= 1.4, < 3.0)
@ -522,10 +528,10 @@ GEM
      mustermann-grape (~> 1.0.0)
      rack (>= 1.3.0)
      rack-accept
-    grape-entity (0.7.1)
-      activesupport (>= 4.0)
+    grape-entity (0.9.0)
+      activesupport (>= 3.0.0)
      multi_json (>= 1.3.2)
-    grape-path-helpers (1.6.1)
+    grape-path-helpers (1.6.3)
      activesupport
      grape (~> 1.3)
      rake (> 12)
@ -626,6 +632,7 @@ GEM
    jaeger-client (1.1.0)
      opentracing (~> 0.3)
      thrift
+    jaro_winkler (1.5.4)
    jira-ruby (2.1.4)
      activesupport
      atlassian-jwt
@ -641,8 +648,6 @@ GEM
      activesupport (>= 4.2)
      aes_key_wrap
      bindata
-    json-schema (2.8.1)
-      addressable (>= 2.4)
    json_schemer (0.2.12)
      ecma-re-validator (~> 0.2)
      hana (~> 1.3)
@ -863,12 +868,8 @@ GEM
      activesupport
      nokogiri (>= 1.4.4)
      omniauth (~> 1.0)
-    omniauth_openid_connect (0.3.5)
-      addressable (~> 2.5)
-      omniauth (~> 1.9)
-      openid_connect (~> 1.1)
    open4 (1.3.4)
-    openid_connect (1.1.8)
+    openid_connect (1.2.0)
      activemodel
      attr_required (>= 1.0.0)
      json-jwt (>= 1.5.0)
@ -890,10 +891,13 @@ GEM
    parser (3.0.0.0)
      ast (~> 2.4.1)
    parslet (1.8.2)
+    pastel (0.8.0)
+      tty-color (~> 0.5)
    peek (1.1.0)
      railties (>= 4.0.0)
    pg (1.2.3)
-    pg_query (1.3.0)
+    pg_query (2.0.3)
+      google-protobuf (~> 3.15.5)
    plist (3.6.0)
    png_quantizator (0.2.1)
    po_to_json (1.0.1)
@ -914,11 +918,15 @@ GEM
    pry (0.13.1)
      coderay (~> 1.1)
      method_source (~> 1.0)
+    pry-byebug (3.9.0)
+      byebug (~> 11.0)
+      pry (~> 0.13.0)
    pry-rails (0.3.9)
      pry (>= 0.10.4)
-    pry-remote (0.1.8)
-      pry (~> 0.9)
-      slop (~> 3.0)
+    pry-shell (0.4.0)
+      pry (~> 0.13.0)
+      tty-markdown
+      tty-prompt
    public_suffix (4.0.6)
    puma (5.1.1)
      nio4r (~> 2.0)
@ -1184,9 +1192,24 @@ GEM
    simplecov-html (0.12.2)
    sixarm_ruby_unaccent (1.2.0)
    slack-messenger (2.3.4)
-    slop (3.6.0)
    snowplow-tracker (0.6.1)
      contracts (~> 0.7, <= 0.11)
+    solargraph (0.40.4)
+      backport (~> 1.1)
+      benchmark
+      bundler (>= 1.17.2)
+      e2mmap
+      jaro_winkler (~> 1.5)
+      kramdown (~> 2.3)
+      kramdown-parser-gfm (~> 1.1)
+      parser (~> 3.0)
+      reverse_markdown (>= 1.0.5, < 3)
+      rubocop (>= 0.52)
+      thor (~> 1.0)
+      tilt (~> 2.0)
+      yard (~> 0.9, >= 0.9.24)
+    spamcheck (0.1.0)
+      grpc (~> 1.0)
    spring (2.1.1)
    spring-commands-rspec (1.0.4)
      spring (>= 0.9.1)
@ -1208,7 +1231,12 @@ GEM
    state_machines-activerecord (0.8.0)
      activerecord (>= 5.1)
      state_machines-activemodel (>= 0.8.0)
-    swd (1.1.2)
+    strings (0.2.1)
+      strings-ansi (~> 0.2)
+      unicode-display_width (>= 1.5, < 3.0)
+      unicode_utils (~> 1.4)
+    strings-ansi (0.2.0)
+    swd (1.2.0)
      activesupport (>= 3)
      attr_required (>= 0.0.5)
      httpclient (>= 2.4)
@ -1254,6 +1282,23 @@ GEM
    truncato (0.7.11)
      htmlentities (~> 4.3.1)
      nokogiri (>= 1.7.0, <= 2.0)
+    tty-color (0.6.0)
+    tty-cursor (0.7.1)
+    tty-markdown (0.7.0)
+      kramdown (>= 1.16.2, < 3.0)
+      pastel (~> 0.8)
+      rouge (~> 3.14)
+      strings (~> 0.2.0)
+      tty-color (~> 0.5)
+      tty-screen (~> 0.8)
+    tty-prompt (0.23.1)
+      pastel (~> 0.8)
+      tty-reader (~> 0.8)
+    tty-reader (0.9.0)
+      tty-cursor (~> 0.7)
+      tty-screen (~> 0.8)
+      wisper (~> 2.0)
+    tty-screen (0.8.1)
    tzinfo (1.2.9)
      thread_safe (~> 0.1)
    u2f (0.2.1)
@ -1322,12 +1367,14 @@ GEM
      builder
      expression_parser
      rinku
+    wisper (2.0.1)
    with_env (1.1.0)
    wmi-lite (1.0.5)
    xml-simple (1.1.5)
    xpath (3.2.0)
      nokogiri (~> 1.8)
    yajl-ruby (1.4.1)
+    yard (0.9.26)
    zeitwerk (2.4.2)

 PLATFORMS
@ -1353,7 +1400,7 @@ DEPENDENCIES
  aws-sdk-cloudformation (~> 1)
  aws-sdk-core (~> 3)
  aws-sdk-s3 (~> 1)
-  babosa (~> 1.0.2)
+  babosa (~> 1.0.4)
  base32 (~> 0.3.0)
  batch-loader (~> 2.0.1)
  bcrypt (~> 3.1, >= 3.1.14)
@ -1366,7 +1413,7 @@ DEPENDENCIES
  browser (~> 4.2)
  bullet (~> 6.1.3)
  bundler-audit (~> 0.7.0.1)
-  capybara (~> 3.34.0)
+  capybara (~> 3.35.3)
  capybara-screenshot (~> 1.0.22)
  carrierwave (~> 1.3)
  charlock_holmes (~> 0.7.7)
@ -1378,6 +1425,7 @@ DEPENDENCIES
  crystalball (~> 0.7.0)
  database_cleaner (~> 1.7.0)
  deckar01-task_list (= 2.3.1)
+  declarative_policy (~> 1.0.0)
  default_value_for (~> 3.4.0)
  deprecation_toolkit (~> 1.5.1)
  derailed_benchmarks
@ -1418,30 +1466,30 @@ DEPENDENCIES
  gettext (~> 3.3)
  gettext_i18n_rails (~> 1.8.0)
  gettext_i18n_rails_js (~> 1.3)
-  gitaly (~> 13.11.0.pre.rc1)
+  gitaly (~> 13.12.0.pre.rc1)
  github-markup (~> 1.7.0)
  gitlab-chronic (~> 0.10.5)
-  gitlab-dangerfiles (~> 1.1.1)
-  gitlab-experiment (~> 0.5.3)
+  gitlab-dangerfiles (~> 2.0.0)
+  gitlab-experiment (~> 0.5.4)
  gitlab-fog-azure-rm (~> 1.0.1)
  gitlab-fog-google (~> 1.13)
-  gitlab-labkit (~> 0.16.2)
-  gitlab-license (~> 1.4)
+  gitlab-labkit (~> 0.17.1)
+  gitlab-license (~> 1.5)
  gitlab-mail_room (~> 0.0.9)
  gitlab-markup (~> 1.7.1)
  gitlab-net-dns (~> 0.9.1)
-  gitlab-pry-byebug
+  gitlab-omniauth-openid-connect (~> 0.4.0)
  gitlab-sidekiq-fetcher (= 0.5.6)
  gitlab-styles (~> 6.2.0)
  gitlab_chronic_duration (~> 0.10.6.2)
  gitlab_omniauth-ldap (~> 2.1.1)
  gon (~> 6.4.0)
  google-api-client (~> 0.33)
-  google-protobuf (~> 3.14.0)
+  google-protobuf (~> 3.15.8)
  gpgme (~> 2.0.19)
  grape (~> 1.5.2)
-  grape-entity (~> 0.7.1)
-  grape-path-helpers (~> 1.6.1)
+  grape-entity (~> 0.9.0)
+  grape-path-helpers (~> 1.6.3)
  grape_logging (~> 1.7)
  graphiql-rails (~> 1.4.10)
  graphlient (~> 0.4.0)
@ -1465,7 +1513,6 @@ DEPENDENCIES
  jira-ruby (~> 2.1.4)
  js_regex (~> 3.4)
  json (~> 2.3.0)
-  json-schema (~> 2.8.0)
  json_schemer (~> 0.2.12)
  jwt (~> 2.1.0)
  kaminari (~> 1.0)
@ -1513,18 +1560,18 @@ DEPENDENCIES
  omniauth-shibboleth (~> 1.3.0)
  omniauth-twitter (~> 1.4)
  omniauth_crowd (~> 2.4.0)
-  omniauth_openid_connect (~> 0.3.5)
  org-ruby (~> 0.9.12)
  parallel (~> 1.19)
  parslet (~> 1.8)
  peek (~> 1.1)
  pg (~> 1.1)
-  pg_query (~> 1.3.0)
+  pg_query (~> 2.0.3)
  png_quantizator (~> 0.2.1)
  premailer-rails (~> 1.10.3)
  prometheus-client-mmap (~> 0.12.0)
+  pry-byebug
  pry-rails (~> 0.3.9)
-  pry-remote
+  pry-shell (~> 0.4.0)
  puma (~> 5.1.1)
  puma_worker_killer (~> 0.3.1)
  rack (~> 2.2.3)
@ -1579,6 +1626,8 @@ DEPENDENCIES
  simplecov-cobertura (~> 1.3.1)
  slack-messenger (~> 2.3.4)
  snowplow-tracker (~> 0.6.1)
+  solargraph (~> 0.40.4)
+  spamcheck (~> 0.1.0)
  spring (~> 2.1.0)
  spring-commands-rspec (~> 1.0.4)
  sprockets (~> 3.7.0)
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
@ -455,10 +455,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "05rgxg4pz4bc4xk34w5grv0yp1j94wf571w84lf3xgqcbs42ip2f";
+      sha256 = "16dwqn33kmxkqkv51cwiikdkbrdjfsymlnc0rgbjwilmym8a9phq";
      type = "gem";
    };
-    version = "1.0.2";
+    version = "1.0.4";
+  };
+  backport = {
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1xmjljpyx5ly078gi0lmmgkv4y0msxxa3hmv74bzxzp3l8qbn5vc";
+      type = "gem";
+    };
+    version = "1.1.2";
  };
  base32 = {
    groups = ["default"];
@ -500,6 +510,16 @@
    };
    version = "1.0.0";
  };
+  benchmark = {
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1jvrl7400fv7v2jjri1r7ilj3sri36hzipwwgpn5psib4c9c59c6";
+      type = "gem";
+    };
+    version = "0.1.1";
+  };
  benchmark-ips = {
    groups = ["development" "test"];
    platforms = [];
@ -636,10 +656,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1i1bm7r8n67cafd9p3ck7vdmng921b41n9znvlfaz7cy8a3gsrgm";
+      sha256 = "1viqcpsngy9fqjd68932m43ad6xj656d1x33nx9565q57chgi29k";
      type = "gem";
    };
-    version = "3.34.0";
+    version = "3.35.3";
  };
  capybara-screenshot = {
    dependencies = ["capybara" "launchy"];
@ -1014,6 +1034,16 @@
    };
    version = "0.1.0";
  };
+  declarative_policy = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0k2wl0jr0jq64gy7ibb1ipm2dzqil7y66vyffwx81g7sqchh7xh6";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
  default_value_for = {
    dependencies = ["activerecord"];
    groups = ["default"];
@ -1248,6 +1278,16 @@
    };
    version = "1.4.0";
  };
+  e2mmap = {
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0n8gxjb63dck3vrmsdcqqll7xs7f3wk78mw8w0gdk9wp5nx6pvj5";
+      type = "gem";
+    };
+    version = "0.1.0";
+  };
  ecma-re-validator = {
    dependencies = ["regexp_parser"];
    groups = ["default"];
@ -1851,10 +1891,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1hbc2frfyxxlar9ggpnl4x090nw1nlriazzkdgjz3r4mx4ihja1b";
+      sha256 = "1l0zq04lhqbzg0grca1c0p3a5gb9jdlhy41dhlgnrsaf7k6xads6";
      type = "gem";
    };
-    version = "13.11.0.pre.rc1";
+    version = "13.12.0.pre.rc1";
  };
  github-markup = {
    groups = ["default"];
@ -1894,21 +1934,21 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0ivkbq50fhm39zwyfac4q3y0qkrsk3hmrk1ggyhz1yphkq38qvq7";
+      sha256 = "0h40p9v034jczialkh4brrv7karrx6a95mhrfpfs17p800lighzz";
      type = "gem";
    };
-    version = "1.1.1";
+    version = "2.0.0";
  };
  gitlab-experiment = {
-    dependencies = ["activesupport" "scientist"];
+    dependencies = ["activesupport" "request_store" "scientist"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0ccjmm10pjvpzy5m7b86mxd2mg2x0k4y0c4cim0r4y7sy2c115mz";
+      sha256 = "18xc1785b9h0vwlqgi2m0mhjim6jaqqpi8nnl4hh8mbjd4d6kf1j";
      type = "gem";
    };
-    version = "0.5.3";
+    version = "0.5.4";
  };
  gitlab-fog-azure-rm = {
    dependencies = ["azure-storage-blob" "azure-storage-common" "fog-core" "fog-json" "mime-types" "ms_rest_azure"];
@ -1938,20 +1978,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0184rq6sal3xz4f0w5iaa5zf3q55i4dh0rlvr25l1g0s2imwr3fa";
+      sha256 = "1y1sk3xmxj14nzx7v2zgq4q4d5lh4v1pvhs03n03j3kp4fbrj469";
      type = "gem";
    };
-    version = "0.16.2";
+    version = "0.17.1";
  };
  gitlab-license = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1rfyxchshl2h0c2dpsy1wa751l02i22nv5mkhygfwnbi0ndkzqmg";
+      sha256 = "07qcbdrxqwbri0kgiamrvx9y7cii3smf94g6scgn2l369m6955x1";
      type = "gem";
    };
-    version = "1.4.0";
+    version = "1.5.0";
  };
  gitlab-mail_room = {
    groups = ["default"];
@ -1983,20 +2023,16 @@
    };
    version = "0.9.1";
  };
-  gitlab-pry-byebug = {
-    dependencies = ["byebug" "pry"];
-    groups = ["development" "test"];
-    platforms = [{
-      engine = "maglev";
-    } {
-      engine = "ruby";
-    }];
+  gitlab-omniauth-openid-connect = {
+    dependencies = ["addressable" "omniauth" "openid_connect"];
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0sp33vzzw8b7q9d8kb4pw8cl5fzlbffdpwz125x1g3kdiwz8xp3j";
+      sha256 = "16vbdyp2ml2i59xnpk0w5grh441kxcdpr639yzv69brjnrf3h9di";
      type = "gem";
    };
-    version = "3.9.0";
+    version = "0.4.0";
  };
  gitlab-sidekiq-fetcher = {
    dependencies = ["sidekiq"];
@ -2091,10 +2127,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0pbm2kjhxvazx9d5c071bxcjx5cbip6d2y36dii2a4558nqjd12p";
+      sha256 = "0d9ayd4c69iag9nny7yydjx6dw4ymd52x1kv917ngv3vmsdkv51x";
      type = "gem";
    };
-    version = "3.14.0";
+    version = "3.15.8";
  };
  googleapis-common-protos-types = {
    dependencies = ["google-protobuf"];
@ -2102,10 +2138,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1aava1b75n056s24gn7ajrkmm6s3xa3swl62dl5q9apw4marghji";
+      sha256 = "0074jk8fdl5rh7hfgx00n17sg493xrylkjkslx2d7cj5mk6hwn7d";
      type = "gem";
    };
-    version = "1.0.5";
+    version = "1.0.6";
  };
  googleauth = {
    dependencies = ["faraday" "jwt" "memoist" "multi_json" "os" "signet"];
@ -2146,10 +2182,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1w78wylkhdkc0s6n6d20hggbb3pl3ladzzd5lx6ack2iswybx7b9";
+      sha256 = "0sqk33djlyvkinj0vxblfcib86bk9dy0iq2c3j2yalxyrpns3kfr";
      type = "gem";
    };
-    version = "0.7.1";
+    version = "0.9.0";
  };
  grape-path-helpers = {
    dependencies = ["activesupport" "grape" "rake" "ruby2_keywords"];
@ -2157,10 +2193,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1xdp7b5fnvm89szy8ghpl6wm125iq7f0qnhibj5bxqrvg3xyhc2m";
+      sha256 = "1jbajciakiq9wwax2x11jzhmwzkcpkb4c0gfl01aj8a3l99gvgs9";
      type = "gem";
    };
-    version = "1.6.1";
+    version = "1.6.3";
  };
  grape_logging = {
    dependencies = ["grape" "rack"];
@ -2566,6 +2602,16 @@
    };
    version = "1.1.0";
  };
+  jaro_winkler = {
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1y8l6k34svmdyqxya3iahpwbpvmn3fswhwsvrz0nk1wyb8yfihsh";
+      type = "gem";
+    };
+    version = "1.5.4";
+  };
  jira-ruby = {
    dependencies = ["activesupport" "atlassian-jwt" "multipart-post" "oauth"];
    groups = ["default"];
@ -2619,17 +2665,6 @@
    };
    version = "1.13.0";
  };
-  json-schema = {
-    dependencies = ["addressable"];
-    groups = ["test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1yv5lfmr2nzd14af498xqd5p89f3g080q8wk0klr3vxgypsikkb5";
-      type = "gem";
-    };
-    version = "2.8.1";
-  };
  json_schemer = {
    dependencies = ["ecma-re-validator" "hana" "regexp_parser" "uri_template"];
    groups = ["default"];
@ -3620,17 +3655,6 @@
    };
    version = "2.4.0";
  };
-  omniauth_openid_connect = {
-    dependencies = ["addressable" "omniauth" "openid_connect"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1wxf52yggvwmyg6f9fiykh1sk51xx34i6x6m8f06ia56npslc4aw";
-      type = "gem";
-    };
-    version = "0.3.5";
-  };
  open4 = {
    groups = ["default" "development"];
    platforms = [];
@ -3647,10 +3671,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0r50vwf9hsf6r8gx5mwqs3w3w92l864ikiz9d0fcibqsr1489pbg";
+      sha256 = "1nqhgvq006h6crbp8lffw66ll46zf319c2637g4sybdclglismma";
      type = "gem";
    };
-    version = "1.1.8";
+    version = "1.2.0";
  };
  openssl = {
    groups = ["default"];
@ -3754,6 +3778,17 @@
    };
    version = "1.8.2";
  };
+  pastel = {
+    dependencies = ["tty-color"];
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0xash2gj08dfjvq4hy6l1z22s5v30fhizwgs10d6nviggpxsj7a8";
+      type = "gem";
+    };
+    version = "0.8.0";
+  };
  peek = {
    dependencies = ["railties"];
    groups = ["default"];
@ -3776,14 +3811,15 @@
    version = "1.2.3";
  };
  pg_query = {
+    dependencies = ["google-protobuf"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1i9l3y502ddm2lq3ajhxhqq17vs9hgxkxm443yw221ccibcfh6qf";
+      sha256 = "1mii63kgppy2zil2qn54c94z93b6ama6x7gq6rbv4xxlfk8ncrag";
      type = "gem";
    };
-    version = "1.3.0";
+    version = "2.0.3";
  };
  plist = {
    groups = ["default"];
@ -3884,6 +3920,17 @@
    };
    version = "0.13.1";
  };
+  pry-byebug = {
+    dependencies = ["byebug" "pry"];
+    groups = ["development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "096y5vmzpyy4x9h4ky4cs4y7d19vdq9vbwwrqafbh5gagzwhifiv";
+      type = "gem";
+    };
+    version = "3.9.0";
+  };
  pry-rails = {
    dependencies = ["pry"];
    groups = ["development" "test"];
@ -3895,16 +3942,16 @@
    };
    version = "0.3.9";
  };
-  pry-remote = {
-    dependencies = ["pry" "slop"];
+  pry-shell = {
+    dependencies = ["pry" "tty-markdown" "tty-prompt"];
    groups = ["development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "10g1wrkcy5v5qyg9fpw1cag6g5rlcl1i66kn00r7kwqkzrdhd7nm";
+      sha256 = "1315j8klxd404xxmcw1c6rlx7j445dzx62q5sggzvd59sl1amkf5";
      type = "gem";
    };
-    version = "0.1.8";
+    version = "0.4.0";
  };
  public_suffix = {
    groups = ["default" "development" "test"];
@ -5078,16 +5125,6 @@
    };
    version = "2.3.4";
  };
-  slop = {
-    groups = ["default" "development" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "00w8g3j7k7kl8ri2cf1m58ckxk8rn350gp4chfscmgv6pq1spk3n";
-      type = "gem";
-    };
-    version = "3.6.0";
-  };
  snowplow-tracker = {
    dependencies = ["contracts"];
    groups = ["default"];
@ -5099,6 +5136,28 @@
    };
    version = "0.6.1";
  };
+  solargraph = {
+    dependencies = ["backport" "benchmark" "e2mmap" "jaro_winkler" "kramdown" "kramdown-parser-gfm" "parser" "reverse_markdown" "rubocop" "thor" "tilt" "yard"];
+    groups = ["development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0xrad7amwf3nmdbif566qprk6xvwydxwz0s7arnzpvr01anc9gcl";
+      type = "gem";
+    };
+    version = "0.40.4";
+  };
+  spamcheck = {
+    dependencies = ["grpc"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0n307r7y819gq21yqhlni3r455cgcg3nc5318rhhx1bs99qs793r";
+      type = "gem";
+    };
+    version = "0.1.0";
+  };
  spring = {
    groups = ["development" "test"];
    platforms = [];
@ -5214,16 +5273,37 @@
    };
    version = "0.8.0";
  };
+  strings = {
+    dependencies = ["strings-ansi" "unicode-display_width" "unicode_utils"];
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1yynb0qhhhplmpzavfrrlwdnd1rh7rkwzcs4xf0mpy2wr6rr6clk";
+      type = "gem";
+    };
+    version = "0.2.1";
+  };
+  strings-ansi = {
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "120wa6yjc63b84lprglc52f40hx3fx920n4dmv14rad41rv2s9lh";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
  swd = {
    dependencies = ["activesupport" "attr_required" "httpclient"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1s2vjb6f13za7p1iycl2p73d3p202xa6xny9fjrp8ynwsqix7lyd";
+      sha256 = "0c5cdpykx2h4jx8q01hjhv8f0plw5r9iqm2i1m0ijiyk7dqm824w";
      type = "gem";
    };
-    version = "1.1.2";
+    version = "1.2.0";
  };
  sys-filesystem = {
    dependencies = ["ffi"];
@ -5465,6 +5545,69 @@
    };
    version = "0.7.11";
  };
+  tty-color = {
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0aik4kmhwwrmkysha7qibi2nyzb4c8kp42bd5vxnf8sf7b53g73g";
+      type = "gem";
+    };
+    version = "0.6.0";
+  };
+  tty-cursor = {
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0j5zw041jgkmn605ya1zc151bxgxl6v192v2i26qhxx7ws2l2lvr";
+      type = "gem";
+    };
+    version = "0.7.1";
+  };
+  tty-markdown = {
+    dependencies = ["kramdown" "pastel" "rouge" "strings" "tty-color" "tty-screen"];
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0hp6b6mcawg563098gs93wr49xmg871lkaj8m8gwk2va3zvqw7i5";
+      type = "gem";
+    };
+    version = "0.7.0";
+  };
+  tty-prompt = {
+    dependencies = ["pastel" "tty-reader"];
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1j4y8ik82azjxshgd4i1v4wwhsv3g9cngpygxqkkz69qaa8cxnzw";
+      type = "gem";
+    };
+    version = "0.23.1";
+  };
+  tty-reader = {
+    dependencies = ["tty-cursor" "tty-screen" "wisper"];
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1cf2k7w7d84hshg4kzrjvk9pkyc2g1m3nx2n1rpmdcf0hp4p4af6";
+      type = "gem";
+    };
+    version = "0.9.0";
+  };
+  tty-screen = {
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "18jr6s1cg8yb26wzkqa6874q0z93rq0y5aw092kdqazk71y6a235";
+      type = "gem";
+    };
+    version = "0.8.1";
+  };
  tzinfo = {
    dependencies = ["thread_safe"];
    groups = ["default" "development" "test"];
@ -5751,6 +5894,16 @@
    };
    version = "0.8.1";
  };
+  wisper = {
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1rpsi0ziy78cj82sbyyywby4d0aw0a5q84v65qd28vqn79fbq5yf";
+      type = "gem";
+    };
+    version = "2.0.1";
+  };
  with_env = {
    groups = ["default" "development" "test"];
    platforms = [];
@ -5802,6 +5955,16 @@
    };
    version = "1.4.1";
  };
+  yard = {
+    groups = ["default" "development"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0qzr5j1a1cafv81ib3i51qyl8jnmwdxlqi3kbiraldzpbjh4ln9h";
+      type = "gem";
+    };
+    version = "0.9.26";
+  };
  zeitwerk = {
    groups = ["default" "development" "test"];
    platforms = [];
--- a/pkgs/applications/version-management/gitlab/update.py
+++ b/pkgs/applications/version-management/gitlab/update.py
@ -131,9 +131,11 @@ def update_rubyenv():
    data = _get_data_json()
    rev = data['rev']

-    for fn in ['Gemfile.lock', 'Gemfile']:
-        with open(rubyenv_dir / fn, 'w') as f:
-            f.write(repo.get_file(fn, rev))
+    with open(rubyenv_dir / 'Gemfile.lock', 'w') as f:
+        f.write(repo.get_file('Gemfile.lock', rev))
+    with open(rubyenv_dir / 'Gemfile', 'w') as f:
+        original = repo.get_file('Gemfile', rev)
+        f.write(re.sub(r".*mail-smtp_pool.*", "", original))

    subprocess.check_output(['bundle', 'lock'], cwd=rubyenv_dir)
    subprocess.check_output(['bundix'], cwd=rubyenv_dir)
--- a/pkgs/applications/version-management/gitlab/yarnPkgs.nix
+++ b/pkgs/applications/version-management/gitlab/yarnPkgs.nix
--- a/pkgs/applications/video/kooha/default.nix
+++ b/pkgs/applications/video/kooha/default.nix
@ -1,17 +1,17 @@
 { lib, fetchFromGitHub, appstream-glib, desktop-file-utils, glib
-, gobject-introspection, gst_all_1, gtk3, libhandy, librsvg, meson, ninja
+, gobject-introspection, gst_all_1, gtk4, libadwaita, librsvg, meson, ninja
 , pkg-config, python3, wrapGAppsHook }:

 python3.pkgs.buildPythonApplication rec {
  pname = "kooha";
-  version = "1.1.3";
+  version = "1.2.1";
  format = "other";

  src = fetchFromGitHub {
    owner = "SeaDve";
    repo = "Kooha";
    rev = "v${version}";
-    sha256 = "14lrx6wplvlk3cg3wij88h4ydp3m69pw7lvvzrq3j9qnh431bs36";
+    sha256 = "1qwbzdn0n1nxcfci1bhhkfchdhw5yz74fdvsa84cznyyx2jils8w";
  };

  buildInputs = [
@ -19,8 +19,8 @@ python3.pkgs.buildPythonApplication rec {
    gobject-introspection
    gst_all_1.gstreamer
    gst_all_1.gst-plugins-base
-    gtk3
-    libhandy
+    gtk4
+    libadwaita
    librsvg
  ];

@ -48,6 +48,10 @@ python3.pkgs.buildPythonApplication rec {
    patchShebangs build-aux/meson/postinstall.py
  '';

+  installCheckPhase = ''
+    $out/bin/kooha --help
+  '';
+
  meta = with lib; {
    description = "Simple screen recorder";
    homepage = "https://github.com/SeaDve/Kooha";
--- a/pkgs/applications/virtualization/virt-manager/default.nix
+++ b/pkgs/applications/virtualization/virt-manager/default.nix
@ -32,10 +32,9 @@ python3Packages.buildPythonApplication rec {
    gobject-introspection # Temporary fix, see https://github.com/NixOS/nixpkgs/issues/56943
  ] ++ optional spiceSupport spice-gtk;

-  propagatedBuildInputs = with python3Packages;
-    [
-      pygobject3 ipaddress libvirt libxml2 requests
-    ];
+  propagatedBuildInputs = with python3Packages; [
+    pygobject3 ipaddress libvirt libxml2 requests cdrtools
+  ];

  patchPhase = ''
    sed -i 's|/usr/share/libvirt/cpu_map.xml|${system-libvirt}/share/libvirt/cpu_map.xml|g' virtinst/capabilities.py
--- a/pkgs/development/interpreters/clojure/babashka.nix
+++ b/pkgs/development/interpreters/clojure/babashka.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "babashka";
-  version = "0.4.1";
+  version = "0.4.3";

  reflectionJson = fetchurl {
    name = "reflection.json";
@ -12,7 +12,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://github.com/babashka/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "sha256-tKMxi0umMmM99NusSSE9tT95TBcfXm1lfo95fQRUBrs=";
+    sha256 = "sha256-teZKAwSv9wliVFKdT76yQjMC5g7SGPAqcq/jZ07sYjQ=";
  };

  dontUnpack = true;
@ -110,9 +110,15 @@ stdenv.mkDerivation rec {
    - Batteries included (tools.cli, cheshire, ...)
    - Library support via popular tools like the clojure CLI
    '';
-    homepage = "https://github.com/borkdude/babashka";
+    homepage = "https://github.com/babashka/babashka";
    license = licenses.epl10;
    platforms = graalvm11-ce.meta.platforms;
-    maintainers = with maintainers; [ bandresen bhougland DerGuteMoritz jlesquembre ];
+    maintainers = with maintainers; [
+      bandresen
+      bhougland
+      DerGuteMoritz
+      jlesquembre
+      thiagokokada
+    ];
  };
 }
--- a/pkgs/development/libraries/exempi/default.nix
+++ b/pkgs/development/libraries/exempi/default.nix
@ -11,12 +11,14 @@ stdenv.mkDerivation rec {

  configureFlags = [
    "--with-boost=${boost.dev}"
+  ] ++ lib.optionals (!doCheck) [
+    "--enable-unittest=no"
  ];

  buildInputs = [ expat zlib boost ]
    ++ lib.optionals stdenv.isDarwin [ libiconv darwin.apple_sdk.frameworks.CoreServices ];

-  doCheck = stdenv.isLinux;
+  doCheck = stdenv.isLinux && stdenv.is64bit;

  meta = with lib; {
    description = "An implementation of XMP (Adobe's Extensible Metadata Platform)";
--- a/pkgs/development/libraries/getdata/default.nix
+++ b/pkgs/development/libraries/getdata/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, libtool }:
+{ lib, stdenv, fetchurl, fetchpatch, libtool }:
 stdenv.mkDerivation rec {
  pname = "getdata";
  version = "0.10.0";
@ -7,6 +7,13 @@ stdenv.mkDerivation rec {
    sha256 = "18xbb32vygav9x6yz0gdklif4chjskmkgp06rwnjdf9myhia0iym";
  };

+  patches = [
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/libg/libgetdata/0.10.0-10/debian/patches/CVE-2021-20204.patch";
+      sha256 = "1lvp1c2pkk9kxniwlvax6d8fsmjrkpxawf71c7j4rfjm6dgvivzm";
+    })
+  ];
+
  buildInputs = [ libtool ];

  meta = with lib; {
--- a/pkgs/development/libraries/igraph/default.nix
+++ b/pkgs/development/libraries/igraph/default.nix
@ -96,6 +96,10 @@ stdenv.mkDerivation rec {
    cp -r doc "$out/share"
  '';

+  postFixup = lib.optionalString stdenv.isDarwin ''
+    install_name_tool -change libblas.dylib ${blas}/lib/libblas.dylib $out/lib/libigraph.dylib
+  '';
+
  meta = with lib; {
    description = "The network analysis package";
    homepage = "https://igraph.org/";
--- a/pkgs/development/libraries/mpich/default.nix
+++ b/pkgs/development/libraries/mpich/default.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, perl, gfortran
-, openssh, hwloc, autoconf, automake, libtool
+, openssh, hwloc
 # either libfabric or ucx work for ch4backend on linux. On darwin, neither of
 # these libraries currently build so this argument is ignored on Darwin.
 , ch4backend
@ -11,29 +11,13 @@ assert (ch4backend.pname == "ucx" || ch4backend.pname == "libfabric");

 stdenv.mkDerivation  rec {
  pname = "mpich";
-  version = "3.4.1";
+  version = "3.4.2";

  src = fetchurl {
    url = "https://www.mpich.org/static/downloads/${version}/mpich-${version}.tar.gz";
-    sha256 = "09wpfw9lsrc84vcmfw94razd4xv4znx4mmg7rqmljvgg0jc96dl8";
+    sha256 = "1gw7qpb27mhsj7ip0hhljshgpwvz2hmyhizhlp6793afp2lbw6aw";
  };

-  patches = [
-    # Reverts an upstream change that causes json-c test to fail
-    ./jsonc-test.patch
-  ];
-
-  # Required for the json-c patch
-  nativeBuildInputs = [ autoconf automake libtool ];
-
-  # Update configure after patch
-  postPatch = ''
-    cd modules/json-c
-    ./autogen.sh
-    cd ../..
-  '';
-
-
  configureFlags = [
    "--enable-shared"
    "--enable-sharedlib"
--- a/pkgs/development/libraries/mpich/jsonc-test.patch
+++ b/pkgs/development/libraries/mpich/jsonc-test.patch
@ -1,62 +0,0 @@
--- b/modules/json-c/configure.ac
-+++ a/modules/json-c/configure.ac
-@@ -75,7 +75,7 @@
- AC_FUNC_VPRINTF
- AC_FUNC_MEMCMP
- AC_CHECK_FUNCS([realloc])
-+AC_CHECK_FUNCS(strcasecmp strdup strerror snprintf vsnprintf vasprintf open strncasecmp setlocale)
-AC_CHECK_FUNCS(strcasecmp strdup strerror snprintf vsnprintf open strncasecmp setlocale)
- AC_CHECK_DECLS([INFINITY], [], [], [[#include <math.h>]])
- AC_CHECK_DECLS([nan], [], [], [[#include <math.h>]])
- AC_CHECK_DECLS([isnan], [], [], [[#include <math.h>]])
--- b/modules/json-c/json_pointer.c
-+++ a/modules/json-c/json_pointer.c
-@@ -208,7 +208,7 @@
- 	}
-
- 	va_start(args, path_fmt);
-+	rc = vasprintf(&path_copy, path_fmt, args);
-	rc = json_vasprintf(&path_copy, path_fmt, args);
- 	va_end(args);
-
- 	if (rc < 0)
-@@ -287,7 +287,7 @@
-
- 	/* pass a working copy to the recursive call */
- 	va_start(args, path_fmt);
-+	rc = vasprintf(&path_copy, path_fmt, args);
-	rc = json_vasprintf(&path_copy, path_fmt, args);
- 	va_end(args);
-
- 	if (rc < 0)
--- b/modules/json-c/printbuf.c
-+++ a/modules/json-c/printbuf.c
-@@ -129,7 +129,7 @@
-      would have been written - this code handles both cases. */
-   if(size == -1 || size > 127) {
-     va_start(ap, msg);
-+    if((size = vasprintf(&t, msg, ap)) < 0) { va_end(ap); return -1; }
-    if((size = json_vasprintf(&t, msg, ap)) < 0) { va_end(ap); return -1; }
-     va_end(ap);
-     printbuf_memappend(p, t, size);
-     free(t);
--- b/modules/json-c/vasprintf_compat.h
-+++ a/modules/json-c/vasprintf_compat.h
-@@ -8,8 +8,9 @@
-
- #include "snprintf_compat.h"
-
-+#if !defined(HAVE_VASPRINTF)
- /* CAW: compliant version of vasprintf */
-+static int vasprintf(char **buf, const char *fmt, va_list ap)
-static int json_vasprintf(char **buf, const char *fmt, va_list ap)
- {
- #ifndef WIN32
- 	static char _T_emptybuffer = '\0';
-@@ -40,5 +41,6 @@
-
- 	return chars;
- }
-+#endif /* !HAVE_VASPRINTF */
-
- #endif /* __vasprintf_compat_h */
--- a/pkgs/development/libraries/nv-codec-headers/10_x.nix
+++ b/pkgs/development/libraries/nv-codec-headers/10_x.nix
@ -0,0 +1,22 @@
+{ lib, stdenv, fetchgit }:
+
+stdenv.mkDerivation rec {
+  pname = "nv-codec-headers";
+  version = "10.0.26.2";
+
+  src = fetchgit {
+    url = "https://git.videolan.org/git/ffmpeg/nv-codec-headers.git";
+    rev = "n${version}";
+    sha256 = "0n5jlwjfv5irx1if1g0n52m279bw7ab6bd3jz2v4vwg9cdzbxx85";
+  };
+
+  makeFlags = [ "PREFIX=$(out)" ];
+
+  meta = {
+    description = "FFmpeg version of headers for NVENC";
+    homepage = "https://ffmpeg.org/";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.MP2E ];
+    platforms = lib.platforms.all;
+  };
+}
--- a/pkgs/development/libraries/poppler/default.nix
+++ b/pkgs/development/libraries/poppler/default.nix
@ -65,10 +65,9 @@ stdenv.mkDerivation rec {
    cairo
    lcms
    curl
+    nss
  ] ++ lib.optionals qt5Support [
    qtbase
-  ] ++ lib.optionals utils [
-    nss
  ] ++ lib.optionals introspectionSupport [
    gobject-introspection
  ];
--- a/pkgs/development/libraries/qhull/default.nix
+++ b/pkgs/development/libraries/qhull/default.nix
@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, cmake }:
+{ lib, stdenv, fetchFromGitHub, cmake, fixDarwinDylibNames }:

 stdenv.mkDerivation rec {
  pname = "qhull";
@ -11,7 +11,8 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-djUO3qzY8ch29AuhY3Bn1ajxWZ4/W70icWVrxWRAxRc=";
  };

-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [ cmake ]
+    ++ lib.optional stdenv.isDarwin fixDarwinDylibNames;

  meta = with lib; {
    homepage = "http://www.qhull.org/";
--- a/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
+++ b/pkgs/development/libraries/qt-5/modules/qtwebengine.nix
@ -134,7 +134,7 @@ qtModule {
  '';

  qmakeFlags = [ "--" "-system-ffmpeg" ]
-    ++ optional stdenv.isLinux "-webengine-webrtc-pipewire"
+    ++ optional (stdenv.isLinux && (lib.versionAtLeast qtCompatVersion "5.15")) "-webengine-webrtc-pipewire"
    ++ optional enableProprietaryCodecs "-proprietary-codecs";

  propagatedBuildInputs = [
@ -168,6 +168,7 @@ qtModule {
    xorg.xrandr libXScrnSaver libXcursor libXrandr xorg.libpciaccess libXtst
    xorg.libXcomposite xorg.libXdamage libdrm

+  ] ++ optionals (stdenv.isLinux && (lib.versionAtLeast qtCompatVersion "5.15")) [
    # Pipewire
    pipewire_0_2
  ]
--- a/pkgs/development/libraries/science/math/arpack/default.nix
+++ b/pkgs/development/libraries/science/math/arpack/default.nix
@ -46,6 +46,10 @@ stdenv.mkDerivation rec {
    export OMP_NUM_THREADS=2
  '';

+  postFixup = lib.optionalString stdenv.isDarwin ''
+    install_name_tool -change libblas.dylib ${blas}/lib/libblas.dylib $out/lib/libarpack.dylib
+  '';
+
  meta = {
    homepage = "https://github.com/opencollab/arpack-ng";
    description = ''
--- a/pkgs/development/libraries/spdk/default.nix
+++ b/pkgs/development/libraries/spdk/default.nix
@ -13,31 +13,17 @@
 , openssl
 }:

-let
-  dpdk-compat-patch = fetchurl {
-    url = "https://review.spdk.io/gerrit/plugins/gitiles/spdk/spdk/+/6acb9a58755856fb9316baf9dbbb7239dc6b9446%5E%21/?format=TEXT";
-    sha256 = "18q0956fkjw19r29hp16x4pygkfv01alj9cld2wlqqyfgp41nhn0";
-  };
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
  pname = "spdk";
-  version = "20.04.1";
+  version = "21.04";

  src = fetchFromGitHub {
    owner = "spdk";
    repo = "spdk";
    rev = "v${version}";
-    sha256 = "ApMyGamPrMalzZLbVkJlcwatiB8dOJmoxesdjkWZElk=";
+    sha256 = "sha256-Xmmgojgtt1HwTqG/1ZOJVo1BcdAH0sheu40d73OJ68w=";
  };

-  patches = [
-    ./spdk-dpdk-meson.patch
-    # https://review.spdk.io/gerrit/c/spdk/spdk/+/3134
-    (fetchpatch {
-      url = "https://github.com/spdk/spdk/commit/c954b5b722c5c163774d3598458ff726c48852ab.patch";
-      sha256 = "1n149hva5qxmpr0nmav10nya7zklafxi136f809clv8pag84g698";
-    })
-  ];
-
  nativeBuildInputs = [
    python3
  ];
@ -48,12 +34,13 @@ in stdenv.mkDerivation rec {

  postPatch = ''
    patchShebangs .
-    base64 -d ${dpdk-compat-patch} | patch -p1
  '';

  configureFlags = [ "--with-dpdk=${dpdk}" ];

  NIX_CFLAGS_COMPILE = "-mssse3"; # Necessary to compile.
+  # otherwise does not find strncpy when compiling
+  NIX_LDFLAGS = "-lbsd";

  meta = with lib; {
    description = "Set of libraries for fast user-mode storage";
--- a/pkgs/development/libraries/vapoursynth/plugin-interface.nix
+++ b/pkgs/development/libraries/vapoursynth/plugin-interface.nix
@ -8,10 +8,11 @@ plugins: let

  getRecursivePropagatedBuildInputs = pkgs: lib.flatten
    (map
-      (pkg: pkg.propagatedBuildInputs ++ (getRecursivePropagatedBuildInputs pkg.propagatedBuildInputs))
+      (pkg: let cleanPropagatedBuildInputs = lib.filter lib.isDerivation pkg.propagatedBuildInputs;
+        in cleanPropagatedBuildInputs ++ (getRecursivePropagatedBuildInputs cleanPropagatedBuildInputs))
      pkgs);

-  deepPlugins = plugins ++ (getRecursivePropagatedBuildInputs plugins);
+  deepPlugins = lib.unique (plugins ++ (getRecursivePropagatedBuildInputs plugins));

  pluginsEnv = buildEnv {
    name = "vapoursynth-plugins-env";
--- a/pkgs/development/libraries/webkitgtk/428774.patch
+++ b/pkgs/development/libraries/webkitgtk/428774.patch
@ -0,0 +1,86 @@
+diff -aru a/Source/WebKit/NetworkProcess/ServiceWorker/WebSWOriginStore.cpp b/Source/WebKit/NetworkProcess/ServiceWorker/WebSWOriginStore.cpp
+--- a/Source/WebKit/NetworkProcess/ServiceWorker/WebSWOriginStore.cpp	2021-02-26 04:57:15.000000000 -0500
+++ b/Source/WebKit/NetworkProcess/ServiceWorker/WebSWOriginStore.cpp	2021-05-16 14:45:32.000000000 -0400
+@@ -87,7 +87,7 @@
+     if (!m_store.createSharedMemoryHandle(handle))
+         return;
+ 
+-#if OS(DARWIN) || OS(WINDOWS)
+#if (OS(DARWIN) || OS(WINDOWS)) && !USE(UNIX_DOMAIN_SOCKETS)
+     uint64_t dataSize = handle.size();
+ #else
+     uint64_t dataSize = 0;
+diff -aru a/Source/WebKit/Platform/IPC/IPCSemaphore.cpp b/Source/WebKit/Platform/IPC/IPCSemaphore.cpp
+--- a/Source/WebKit/Platform/IPC/IPCSemaphore.cpp	2021-02-26 04:57:15.000000000 -0500
+++ b/Source/WebKit/Platform/IPC/IPCSemaphore.cpp	2021-05-16 15:54:53.000000000 -0400
+@@ -26,8 +26,6 @@
+ #include "config.h"
+ #include "IPCSemaphore.h"
+ 
+-#if !OS(DARWIN)
+-
+ namespace IPC {
+ 
+ Semaphore::Semaphore() = default;
+@@ -46,5 +44,3 @@
+ }
+ 
+ }
+-
+-#endif
+diff -aru a/Source/WebKit/Platform/IPC/IPCSemaphore.h b/Source/WebKit/Platform/IPC/IPCSemaphore.h
+--- a/Source/WebKit/Platform/IPC/IPCSemaphore.h	2021-02-26 04:57:15.000000000 -0500
+++ b/Source/WebKit/Platform/IPC/IPCSemaphore.h	2021-05-16 14:46:13.000000000 -0400
+@@ -29,7 +29,7 @@
+ #include <wtf/Optional.h>
+ #include <wtf/Seconds.h>
+ 
+-#if OS(DARWIN)
+#if PLATFORM(COCOA)
+ #include <mach/semaphore.h>
+ #include <wtf/MachSendRight.h>
+ #endif
+@@ -51,7 +51,7 @@
+     void encode(Encoder&) const;
+     static Optional<Semaphore> decode(Decoder&);
+ 
+-#if OS(DARWIN)
+#if PLATFORM(COCOA)
+     explicit Semaphore(MachSendRight&&);
+ 
+     void signal();
+@@ -64,7 +64,7 @@
+ #endif
+ 
+ private:
+-#if OS(DARWIN)
+#if PLATFORM(COCOA)
+     void destroy();
+     MachSendRight m_sendRight;
+     semaphore_t m_semaphore { SEMAPHORE_NULL };
+Only in b/Source/WebKit/Platform/IPC: IPCSemaphore.h.orig
+diff -aru a/Source/WebKit/Platform/SharedMemory.h b/Source/WebKit/Platform/SharedMemory.h
+--- a/Source/WebKit/Platform/SharedMemory.h	2021-02-26 04:57:15.000000000 -0500
+++ b/Source/WebKit/Platform/SharedMemory.h	2021-05-16 14:45:32.000000000 -0400
+@@ -75,7 +75,7 @@
+ 
+         bool isNull() const;
+ 
+-#if OS(DARWIN) || OS(WINDOWS)
+#if (OS(DARWIN) || OS(WINDOWS)) && !USE(UNIX_DOMAIN_SOCKETS)
+         size_t size() const { return m_size; }
+ #endif
+ 
+diff -aru a/Source/WebKit/UIProcess/VisitedLinkStore.cpp b/Source/WebKit/UIProcess/VisitedLinkStore.cpp
+--- a/Source/WebKit/UIProcess/VisitedLinkStore.cpp	2021-02-26 04:57:16.000000000 -0500
+++ b/Source/WebKit/UIProcess/VisitedLinkStore.cpp	2021-05-16 14:45:32.000000000 -0400
+@@ -119,7 +119,7 @@
+         return;
+ 
+     // FIXME: Get the actual size of data being sent from m_linkHashStore and send it in the SharedMemory::IPCHandle object.
+-#if OS(DARWIN) || OS(WINDOWS)
+#if (OS(DARWIN) || OS(WINDOWS)) && !USE(UNIX_DOMAIN_SOCKETS)
+     uint64_t dataSize = handle.size();
+ #else
+     uint64_t dataSize = 0;
+Only in b/Source/WebKit/WebProcess/WebPage/CoordinatedGraphics: DrawingAreaCoordinatedGraphics.cpp.orig
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@ -1,5 +1,7 @@
 { lib, stdenv
+, runCommandNoCC
 , fetchurl
+, fetchpatch
 , perl
 , python3
 , ruby
@ -34,6 +36,7 @@
 , libidn
 , libedit
 , readline
+, sdk
 , libGL
 , libGLU
 , mesa
@ -78,6 +81,32 @@ stdenv.mkDerivation rec {
      inherit (addOpenGLRunpath) driverLink;
    })
    ./libglvnd-headers.patch
+  ] ++ lib.optionals stdenv.isDarwin [
+    (fetchpatch {
+      url = "https://github.com/WebKit/WebKit/commit/94cdcd289b993ed4d39c17d4b8b90db7c81a9b10.diff";
+      sha256 = "sha256-ywrTEjf3ATqI0Vvs60TeAZ+m58kCibum4DamRWrQfaA=";
+      excludes = [ "Source/WebKit/ChangeLog" ];
+    })
+
+    # https://bugs.webkit.org/show_bug.cgi?id=225856
+    (fetchpatch {
+      url = "https://bug-225856-attachments.webkit.org/attachment.cgi?id=428797";
+      sha256 = "sha256-ffo5p2EyyjXe3DxdrvAcDKqxwnoqHtYBtWod+1fOjMU=";
+      excludes = [ "Source/WebCore/ChangeLog" ];
+    })
+
+    # https://bugs.webkit.org/show_bug.cgi?id=225850
+    ./428774.patch # https://bug-225850-attachments.webkit.org/attachment.cgi?id=428774
+    (fetchpatch {
+      url = "https://bug-225850-attachments.webkit.org/attachment.cgi?id=428776";
+      sha256 = "sha256-ryNRYMsk72SL0lNdh6eaAdDV3OT8KEqVq1H0j581jmQ=";
+      excludes = [ "Source/WTF/ChangeLog" ];
+    })
+    (fetchpatch {
+      url = "https://bug-225850-attachments.webkit.org/attachment.cgi?id=428778";
+      sha256 = "sha256-78iP+T2vaIufO8TmIPO/tNDgmBgzlDzalklrOPrtUeo=";
+      excludes = [ "Source/WebKit/ChangeLog" ];
+    })
  ];

  preConfigure = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
@ -96,6 +125,7 @@ stdenv.mkDerivation rec {
    gperf
    ninja
    perl
+    perl.pkgs.FileCopyRecursive # used by copy-user-interface-resources.pl
    pkg-config
    python3
    ruby
@ -143,6 +173,12 @@ stdenv.mkDerivation rec {
  ]) ++ lib.optionals stdenv.isDarwin [
    libedit
    readline
+    # Pull a header that contains a definition of proc_pid_rusage().
+    # (We pick just that one because using the other headers from `sdk` is not
+    # compatible with our C++ standard library)
+    (runCommandNoCC "${pname}_headers" {} ''
+      install -Dm444 "${lib.getDev sdk}"/include/libproc.h "$out"/include/libproc.h
+    '')
  ] ++ lib.optionals stdenv.isLinux [
    bubblewrap
    libseccomp
--- a/pkgs/development/python-modules/acoustics/default.nix
+++ b/pkgs/development/python-modules/acoustics/default.nix
@ -15,7 +15,7 @@ buildPythonPackage rec {

  checkPhase = ''
    pushd tests
-    py.test ./.
+    py.test -Wignore::DeprecationWarning ./.
    popd
  '';

--- a/pkgs/development/python-modules/cock/default.nix
+++ b/pkgs/development/python-modules/cock/default.nix
@ -0,0 +1,19 @@
+{ lib, buildPythonPackage, fetchPypi, locale, pytestCheckHook, click, sortedcontainers, pyyaml }:
+
+buildPythonPackage rec {
+  pname = "cock";
+  version = "0.8.0";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1gwaklvwlyvhz2c07hdmhbnqqmpybssxzzr0399dpjk7dgdqgam3";
+  };
+
+  propagatedBuildInputs = [ click sortedcontainers pyyaml ];
+
+  meta = with lib; {
+    homepage = "https://github.com/pohmelie/cock";
+    description = "Configuration file with click";
+    license = licenses.mit;
+  };
+}
--- a/pkgs/development/python-modules/cocotb-bus/default.nix
+++ b/pkgs/development/python-modules/cocotb-bus/default.nix
@ -0,0 +1,35 @@
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchPypi
+}:
+
+buildPythonPackage rec {
+  pname = "cocotb-bus";
+  version = "0.1.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "cc9b0bb00c95061a67f650caf96e3a294bb74ef437124dea456dd9e2a9431854";
+  };
+
+  postPatch = ''
+    # remove circular dependency cocotb from setup.py
+    substituteInPlace setup.py --replace '"cocotb>=1.5.0.dev,<2.0"' ""
+  '';
+
+  # tests require cocotb, disable for now to avoid circular dependency
+  doCheck = false;
+
+  # checkPhase = ''
+  #   export PATH=$out/bin:$PATH
+  #   make test
+  # '';
+
+  meta = with lib; {
+    description = "Pre-packaged testbenching tools and reusable bus interfaces for cocotb";
+    homepage = "https://github.com/cocotb/cocotb-bus";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ prusnak ];
+  };
+}
--- a/pkgs/development/python-modules/cocotb/default.nix
+++ b/pkgs/development/python-modules/cocotb/default.nix
@ -1,19 +1,31 @@
-{ lib, stdenv, buildPythonPackage, fetchFromGitHub, setuptools, swig, verilog }:
+{ lib
+, stdenv
+, buildPythonPackage
+, fetchPypi
+, setuptools
+, setuptools-scm
+, cocotb-bus
+, pytest
+, swig
+, verilog
+}:

 buildPythonPackage rec {
  pname = "cocotb";
-  version = "1.5.1";
+  version = "1.5.2";

-  src = fetchFromGitHub {
-    owner = pname;
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "02bw2i03vd4rcvdk10qdjl2lbvvy81cn9qpr8vzq8cm9h45689mv";
+  # - we need to use the tarball from PyPi
+  #   or the full git checkout (with .git)
+  # - using fetchFromGitHub will cause a build failure,
+  #   because it does not include required metadata
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "9f4f3e6eb9caeb479e98d604770645b57469cd25b39e28df1916ffcd593efbe6";
  };

-  propagatedBuildInputs = [
-    setuptools
-  ];
+  nativeBuildInputs = [ setuptools-scm ];
+
+  buildInputs = [ setuptools ];

  postPatch = ''
    patchShebangs bin/*.py
@ -25,16 +37,14 @@ buildPythonPackage rec {
    do
      substituteInPlace $f --replace 'shell which' 'shell command -v'
    done
+
+    # remove circular dependency cocotb-bus from setup.py
+    substituteInPlace setup.py --replace "'cocotb-bus<1.0'" ""
  '';

-  checkInputs = [ swig verilog ];
+  checkInputs = [ cocotb-bus pytest swig verilog ];

  checkPhase = ''
-    # test expected failures actually pass because of a fix in our icarus version
-    # https://github.com/cocotb/cocotb/issues/1952
-    substituteInPlace tests/test_cases/test_discovery/test_discovery.py \
-      --replace 'def access_single_bit' $'def foo(x): pass\ndef foo'
-
    export PATH=$out/bin:$PATH
    make test
  '';
--- a/pkgs/development/python-modules/cssutils/default.nix
+++ b/pkgs/development/python-modules/cssutils/default.nix
@ -5,19 +5,21 @@
 , setuptools-scm
 , toml
 , importlib-metadata
+, cssselect
+, lxml
 , mock
 , pytestCheckHook
 }:

 buildPythonPackage rec {
  pname = "cssutils";
-  version = "2.2.0";
+  version = "2.3.0";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "5bef59f6b59bdccbea8e36cb292d2be1b6be1b485fc4a9f5886616f19eb31aaf";
+    sha256 = "sha256-stOxYEfKroLlxZADaTW6+htiHPRcLziIWvS+SDjw/QA=";
  };

  nativeBuildInputs = [
@ -30,6 +32,8 @@ buildPythonPackage rec {
  ];

  checkInputs = [
+    cssselect
+    lxml
    mock
    pytestCheckHook
  ];
@ -38,6 +42,12 @@ buildPythonPackage rec {
    # access network
    "test_parseUrl"
    "encutils"
+    "website.logging"
+  ] ++ lib.optionals (pythonOlder "3.9") [
+    # AttributeError: module 'importlib.resources' has no attribute 'files'
+    "test_parseFile"
+    "test_parseString"
+    "test_combine"
  ];

  pythonImportsCheck = [ "cssutils" ];
--- a/pkgs/development/python-modules/google-api-python-client/default.nix
+++ b/pkgs/development/python-modules/google-api-python-client/default.nix
@ -4,11 +4,11 @@

 buildPythonPackage rec {
  pname = "google-api-python-client";
-  version = "2.0.2";
+  version = "2.6.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "04c0c8m4c7lzqv0m3jm0zks9wjcv1myas80rxswvi36wn376qs28";
+    sha256 = "1s1q1nw05925ryvnycq4bmqrxc14cicdl1j4l9xvyis26cjg71va";
  };

  # No tests included in archive
--- a/pkgs/development/python-modules/jupyter_server/default.nix
+++ b/pkgs/development/python-modules/jupyter_server/default.nix
@ -77,6 +77,8 @@ buildPythonPackage rec {
    "test_delete"
  ];

+  __darwinAllowLocalNetworking = true;
+
  meta = with lib; {
    description = "The backend—i.e. core services, APIs, and REST endpoints—to Jupyter web applications.";
    homepage = "https://github.com/jupyter-server/jupyter_server";
--- a/pkgs/development/python-modules/jupyterlab_server/default.nix
+++ b/pkgs/development/python-modules/jupyterlab_server/default.nix
@ -41,6 +41,8 @@ buildPythonPackage rec {
    "test_get_language_pack"
  ];

+  __darwinAllowLocalNetworking = true;
+
  meta = with lib; {
    description = "JupyterLab Server";
    homepage = "https://jupyter.org";
--- a/pkgs/development/python-modules/mat2/default.nix
+++ b/pkgs/development/python-modules/mat2/default.nix
@ -3,6 +3,7 @@
 , python
 , pythonOlder
 , fetchFromGitLab
+, fetchpatch
 , substituteAll
 , bubblewrap
 , exiftool
@ -49,6 +50,12 @@ buildPythonPackage rec {
    ./executable-name.patch
    # hardcode path to mat2 executable
    ./tests.patch
+    # remove for next release
+    (fetchpatch {
+      name = "fix-tests-ffmpeg-4.4.patch";
+      url = "https://0xacab.org/jvoisin/mat2/-/commit/c9be50f968212b01f8d8ad85e59e19c3e67d8578.patch";
+      sha256 = "0895dkv6575ps3drdfnli15cggx27n9irjx0axigrm4ql4ma0648";
+    })
  ];

  postPatch = ''
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@ -1,16 +1,21 @@
-{ lib, stdenv, fetchPypi, writeText, python, buildPythonPackage, isPy3k, pycairo, backports_functools_lru_cache
-, which, cycler, dateutil, nose, numpy, pyparsing, sphinx, tornado, kiwisolver
+{ lib, stdenv, fetchPypi, writeText, buildPythonPackage, isPy3k, pycairo
+, which, cycler, dateutil, numpy, pyparsing, sphinx, tornado, kiwisolver
 , freetype, qhull, libpng, pkg-config, mock, pytz, pygobject3, gobject-introspection
 , certifi, pillow
 , enableGhostscript ? true, ghostscript, gtk3
 , enableGtk3 ? false, cairo
 # darwin has its own "MacOSX" backend
-, enableTk ? !stdenv.isDarwin, tcl, tk, tkinter, libX11
+, enableTk ? !stdenv.isDarwin, tcl, tk, tkinter
 , enableQt ? false, pyqt5
+# required for headless detection
+, libX11, wayland
 , Cocoa
-, pythonOlder
 }:

+let
+  interactive = enableTk || enableGtk3 || enableQt;
+in
+
 buildPythonPackage rec {
  version = "3.4.1";
  pname = "matplotlib";
@ -62,8 +67,14 @@ buildPythonPackage rec {
    let
      tcl_tk_cache = ''"${tk}/lib", "${tcl}/lib", "${lib.strings.substring 0 3 tk.version}"'';
    in
-    lib.optionalString enableTk
-      "sed -i '/self.tcl_tk_cache = None/s|None|${tcl_tk_cache}|' setupext.py";
+    lib.optionalString enableTk ''
+      sed -i '/self.tcl_tk_cache = None/s|None|${tcl_tk_cache}|' setupext.py
+    '' + lib.optionalString (stdenv.isLinux && interactive) ''
+      # fix paths to libraries in dlopen calls (headless detection)
+      substituteInPlace src/_c_internal_utils.c \
+        --replace libX11.so.6 ${libX11}/lib/libX11.so.6 \
+        --replace libwayland-client.so.0 ${wayland}/lib/libwayland-client.so.0
+    '';

  # Matplotlib needs to be built against a specific version of freetype in
  # order for all of the tests to pass.
@ -72,6 +83,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "Python plotting library, making publication quality plots";
    homepage    = "https://matplotlib.org/";
+    license     = with licenses; [ psfl bsd0 ];
    maintainers = with maintainers; [ lovek323 veprbl ];
  };

--- a/pkgs/development/python-modules/nbclassic/default.nix
+++ b/pkgs/development/python-modules/nbclassic/default.nix
@ -28,6 +28,8 @@ buildPythonPackage rec {
    pytest-tornasync
  ];

+  __darwinAllowLocalNetworking = true;
+
  meta = with lib; {
    description = "Jupyter lab environment notebook server extension.";
    license = with licenses; [ bsd3 ];
--- a/pkgs/development/python-modules/pyrituals/default.nix
+++ b/pkgs/development/python-modules/pyrituals/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "pyrituals";
-  version = "0.0.2";
+  version = "0.0.3";
  format = "pyproject";
  disabled = pythonOlder "3.8";

@ -15,7 +15,7 @@ buildPythonPackage rec {
    owner = "milanmeu";
    repo = pname;
    rev = version;
-    sha256 = "0hrwhk3kpvdg78fgnvhmnnh3wprdv10j8jqjm4ly64chr8cdi6f2";
+    sha256 = "sha256-oAxQRGP6GxiidnGshSJZEh2RD3XsZ/7kFGwcqaYaBnM=";
  };

  propagatedBuildInputs = [ aiohttp ];
--- a/pkgs/development/python-modules/pywemo/default.nix
+++ b/pkgs/development/python-modules/pywemo/default.nix
@ -47,6 +47,11 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

+  disabledTests = [
+    # https://github.com/NixOS/nixpkgs/issues/124165
+    "test_bridge_getdevicestatus"
+  ];
+
  pythonImportsCheck = [ "pywemo" ];

  meta = with lib; {
--- a/pkgs/development/python-modules/scikit-learn/default.nix
+++ b/pkgs/development/python-modules/scikit-learn/default.nix
@ -66,10 +66,30 @@ buildPythonPackage rec {

  doCheck = !stdenv.isAarch64;

-  # Skip test_feature_importance_regression - does web fetch
-  disabledTests = [ "test_feature_importance_regression" ];
+  disabledTests = [
+    # Skip test_feature_importance_regression - does web fetch
+    "test_feature_importance_regression"

-  pytestFlagsArray = [ "-n" "$NIX_BUILD_CORES" "--pyargs" "sklearn" ];
+    # failing on macos
+    "check_regressors_train"
+    "check_classifiers_train"
+    "xfail_ignored_in_check_estimator"
+  ];
+
+  pytestFlagsArray = [
+    # verbose build outputs needed to debug hard-to-reproduce hydra failures
+    "-v"
+    "--pyargs" "sklearn"
+
+    # NuSVC memmap tests causes segmentation faults in certain environments
+    # (e.g. Hydra Darwin machines) related to a long-standing joblib issue
+    # (https://github.com/joblib/joblib/issues/563). See also:
+    # https://github.com/scikit-learn/scikit-learn/issues/17582
+    # Since we are overriding '-k' we need to include the 'disabledTests' from above manually.
+    "-k" "'not (NuSVC and memmap) ${toString (lib.forEach disabledTests (t: "and not ${t}"))}'"
+
+    "-n" "$NIX_BUILD_CORES"
+  ];

  preCheck = ''
    cd $TMPDIR
@ -89,6 +109,6 @@ buildPythonPackage rec {
      "https://scikit-learn.org/stable/whats_new/v${major}.${minor}.html#version-${dashVer}";
    homepage = "https://scikit-learn.org";
    license = licenses.bsd3;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ davhau ];
  };
 }
--- a/pkgs/development/python-modules/smhi-pkg/default.nix
+++ b/pkgs/development/python-modules/smhi-pkg/default.nix
@ -8,13 +8,13 @@

 buildPythonPackage rec {
  pname = "smhi-pkg";
-  version = "1.0.14";
+  version = "1.0.15";

  src = fetchFromGitHub {
    owner = "joysoftware";
    repo = "pypi_smhi";
    rev = version;
-    sha256 = "186xwrg3hvr0hszq2kxvygd241q2sp11gfk6mwj9z4zqywwfcbn3";
+    sha256 = "sha256-tBNmfn2hBkS36B9zKDP+TgqeumbgzBVDiJ5L54RaSc8=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/xgboost/default.nix
+++ b/pkgs/development/python-modules/xgboost/default.nix
@ -1,4 +1,5 @@
-{ buildPythonPackage
+{ lib
+, buildPythonPackage
 , pytestCheckHook
 , cmake
 , scipy
@ -56,6 +57,11 @@ buildPythonPackage {
  disabledTests = [
    "test_cli_binary_classification"
    "test_model_compatibility"
+  ] ++ lib.optionals stdenv.isDarwin [
+    # fails to connect to the com.apple.fonts daemon in sandboxed mode
+    "test_plotting"
+    "test_sklearn_plotting"
  ];

+  __darwinAllowLocalNetworking = true;
 }
--- a/pkgs/development/tools/build-managers/rebar3/default.nix
+++ b/pkgs/development/tools/build-managers/rebar3/default.nix
@ -3,7 +3,7 @@
  writeScript, common-updater-scripts, coreutils, git, gnused, nix, rebar3-nix }:

 let
-  version = "3.16.0";
+  version = "3.16.1";
  owner = "erlang";
  deps = import ./rebar-deps.nix { inherit fetchFromGitHub fetchHex; };
  rebar3 = stdenv.mkDerivation rec {
@ -16,7 +16,7 @@ let
      inherit owner;
      repo = pname;
      rev = version;
-      sha256 = "1yqvm37l5rn5dyg4sc2hv47930s2524qrdpnjwy3zqa27r7k5n36";
+      sha256 = "0dhwlx7zykf9y3znk2k8fxrq5j43jy3c3gd76k74q34p1xbajgzr";
    };

    buildInputs = [ erlang ];
--- a/pkgs/development/tools/database/pgsync/Gemfile.lock
+++ b/pkgs/development/tools/database/pgsync/Gemfile.lock
@ -3,12 +3,12 @@ GEM
  specs:
    parallel (1.20.1)
    pg (1.2.3)
-    pgsync (0.6.6)
+    pgsync (0.6.7)
      parallel
      pg (>= 0.18.2)
      slop (>= 4.8.2)
      tty-spinner
-    slop (4.8.2)
+    slop (4.9.0)
    tty-cursor (0.7.1)
    tty-spinner (0.9.3)
      tty-cursor (~> 0.7)
--- a/pkgs/development/tools/database/pgsync/gemset.nix
+++ b/pkgs/development/tools/database/pgsync/gemset.nix
@ -25,20 +25,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0wjvcfsgm7xxhb2lxil19qjxvvihqxbjd2ykmm5d43p0h2l9wvxr";
+      sha256 = "0kn7cf048zwbap0mifdpzz8if1ah803vgzbx09dfgjwgvfx5w5w6";
      type = "gem";
    };
-    version = "0.6.6";
+    version = "0.6.7";
  };
  slop = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "05d1xv8r9cmd0mmlqpa853yzd7xhcyha063w1g8dpf84scxbxmd3";
+      sha256 = "09n6sj4p3b43qq6jmghr9zhgny6719bpca8j6rxnlbq9bsnrd8rj";
      type = "gem";
    };
-    version = "4.8.2";
+    version = "4.9.0";
  };
  tty-cursor = {
    groups = ["default"];
--- a/pkgs/development/tools/devpi-client/default.nix
+++ b/pkgs/development/tools/devpi-client/default.nix
@ -49,6 +49,8 @@ buildPythonApplication rec {

  LC_ALL = "en_US.UTF-8";

+  __darwinAllowLocalNetworking = true;
+
  meta = with lib; {
    homepage = "http://doc.devpi.net";
    description = "Client for devpi, a pypi index server and packaging meta tool";
--- a/pkgs/development/tools/devpi-server/default.nix
+++ b/pkgs/development/tools/devpi-server/default.nix
@ -55,6 +55,8 @@ python3Packages.buildPythonApplication rec {
    "TestMirrorIndexThings"
  ];

+  __darwinAllowLocalNetworking = true;
+
  meta = with lib;{
    homepage = "http://doc.devpi.net";
    description = "Github-style pypi index server and packaging meta tool";
--- a/pkgs/development/tools/electron/default.nix
+++ b/pkgs/development/tools/electron/default.nix
@ -86,32 +86,32 @@ rec {
    headers = "0yx8mkrm15ha977hzh7g2sc5fab9sdvlk1bk3yxignhxrqqbw885";
  };

-  electron_10 = mkElectron "10.4.5" {
-    x86_64-linux = "d7f6203d09b4419262e985001d4c4f6c1fdfa3150eddb0708df9e124bebd0503";
-    x86_64-darwin = "e3ae7228010055b1d198d8dbaf0f34882d369d8caf76206a59f198301a3f3913";
-    i686-linux = "dd6abc0dc00d8f9d0e31c8f2bb70f7bbbaec58af4c446f8b493bbae9a9428e2f";
-    armv7l-linux = "86bc5f9d3dc94d19e847bf10ab22d98926b616d9febcbdceafd30e35b8f2b2db";
-    aarch64-linux = "655b36d68332131250f7496de0bb03a1e93f74bb5fc4b4286148855874673dcd";
-    headers = "1kfgww8wha86yw75k5yfq4mxvjlxgf1jmmzxy0p3hyr000kw26pk";
+  electron_10 = mkElectron "10.4.7" {
+    x86_64-linux = "e3ea75fcedce588c6b59cfa3a6e46ba67b789e14dc2e5b9dfe1ddf3f82b0f995";
+    x86_64-darwin = "8f01e020563b7fce68dc2e3d4bbf419320d13b088e89eb64f9645e9d73ad88fb";
+    i686-linux = "dd7fde9b3993538333ec701101554050b27d0b680196d0883ab563e8e696fc79";
+    armv7l-linux = "56f11ed14f8a620650d31c21ebd095ce59ef4286c98276802b18f9cc85560ddd";
+    aarch64-linux = "0550584518c8e98fe1113706c10fd7456ec519f7aa6867fbff17c8913327d758";
+    headers = "01x6a0r2jawjpl09ixgzap3g0z6znj34hsnnhzanavkbds0ri4k6";
  };

-  electron_11 = mkElectron "11.4.6" {
-    x86_64-linux = "03932a0b3328a00e7ed49947c70143b7b3455a3c1976defab2f74127cdae43e9";
-    x86_64-darwin = "47de03b17ab20213c95d5817af3d7db2b942908989649202efdcd1d566dd24c3";
-    i686-linux = "b76e69ad4b654384b4f1647f0cb362e78c1d99be7b814d7d32abc22294639ace";
-    armv7l-linux = "cc4be8e0c348bc8db5002cf6c63c1d02fcb594f1f8bfc358168738c930098857";
-    aarch64-linux = "75665dd5b2b9938bb4572344d459db65f46c5f7c637a32946c5a822cc23a77dc";
-    aarch64-darwin = "0c782b1d4eb848bae780f4e3a236caa1671486264c1f8e72fde98f1256d8f9e5";
-    headers = "0ip1wxgflifs86vk4xpz1555xa7yjy64ygqgd5a2g723148m52rk";
+  electron_11 = mkElectron "11.4.7" {
+    x86_64-linux = "05005d351a1b08a550a8186efba6f4fdd96842355a634934d9a9d7d31c2cd539";
+    x86_64-darwin = "e6445ad3d7e851fc3227785788d0706d58c9c8ea3821afa7f871c6254c463043";
+    i686-linux = "5473f36eb2a9772da7e4f1a162a724b4a5335e8f78fb51d585bac3bd50ff12fc";
+    armv7l-linux = "0de0d74b1206f7ffd9e4c75754bbf6fdf27c83a0ce6b4cd8a6b5af81d7a20ba7";
+    aarch64-linux = "f2261dde71197c358aff85d7a320cbd2315a5adf228218fd9a2f5c8561589323";
+    aarch64-darwin = "a2abc83c21402e30f4f42f4615cccc4369884faa2f2fa576d71f423834988622";
+    headers = "1dqkx861vfq6xbzdlbgza6h4j7bib8p3xahllrnfc0s65y8gf0ry";
  };

-  electron_12 = mkElectron "12.0.7" {
-    x86_64-linux = "335b77b35361fac4e2df1b7e8de5cf055e0a1a2065759cb2dd4508e8a77949fa";
-    x86_64-darwin = "c3238c9962c5ad0f9de23c9314f07e03410d096d7e9f9d91016dab2856606a9e";
-    i686-linux = "16023d86b88c7fccafd491c020d064caa2138d6a3493664739714555f72e5b06";
-    armv7l-linux = "53cc1250ff62f2353d8dd37552cbd7bdcaaa756106faee8b809303bed00e040a";
-    aarch64-linux = "3eddc0c507a43cce4e714bfe509d99218b5ab99f4660dd173aac2a895576dc71";
-    aarch64-darwin = "2bc8f37af68e220f93fb9abc62d1c56d8b64baaf0ef9ef974f24ddcbe4f8b488";
-    headers = "1ji9aj7qr4b27m5kprsgsrl21rjphz5bbnmn6q0n2x84l429nyfb";
+  electron_12 = mkElectron "12.0.9" {
+    x86_64-linux = "3ab0a873f720d3bf56cce6ca1bf9d8b956843920798f659ca0829e4cc3126f6d";
+    x86_64-darwin = "b3f1e378f58e7c36b54451c5a3485adc370277827974e1eb0790b6965737c872";
+    i686-linux = "37405b3b27779ad417c3ae432d7f0d969c126c958a0ad8f2585c34fc8ee6c6e6";
+    armv7l-linux = "2d41ef3ed6a215efe2c7d03d8055fcfda0079f09e9580e5bf70e8ac4a22b0898";
+    aarch64-linux = "22a85817ea2edbba2e17b35f6e3a8104b2165e070ea21a1f2fa3b40e8d7aecc9";
+    aarch64-darwin = "cb8aa8153005ea0d801182eb714d56af0217345b1152d867317291670731daeb";
+    headers = "1vwcjzkjag2wxrwnsbi8bgbv8bi6vn5iq9b04krwlk7mlhm4ax66";
  };
 }
--- a/pkgs/development/tools/misc/ccls/default.nix
+++ b/pkgs/development/tools/misc/ccls/default.nix
@ -21,17 +21,11 @@ stdenv.mkDerivation rec {
    cmakeFlagsArray+=(-DCMAKE_CXX_FLAGS="-fvisibility=hidden -fno-rtti")
  '';

+  clang = llvmPackages.clang;
  shell = runtimeShell;
+
  postFixup = ''
-    # We need to tell ccls where to find the standard library headers.
-
-    standard_library_includes="\\\"-isystem\\\", \\\"${lib.getDev stdenv.cc.libc}/include\\\""
-    standard_library_includes+=", \\\"-isystem\\\", \\\"${llvmPackages.libcxx}/include/c++/v1\\\""
-    export standard_library_includes
-
-    wrapped=".ccls-wrapped"
-    export wrapped
-
+    export wrapped=".ccls-wrapped"
    mv $out/bin/ccls $out/bin/$wrapped
    substituteAll ${./wrapper} $out/bin/ccls
    chmod --reference=$out/bin/$wrapped $out/bin/ccls
--- a/pkgs/development/tools/misc/ccls/wrapper
+++ b/pkgs/development/tools/misc/ccls/wrapper
@ -1,12 +1,9 @@
 #! @shell@ -e

-initString="--init={\"clang\":{\"extraArgs\": [@standard_library_includes@"
-
-if [ "${NIX_CFLAGS_COMPILE}" != "" ]; then
-  read -a cflags_array <<< ${NIX_CFLAGS_COMPILE}
-  initString+=$(printf ', \"%s\"' "${cflags_array[@]}")
-fi
-
-initString+="]}}"
+printf -v extraArgs ',\"%s\"' \
+  $(cat @clang@/nix-support/libc-cflags \
+        @clang@/nix-support/libcxx-cxxflags) \
+  ${NIX_CFLAGS_COMPILE}
+initString="--init={\"clang\":{\"extraArgs\":[${extraArgs:1}]}}"

 exec -a "$0" "@out@/bin/@wrapped@" "${initString}" "$@"
--- a/pkgs/development/tools/rust/cargo-raze/default.nix
+++ b/pkgs/development/tools/rust/cargo-raze/default.nix
@ -19,7 +19,9 @@ rustPlatform.buildRustPackage rec {
  buildInputs = [ curl libgit2 openssl ]
    ++ lib.optional stdenv.isDarwin Security;

-  doCheck = true;
+  # thread 'main' panicked at 'Cannot ping mock server.: "cannot send request to mock server: cannot send request to mock server: failed to resolve host name"'
+  # __darwinAllowLocalNetworking does not fix the panic
+  doCheck = !stdenv.isDarwin;

  meta = with lib; {
    description = "Generate Bazel BUILD files from Cargo dependencies";
--- a/pkgs/games/terraria-server/default.nix
+++ b/pkgs/games/terraria-server/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "terraria-server";
-  version = "1.4.2.2";
+  version = "1.4.2.3";
  urlVersion = lib.replaceChars [ "." ] [ "" ] version;

  src = fetchurl {
-    url = "https://terraria.org/system/dedicated_servers/archives/000/000/045/original/terraria-server-${urlVersion}.zip";
-    sha256 = "0jz79yidnri6hrqp2aqbi8hg0w3k4nrnfbvxgy5q612fr04g6nsw";
+    url = "https://terraria.org/system/dedicated_servers/archives/000/000/046/original/terraria-server-${urlVersion}.zip";
+    sha256 = "0qm4pbm1d9gax47fk4zhw9rcxvajxs36w7dghirli89i994r7g8j";
  };

  buildInputs = [ file ];
--- a/pkgs/misc/emulators/retroarch/cores.nix
+++ b/pkgs/misc/emulators/retroarch/cores.nix
@ -1,6 +1,6 @@
-{ lib, stdenv, fetchgit, fetchFromGitHub, fetchFromGitLab, fetchpatch, cmake, pkg-config, makeWrapper, python27, python37, retroarch
+{ lib, stdenv, fetchgit, fetchFromGitHub, fetchFromGitLab, fetchpatch, cmake, pkg-config, makeWrapper, python27, python3, retroarch
 , alsaLib, fluidsynth, curl, hidapi, libGLU, gettext, glib, gtk2, portaudio, SDL, SDL_net, SDL2, SDL2_image, libGL
-, ffmpeg_3, pcre, libevdev, libpng, libjpeg, libzip, udev, libvorbis, snappy, which, hexdump
+, ffmpeg, pcre, libevdev, libpng, libjpeg, libzip, udev, libvorbis, snappy, which, hexdump
 , miniupnpc, sfml, xorg, zlib, nasm, libpcap, boost, icu, openssl
 , buildPackages }:

@ -831,15 +831,24 @@ in with lib.licenses;

  ppsspp = mkLibRetroCore {
    core = "ppsspp";
-    src = fetchgit {
-      url = "https://github.com/hrydgard/ppsspp";
-      rev = "bf1777f7d3702e6a0f71c7ec1fc51976e23c2327";
-      sha256 = "17sym0vk72lzbh9a1501mhw98c78x1gq7k1fpy69nvvb119j37wa";
+    src = fetchFromGitHub {
+      owner = "hrydgard";
+      repo = "ppsspp";
+      rev = "v1.11";
+      fetchSubmodules = true;
+      sha256 = "sha256-vfp/vacIItlPP5dR7jzDT7oOUNFnjvvdR46yi79EJKU=";
    };
+    patches = [
+      (fetchpatch {
+        name = "fix_ffmpeg_4.4.patch";  # to be removed with next release
+        url = "https://patch-diff.githubusercontent.com/raw/hrydgard/ppsspp/pull/14176.patch";
+        sha256 = "sha256-ecDoOydaLfL6+eFpahcO1TnRl866mZZVHlr6Qrib1mo=";
+      })
+    ];
    description = "ppsspp libretro port";
    license = gpl2;
-    extraNativeBuildInputs = [ cmake pkg-config ];
-    extraBuildInputs = [ libGLU libGL libzip ffmpeg_3 python37 snappy xorg.libX11 ];
+    extraNativeBuildInputs = [ cmake pkg-config python3 ];
+    extraBuildInputs = [ libGLU libGL libzip ffmpeg snappy xorg.libX11 ];
    makefile = "Makefile";
    cmakeFlags = [ "-DLIBRETRO=ON -DUSE_SYSTEM_FFMPEG=ON -DUSE_SYSTEM_SNAPPY=ON -DUSE_SYSTEM_LIBZIP=ON -DOpenGL_GL_PREFERENCE=GLVND" ];
    postBuild = "mv lib/ppsspp_libretro${stdenv.hostPlatform.extensions.sharedLibrary} ppsspp_libretro${stdenv.hostPlatform.extensions.sharedLibrary}";
--- a/Show More
+++ b/Show More