Merge staging-next into staging

2020-03-12 12:00:40 +01:00 · 2020-03-12 12:00:40 +01:00 · 21f47e641b
commit 21f47e641b
parent 31855d74a3 8fa5eb488b
308 changed files with 6481 additions and 4537 deletions
--- a/doc/languages-frameworks/gnome.xml
+++ b/doc/languages-frameworks/gnome.xml
@ -233,7 +233,7 @@ mkDerivation {
    </term>
    <listitem>
     <para>
-      You can rely on applications depending on the library set the necessary environment variables but that it often easy to miss. Instead we recommend to patch the paths in the source code whenever possible. Here are some examples:
+      You can rely on applications depending on the library setting the necessary environment variables but that is often easy to miss. Instead we recommend to patch the paths in the source code whenever possible. Here are some examples:
      <itemizedlist>
       <listitem xml:id="ssec-gnome-common-issues-unwrappable-package-gnome-shell-ext">
        <para>
--- a/lib/customisation.nix
+++ b/lib/customisation.nix
@ -131,7 +131,12 @@ rec {
      origArgs = auto // args;
      pkgs = f origArgs;
      mkAttrOverridable = name: _: makeOverridable (newArgs: (f newArgs).${name}) origArgs;
-    in lib.mapAttrs mkAttrOverridable pkgs;
+    in
+      if lib.isDerivation pkgs then throw
+        ("function `callPackages` was called on a *single* derivation "
+          + ''"${pkgs.name or "<unknown-name>"}";''
+          + " did you mean to use `callPackage` instead?")
+      else lib.mapAttrs mkAttrOverridable pkgs;


  /* Add attributes to each output of a derivation without changing
--- a/lib/default.nix
+++ b/lib/default.nix
@ -24,6 +24,7 @@ let
    # packaging
    customisation = callLibs ./customisation.nix;
    maintainers = import ../maintainers/maintainer-list.nix;
+    teams = callLibs ../maintainers/team-list.nix;
    meta = callLibs ./meta.nix;
    sources = callLibs ./sources.nix;
    versions = callLibs ./versions.nix;
--- a/lib/generators.nix
+++ b/lib/generators.nix
@ -76,10 +76,14 @@ rec {
   * mkKeyValue is the same as in toINI.
   */
  toKeyValue = {
-    mkKeyValue ? mkKeyValueDefault {} "="
-  }: attrs:
-    let mkLine = k: v: mkKeyValue k v + "\n";
-    in libStr.concatStrings (libAttr.mapAttrsToList mkLine attrs);
+    mkKeyValue ? mkKeyValueDefault {} "=",
+    listsAsDuplicateKeys ? false
+  }:
+  let mkLine = k: v: mkKeyValue k v + "\n";
+      mkLines = if listsAsDuplicateKeys
+        then k: v: map (mkLine k) (if lib.isList v then v else [v])
+        else k: v: [ (mkLine k v) ];
+  in attrs: libStr.concatStrings (lib.concatLists (libAttr.mapAttrsToList mkLines attrs));


  /* Generate an INI-style config file from an
@ -106,7 +110,9 @@ rec {
    # apply transformations (e.g. escapes) to section names
    mkSectionName ? (name: libStr.escape [ "[" "]" ] name),
    # format a setting line from key and value
-    mkKeyValue    ? mkKeyValueDefault {} "="
+    mkKeyValue    ? mkKeyValueDefault {} "=",
+    # allow lists as values for duplicate keys
+    listsAsDuplicateKeys ? false
  }: attrsOfAttrs:
    let
        # map function to string for each key val
@ -115,7 +121,7 @@ rec {
            (libAttr.mapAttrsToList mapFn attrs);
        mkSection = sectName: sectValues: ''
          [${mkSectionName sectName}]
-        '' + toKeyValue { inherit mkKeyValue; } sectValues;
+        '' + toKeyValue { inherit mkKeyValue listsAsDuplicateKeys; } sectValues;
    in
      # map input to ini sections
      mapAttrsToStringsSep "\n" mkSection attrsOfAttrs;
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@ -348,6 +348,18 @@ runTests {
    '';
  };

+  testToINIDuplicateKeys = {
+    expr = generators.toINI { listsAsDuplicateKeys = true; } { foo.bar = true; baz.qux = [ 1 false ]; };
+    expected = ''
+      [baz]
+      qux=1
+      qux=false
+
+      [foo]
+      bar=true
+    '';
+  };
+
  testToINIDefaultEscapes = {
    expr = generators.toINI {} {
      "no [ and ] allowed unescaped" = {
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -3596,6 +3596,12 @@
    github = "jorsn";
    githubId = 4646725;
  };
+  joshuafern = {
+    name = "Joshua Fern";
+    email = "joshuafern@protonmail.com";
+    github = "JoshuaFern";
+    githubId = 4300747;
+  };
  jpas = {
    name = "Jarrod Pas";
    email = "jarrod@jarrodpas.com";
@ -5893,6 +5899,12 @@
    githubId = 4579165;
    name = "Danny Bautista";
  };
+  peelz = {
+    email = "peelz.dev+nixpkgs@gmail.com";
+    github = "louistakepillz";
+    githubId = 920910;
+    name = "peelz";
+  };
  q3k = {
    email = "q3k@q3k.org";
    github = "q3k";
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -0,0 +1,24 @@
+/* List of maintainer teams.
+    name = {
+      # Required
+      members = [ maintainer1 maintainer2 ];
+      scope = "Maintain foo packages.";
+    };
+
+  where
+
+  - `members` is the list of maintainers belonging to the group,
+  - `scope` describes the scope of the group.
+
+  More fields may be added in the future.
+
+  Please keep the list alphabetically sorted.
+  */
+
+{ lib }:
+with lib.maintainers; {
+  freedesktop = {
+    members = [ jtojnar worldofpeace ];
+    scope = "Maintain Freedesktop.org packages for graphical desktop.";
+  };
+}
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@ -23,6 +23,11 @@
     Support is planned until the end of April 2021, handing over to 21.03.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     PHP now defaults to PHP 7.4, updated from 7.3.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>

--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@ -133,7 +133,7 @@ in
      tcpcryptd = 93; # tcpcryptd uses a hard-coded uid. We patch it in Nixpkgs to match this choice.
      firebird = 95;
      #keys = 96; # unused
-      #haproxy = 97; # DynamicUser as of 2019-11-08
+      #haproxy = 97; # dynamically allocated as of 2020-03-11
      mongodb = 98;
      openldap = 99;
      #users = 100; # unused
@ -448,7 +448,7 @@ in
      #tcpcryptd = 93; # unused
      firebird = 95;
      keys = 96;
-      #haproxy = 97; # DynamicUser as of 2019-11-08
+      #haproxy = 97; # dynamically allocated as of 2020-03-11
      #mongodb = 98; # unused
      openldap = 99;
      munin = 102;
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -297,6 +297,7 @@
  ./services/desktops/geoclue2.nix
  ./services/desktops/gsignond.nix
  ./services/desktops/gvfs.nix
+  ./services/desktops/malcontent.nix
  ./services/desktops/pipewire.nix
  ./services/desktops/gnome3/at-spi2-core.nix
  ./services/desktops/gnome3/chrome-gnome-shell.nix
--- a/nixos/modules/programs/firejail.nix
+++ b/nixos/modules/programs/firejail.nix
@ -25,8 +25,14 @@ in {
    enable = mkEnableOption "firejail";

    wrappedBinaries = mkOption {
-      type = types.attrs;
+      type = types.attrsOf types.path;
      default = {};
+      example = literalExample ''
+        {
+          firefox = "''${lib.getBin pkgs.firefox}/bin/firefox";
+          mpv = "''${lib.getBin pkgs.mpv}/bin/mpv";
+        }
+      '';
      description = ''
        Wrap the binaries in firejail and place them in the global path.
        </para>
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@ -21,12 +21,12 @@ with lib;
    (mkRemovedOptionModule [ "services" "firefox" "syncserver" "group" ] "")
    (mkRemovedOptionModule [ "services" "winstone" ] "The corresponding package was removed from nixpkgs.")
    (mkRemovedOptionModule [ "networking" "vpnc" ] "Use environment.etc.\"vpnc/service.conf\" instead.")
-    (mkRemovedOptionModule [ "environment.blcr.enable" ] "The BLCR module has been removed")
-    (mkRemovedOptionModule [ "services.beegfsEnable" ] "The BeeGFS module has been removed")
-    (mkRemovedOptionModule [ "services.beegfs" ] "The BeeGFS module has been removed")
-    (mkRemovedOptionModule [ "services.osquery" ] "The osquery module has been removed")
-    (mkRemovedOptionModule [ "services.fourStore" ] "The fourStore module has been removed")
-    (mkRemovedOptionModule [ "services.fourStoreEndpoint" ] "The fourStoreEndpoint module has been removed")
+    (mkRemovedOptionModule [ "environment" "blcr" "enable" ] "The BLCR module has been removed")
+    (mkRemovedOptionModule [ "services" "beegfsEnable" ] "The BeeGFS module has been removed")
+    (mkRemovedOptionModule [ "services" "beegfs" ] "The BeeGFS module has been removed")
+    (mkRemovedOptionModule [ "services" "osquery" ] "The osquery module has been removed")
+    (mkRemovedOptionModule [ "services" "fourStore" ] "The fourStore module has been removed")
+    (mkRemovedOptionModule [ "services" "fourStoreEndpoint" ] "The fourStoreEndpoint module has been removed")
    (mkRemovedOptionModule [ "programs" "way-cooler" ] ("way-cooler is abandoned by its author: " +
      "https://way-cooler.org/blog/2020/01/09/way-cooler-post-mortem.html"))
    (mkRemovedOptionModule [ "services" "xserver" "multitouch" ] ''
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@ -21,6 +21,11 @@ let
  installOptions =
    "${mysqldOptions} ${lib.optionalString isMysqlAtLeast57 "--insecure"}";

+  settingsFile = pkgs.writeText "my.cnf" (
+    generators.toINI { listsAsDuplicateKeys = true; } cfg.settings +
+    optionalString (cfg.extraOptions != null) "[mysqld]\n${cfg.extraOptions}"
+  );
+
 in

 {
@ -76,9 +81,64 @@ in
        description = "Location where MySQL stores its table files";
      };

+      configFile = mkOption {
+        type = types.path;
+        default = settingsFile;
+        defaultText = "settingsFile";
+        description = ''
+          Override the configuration file used by MySQL. By default,
+          NixOS generates one automatically from <option>services.mysql.settings</option>.
+        '';
+        example = literalExample ''
+          pkgs.writeText "my.cnf" '''
+            [mysqld]
+            datadir = /var/lib/mysql
+            bind-address = 127.0.0.1
+            port = 3336
+            plugin-load-add = auth_socket.so
+
+            !includedir /etc/mysql/conf.d/
+          ''';
+        '';
+      };
+
+      settings = mkOption {
+        type = with types; attrsOf (attrsOf (oneOf [ bool int str (listOf str) ]));
+        default = {};
+        description = ''
+          MySQL configuration. Refer to
+          <link xlink:href="https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html"/>,
+          <link xlink:href="https://dev.mysql.com/doc/refman/8.0/en/server-system-variables.html"/>,
+          and <link xlink:href="https://mariadb.com/kb/en/server-system-variables/"/>
+          for details on supported values.
+
+          <note>
+            <para>
+              MySQL configuration options such as <literal>--quick</literal> should be treated as
+              boolean options and provided values such as <literal>true</literal>, <literal>false</literal>,
+              <literal>1</literal>, or <literal>0</literal>. See the provided example below.
+            </para>
+          </note>
+        '';
+        example = literalExample ''
+          {
+            mysqld = {
+              key_buffer_size = "6G";
+              table_cache = 1600;
+              log-error = "/var/log/mysql_err.log";
+              plugin-load-add = [ "server_audit" "ed25519=auth_ed25519" ];
+            };
+            mysqldump = {
+              quick = true;
+              max_allowed_packet = "16M";
+            };
+          }
+        '';
+      };
+
      extraOptions = mkOption {
-        type = types.lines;
-        default = "";
+        type = with types; nullOr lines;
+        default = null;
        example = ''
          key_buffer_size = 6G
          table_cache = 1600
@ -252,10 +312,27 @@ in

  config = mkIf config.services.mysql.enable {

+    warnings = optional (cfg.extraOptions != null) "services.mysql.`extraOptions` is deprecated, please use services.mysql.`settings`.";
+
    services.mysql.dataDir =
      mkDefault (if versionAtLeast config.system.stateVersion "17.09" then "/var/lib/mysql"
                 else "/var/mysql");

+    services.mysql.settings.mysqld = mkMerge [
+      {
+        datadir = cfg.dataDir;
+        bind-address = mkIf (cfg.bind != null) cfg.bind;
+        port = cfg.port;
+        plugin-load-add = optional (cfg.ensureUsers != []) "auth_socket.so";
+      }
+      (mkIf (cfg.replication.role == "master" || cfg.replication.role == "slave") {
+        log-bin = "mysql-bin-${toString cfg.replication.serverId}";
+        log-bin-index = "mysql-bin-${toString cfg.replication.serverId}.index";
+        relay-log = "mysql-relay-bin";
+        server-id = cfg.replication.serverId;
+      })
+    ];
+
    users.users.mysql = {
      description = "MySQL server user";
      group = "mysql";
@ -266,25 +343,7 @@ in

    environment.systemPackages = [mysql];

-    environment.etc."my.cnf".text =
-    ''
-      [mysqld]
-      port = ${toString cfg.port}
-      datadir = ${cfg.dataDir}
-      ${optionalString (cfg.bind != null) "bind-address = ${cfg.bind}" }
-      ${optionalString (cfg.replication.role == "master" || cfg.replication.role == "slave")
-      ''
-        log-bin=mysql-bin-${toString cfg.replication.serverId}
-        log-bin-index=mysql-bin-${toString cfg.replication.serverId}.index
-        relay-log=mysql-relay-bin
-        server-id = ${toString cfg.replication.serverId}
-      ''}
-      ${optionalString (cfg.ensureUsers != [])
-      ''
-        plugin-load-add = auth_socket.so
-      ''}
-      ${cfg.extraOptions}
-    '';
+    environment.etc."my.cnf".source = cfg.configFile;

    systemd.tmpfiles.rules = [
      "d '${cfg.dataDir}' 0700 ${cfg.user} mysql -"
@ -297,7 +356,7 @@ in

        after = [ "network.target" ];
        wantedBy = [ "multi-user.target" ];
-        restartTriggers = [ config.environment.etc."my.cnf".source ];
+        restartTriggers = [ cfg.configFile ];

        unitConfig.RequiresMountsFor = "${cfg.dataDir}";

--- a/nixos/modules/services/desktops/malcontent.nix
+++ b/nixos/modules/services/desktops/malcontent.nix
@ -0,0 +1,32 @@
+# Malcontent daemon.
+
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+
+  ###### interface
+
+  options = {
+
+    services.malcontent = {
+
+      enable = mkEnableOption "Malcontent";
+
+    };
+
+  };
+
+
+  ###### implementation
+
+  config = mkIf config.services.malcontent.enable {
+
+    environment.systemPackages = [ pkgs.malcontent ];
+
+    services.dbus.packages = [ pkgs.malcontent ];
+
+  };
+
+}
--- a/nixos/modules/services/misc/autorandr.nix
+++ b/nixos/modules/services/misc/autorandr.nix
@ -48,5 +48,5 @@ in {

  };

-  meta.maintainers = with maintainers; [ gnidorah ma27 ];
+  meta.maintainers = with maintainers; [ gnidorah ];
 }
--- a/nixos/modules/services/networking/freeradius.nix
+++ b/nixos/modules/services/networking/freeradius.nix
@ -10,14 +10,15 @@ let
  {
    description = "FreeRadius server";
    wantedBy = ["multi-user.target"];
-    after = ["network-online.target"];
-    wants = ["network-online.target"];
+    after = ["network.target"];
+    wants = ["network.target"];
    preStart = ''
      ${pkgs.freeradius}/bin/radiusd -C -d ${cfg.configDir} -l stdout
    '';

    serviceConfig = {
-        ExecStart = "${pkgs.freeradius}/bin/radiusd -f -d ${cfg.configDir} -l stdout -xx";
+        ExecStart = "${pkgs.freeradius}/bin/radiusd -f -d ${cfg.configDir} -l stdout" +
+                    optionalString cfg.debug " -xx";
        ExecReload = [
          "${pkgs.freeradius}/bin/radiusd -C -d ${cfg.configDir} -l stdout"
          "${pkgs.coreutils}/bin/kill -HUP $MAINPID"
@ -41,6 +42,16 @@ let
      '';
    };

+    debug = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to enable debug logging for freeradius (-xx
+        option). This should not be left on, since it includes
+        sensitive data such as passwords in the logs.
+      '';
+    };
+
  };

 in
@ -66,6 +77,7 @@ in
    };

    systemd.services.freeradius = freeradiusService cfg;
+    warnings = optional cfg.debug "Freeradius debug logging is enabled. This will log passwords in plaintext to the journal!";

  };

--- a/nixos/modules/services/networking/haproxy.nix
+++ b/nixos/modules/services/networking/haproxy.nix
@ -26,6 +26,18 @@ with lib;
        '';
      };

+      user = mkOption {
+        type = types.str;
+        default = "haproxy";
+        description = "User account under which haproxy runs.";
+      };
+
+      group = mkOption {
+        type = types.str;
+        default = "haproxy";
+        description = "Group account under which haproxy runs.";
+      };
+
      config = mkOption {
        type = types.nullOr types.lines;
        default = null;
@ -49,7 +61,8 @@ with lib;
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
      serviceConfig = {
-        DynamicUser = true;
+        User = cfg.user;
+        Group = cfg.group;
        Type = "notify";
        # when running the config test, don't be quiet so we can see what goes wrong
        ExecStartPre = "${pkgs.haproxy}/sbin/haproxy -c -f ${haproxyCfg}";
@ -60,5 +73,16 @@ with lib;
        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
      };
    };
+
+    users.users = optionalAttrs (cfg.user == "haproxy") {
+      haproxy = {
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    };
+
+    users.groups = optionalAttrs (cfg.group == "haproxy") {
+      haproxy = {};
+    };
  };
 }
--- a/nixos/modules/services/networking/vsftpd.nix
+++ b/nixos/modules/services/networking/vsftpd.nix
@ -133,8 +133,8 @@ let
      ${optionalString cfg.enableVirtualUsers ''
        guest_enable=YES
        guest_username=vsftpd
-        pam_service_name=vsftpd
      ''}
+      pam_service_name=vsftpd
      ${cfg.extraConfig}
    '';

--- a/nixos/modules/services/wayland/cage.nix
+++ b/nixos/modules/services/wayland/cage.nix
@ -51,6 +51,7 @@ in {
      conflicts = [ "getty@tty1.service" ];

      restartIfChanged = false;
+      unitConfig.ConditionPathExists = "/dev/tty1";
      serviceConfig = {
        ExecStart = ''
          ${pkgs.cage}/bin/cage \
@ -59,7 +60,6 @@ in {
        '';
        User = cfg.user;

-        ConditionPathExists = "/dev/tty1";
        IgnoreSIGPIPE = "no";

        # Log this user with utmp, letting it show up with commands 'w' and
--- a/nixos/modules/services/x11/display-managers/lightdm-greeters/tiny.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm-greeters/tiny.nix
@ -0,0 +1,92 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  dmcfg = config.services.xserver.displayManager;
+  ldmcfg = dmcfg.lightdm;
+  cfg = ldmcfg.greeters.tiny;
+
+in
+{
+  options = {
+
+    services.xserver.displayManager.lightdm.greeters.tiny = {
+
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to enable lightdm-tiny-greeter as the lightdm greeter.
+
+          Note that this greeter starts only the default X session.
+          You can configure the default X session using
+          <xref linkend="opt-services.xserver.displayManager.defaultSession"/>.
+        '';
+      };
+
+      label = {
+        user = mkOption {
+          type = types.str;
+          default = "Username";
+          description = ''
+            The string to represent the user_text label.
+          '';
+        };
+
+        pass = mkOption {
+          type = types.str;
+          default = "Password";
+          description = ''
+            The string to represent the pass_text label.
+          '';
+        };
+      };
+
+
+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        description = ''
+          Section to describe style and ui.
+        '';
+      };
+
+    };
+
+  };
+
+  config = mkIf (ldmcfg.enable && cfg.enable) {
+
+    services.xserver.displayManager.lightdm.greeters.gtk.enable = false;
+
+    nixpkgs.config.lightdm-tiny-greeter.conf =
+    let
+      configHeader = ''
+        #include <gtk/gtk.h>
+        static const char *user_text = "${cfg.label.user}";
+        static const char *pass_text = "${cfg.label.pass}";
+        static const char *session = "${dmcfg.defaultSession}";
+      '';
+    in
+      optionalString (cfg.extraConfig != "")
+        (configHeader + cfg.extraConfig);
+
+    services.xserver.displayManager.lightdm.greeter =
+      mkDefault {
+        package = pkgs.lightdm-tiny-greeter.xgreeters;
+        name = "lightdm-tiny-greeter";
+      };
+
+    assertions = [
+      {
+        assertion = dmcfg.defaultSession != null;
+        message = ''
+          Please set: services.xserver.displayManager.defaultSession
+        '';
+      }
+    ];
+
+  };
+}
--- a/nixos/modules/services/x11/display-managers/lightdm.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm.nix
@ -77,6 +77,7 @@ in
    ./lightdm-greeters/mini.nix
    ./lightdm-greeters/enso-os.nix
    ./lightdm-greeters/pantheon.nix
+    ./lightdm-greeters/tiny.nix
  ];

  options = {
--- a/nixos/modules/system/activation/switch-to-configuration.pl
+++ b/nixos/modules/system/activation/switch-to-configuration.pl
@ -183,7 +183,7 @@ while (my ($unit, $state) = each %{$activePrev}) {
            # active after the system has resumed, which probably
            # should not be the case.  Just ignore it.
            if ($unit ne "suspend.target" && $unit ne "hibernate.target" && $unit ne "hybrid-sleep.target") {
-                unless (boolIsTrue($unitInfo->{'RefuseManualStart'} // "no")) {
+                unless (boolIsTrue($unitInfo->{'RefuseManualStart'} // "no") || boolIsTrue($unitInfo->{'X-OnlyManualStart'} // "no")) {
                    $unitsToStart{$unit} = 1;
                    recordUnit($startListFile, $unit);
                    # Don't spam the user with target units that always get started.
@ -222,7 +222,7 @@ while (my ($unit, $state) = each %{$activePrev}) {
                    $unitsToReload{$unit} = 1;
                    recordUnit($reloadListFile, $unit);
                }
-                elsif (!boolIsTrue($unitInfo->{'X-RestartIfChanged'} // "yes") || boolIsTrue($unitInfo->{'RefuseManualStop'} // "no") ) {
+                elsif (!boolIsTrue($unitInfo->{'X-RestartIfChanged'} // "yes") || boolIsTrue($unitInfo->{'RefuseManualStop'} // "no") || boolIsTrue($unitInfo->{'X-OnlyManualStart'} // "no")) {
                    $unitsToSkip{$unit} = 1;
                } else {
                    if (!boolIsTrue($unitInfo->{'X-StopIfChanged'} // "yes")) {
--- a/nixos/modules/system/etc/etc.nix
+++ b/nixos/modules/system/etc/etc.nix
@ -94,7 +94,7 @@ in
              default = 0;
              type = types.int;
              description = ''
-                UID of created file. Only takes affect when the file is
+                UID of created file. Only takes effect when the file is
                copied (that is, the mode is not 'symlink').
                '';
            };
@ -103,7 +103,7 @@ in
              default = 0;
              type = types.int;
              description = ''
-                GID of created file. Only takes affect when the file is
+                GID of created file. Only takes effect when the file is
                copied (that is, the mode is not 'symlink').
              '';
            };
@ -113,7 +113,7 @@ in
              type = types.str;
              description = ''
                User name of created file.
-                Only takes affect when the file is copied (that is, the mode is not 'symlink').
+                Only takes effect when the file is copied (that is, the mode is not 'symlink').
                Changing this option takes precedence over <literal>uid</literal>.
              '';
            };
@ -123,7 +123,7 @@ in
              type = types.str;
              description = ''
                Group name of created file.
-                Only takes affect when the file is copied (that is, the mode is not 'symlink').
+                Only takes effect when the file is copied (that is, the mode is not 'symlink').
                Changing this option takes precedence over <literal>gid</literal>.
              '';
            };
--- a/nixos/modules/tasks/auto-upgrade.nix
+++ b/nixos/modules/tasks/auto-upgrade.nix
@ -63,6 +63,19 @@ let cfg = config.system.autoUpgrade; in
        '';
      };

+      randomizedDelaySec = mkOption {
+        default = "0";
+        type = types.str;
+        example = "45min";
+        description = ''
+          Add a randomized delay before each automatic upgrade.
+          The delay will be chozen between zero and this value.
+          This value must be a time span in the format specified by
+          <citerefentry><refentrytitle>systemd.time</refentrytitle>
+          <manvolnum>7</manvolnum></citerefentry>
+        '';
+      };
+
    };

  };
@ -109,6 +122,8 @@ let cfg = config.system.autoUpgrade; in
      startAt = cfg.dates;
    };

+    systemd.timers.nixos-upgrade.timerConfig.RandomizedDelaySec = cfg.randomizedDelaySec;
+
  };

 }
--- a/nixos/tests/docker-tools.nix
+++ b/nixos/tests/docker-tools.nix
@ -137,5 +137,22 @@ import ./make-test-python.nix ({ pkgs, ... }: {
            # Ensure the two output paths (ls and hello) are in the layer
            "docker run bulk-layer ls /bin/hello",
        )
+
+    with subtest("Ensure correct behavior when no store is needed"):
+        # This check tests two requirements simultaneously
+        #  1. buildLayeredImage can build images that don't need a store.
+        #  2. Layers of symlinks are eliminated by the customization layer.
+        #
+        docker.succeed(
+            "docker load --input='${pkgs.dockerTools.examples.no-store-paths}'"
+        )
+
+        # Busybox will not recognize argv[0] and print an error message with argv[0],
+        # but it confirms that the custom-true symlink is present.
+        docker.succeed("docker run --rm no-store-paths custom-true |& grep custom-true")
+
+        # This check may be loosened to allow an *empty* store rather than *no* store.
+        docker.succeed("docker run --rm no-store-paths ls /")
+        docker.fail("docker run --rm no-store-paths ls /nix/store")
  '';
 })
--- a/nixos/tests/kubernetes/dns.nix
+++ b/nixos/tests/kubernetes/dns.nix
@ -3,8 +3,6 @@ with import ./base.nix { inherit system; };
 let
  domain = "my.zyx";

-  certs = import ./certs.nix { externalDomain = domain; kubelets = [ "machine1" "machine2" ]; };
-
  redisPod = pkgs.writeText "redis-pod.json" (builtins.toJSON {
    kind = "Pod";
    apiVersion = "v1";
--- a/nixos/tests/signal-desktop.nix
+++ b/nixos/tests/signal-desktop.nix
@ -17,6 +17,7 @@ import ./make-test-python.nix ({ pkgs, ...} :
    services.xserver.enable = true;
    test-support.displayManager.auto.user = "alice";
    environment.systemPackages = [ pkgs.signal-desktop ];
+    virtualisation.memorySize = 1024;
  };

  enableOCR = true;
--- a/pkgs/applications/audio/MMA/default.nix
+++ b/pkgs/applications/audio/MMA/default.nix
@ -1,12 +1,12 @@
 { stdenv, fetchurl, makeWrapper, python3, alsaUtils, timidity }:

  stdenv.mkDerivation rec {
-  version = "19.08";
+  version = "20.02";
  pname = "mma";

  src = fetchurl {
    url = "https://www.mellowood.ca/mma/mma-bin-${version}.tar.gz";
-    sha256 = "02g2q9f1hbrj1v4mbf7zx2571vqpfla5803hcjpkdkvn8g0dwci0";
+    sha256 = "0i9c3f14j7wy2c86ky83f2vgmg5bihnnwsmpkq13fgqjsaf0qwnv";
  };

  buildInputs = [ makeWrapper python3 alsaUtils timidity ];
@ -19,6 +19,7 @@
    sed -i 's@/usr/bin/timidity@/${timidity}/bin/timidity@g' mma-splitrec
    sed -i 's@/usr/bin/timidity@/${timidity}/bin/timidity@g' util/mma-splitrec.py
    find . -type f | xargs sed -i 's@/usr/bin/env python@${python3.interpreter}@g'
+    find . -type f | xargs sed -i 's@/usr/bin/python@${python3.interpreter}@g'
  '';

  installPhase = ''
--- a/pkgs/applications/audio/spotify/default.nix
+++ b/pkgs/applications/audio/spotify/default.nix
@ -10,14 +10,14 @@ let
  # If an update breaks things, one of those might have valuable info:
  # https://aur.archlinux.org/packages/spotify/
  # https://community.spotify.com/t5/Desktop-Linux
-  version = "1.1.10.546.ge08ef575-19";
+  version = "1.1.26.501.gbe11e53b-15";
  # To get the latest stable revision:
  # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=stable' | jq '.download_url,.version,.last_updated'
  # To get general information:
  # curl -H 'Snap-Device-Series: 16' 'https://api.snapcraft.io/v2/snaps/info/spotify' | jq '.'
  # More examples of api usage:
  # https://github.com/canonical-websites/snapcraft.io/blob/master/webapp/publisher/snaps/views.py
-  rev = "36";
+  rev = "41";


  deps = [
@ -56,6 +56,8 @@ let
    xorg.libXScrnSaver
    xorg.libXtst
    xorg.libxcb
+    xorg.libSM
+    xorg.libICE
    zlib
  ];

@ -75,7 +77,7 @@ stdenv.mkDerivation {
  # https://community.spotify.com/t5/Desktop-Linux/Redistribute-Spotify-on-Linux-Distributions/td-p/1695334
  src = fetchurl {
    url = "https://api.snapcraft.io/api/v1/snaps/download/pOBIoZ2LrCB3rDohMxoYGnbN14EHOgD7_${rev}.snap";
-    sha512 = "c49f1a86a9b737e64a475bbe62754a36f607669e908eb725a2395f0a0a6b95968e0c8ce27ab2c8b6c92fe8cbacb1ef58de11c79b92dc0f58c2c6d3a140706a1f";
+    sha512 = "41bc8d20388bab39058d0709d99b1c8e324ea37af217620797356b8bc0b24aedbe801eaaa6e00a93e94e26765602e5dc27ad423ce2e777b4bec1b92daf04f81e";
  };

  buildInputs = [ squashfsTools makeWrapper ];
--- a/pkgs/applications/audio/zam-plugins/default.nix
+++ b/pkgs/applications/audio/zam-plugins/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation {
  pname = "zam-plugins";
-  version = "3.11";
+  version = "3.12";

  src = fetchgit {
    url = "https://github.com/zamaudio/zam-plugins.git";
    deepClone = true;
-    rev = "af338057e42dd5d07cba1889bfc74eda517c6147";
-    sha256 = "1qbskhcvy2k2xv0f32lw13smz5g72v0yy47zv6vnhnaiaqf3f2d5";
+    rev = "87fdee6e87dbee75c1088e2327ea59c1ab1522e4";
+    sha256 = "0kz0xygff3ca1v9nqi0dvrzy9whbzqxrls5b7hydi808d795893n";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/blockchains/btcdeb/default.nix
+++ b/pkgs/applications/blockchains/btcdeb/default.nix
@ -0,0 +1,30 @@
+{ stdenv
+, fetchFromGitHub
+, autoreconfHook
+, pkgconfig
+, openssl
+}:
+
+with stdenv.lib;
+stdenv.mkDerivation rec {
+  pname = "btcdeb";
+  version = "0.2.19";
+
+  src = fetchFromGitHub {
+    owner = "kallewoof";
+    repo = pname;
+    rev = "fb2dace4cd115dc9529a81515cee855b8ce94784";
+    sha256 = "0l0niamcjxmgyvc6w0wiygfgwsjam3ypv8mvjglgsj50gyv1vnb3";
+  };
+
+  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  buildInputs = [ openssl ];
+
+  meta = {
+    description = "Bitcoin Script Debugger";
+    homepage = "https://github.com/kallewoof/btcdeb";
+    license = licenses.mit;
+    maintainers = with maintainers; [ akru ];
+    platforms = platforms.unix;
+  };
+}
--- a/pkgs/applications/blockchains/nano-wallet/default.nix
+++ b/pkgs/applications/blockchains/nano-wallet/default.nix
@ -4,13 +4,13 @@
 stdenv.mkDerivation rec {

  pname = "nano-wallet";
-  version = "19.0";
+  version = "20.0";

  src = fetchFromGitHub {
    owner = "nanocurrency";
    repo = "raiblocks";
    rev = "V${version}";
-    sha256 = "1y5fc4cvfqh33imjkh91sqhy5bb9kh0icwyvdgm1cl564vnjax80";
+    sha256 = "12nrjjd89yjzx20d85ccmp395pl0djpx0x0qb8dgka8xfy11k7xn";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@ -11,24 +11,27 @@ rustPlatform.buildRustPackage rec {

  src = fetchFromGitHub {
    owner = "paritytech";
+    # N.B. In 2018, the thing that was "polkadot" was split off into its own
+    # repo, so if this package is ever updated it should be changed to
+    # paritytech/polkadot, as per comment here:
+    # https://github.com/paritytech/polkadot#note
    repo = "substrate";
    rev = "19f4f4d4df3bb266086b4e488739f73d3d5e588c";
    sha256 = "0v7g03rbml2afw0splmyjh9nqpjg0ldjw09hyc0jqd3qlhgxiiyj";
-  }; 
+  };

-  # Delete this on next update; see #79975 for details
-  legacyCargoFetcher = true;
-
-  cargoSha256 = "0gc3w0cwdyk8f7cgpp9sfawczk3n6wd7q0nhfvk87sry71b8vvwq";
+  cargoSha256 = "1h5v7c7xi2r2wzh1pj6xidrg7dx23w3rjm88mggpq7574arijk4i";

  buildInputs = [ pkgconfig openssl openssl.dev ];

  meta = with stdenv.lib; {
    description = "Polkadot Node Implementation";
-    homepage = https://polkadot.network;
+    homepage = "https://polkadot.network";
    license = licenses.gpl3;
    maintainers = [ maintainers.akru ];
    platforms = platforms.linux;
+    # Last attempt at building this was on v0.7.22
+    # https://github.com/paritytech/polkadot/releases
    broken = true;
  };
 }
--- a/pkgs/applications/display-managers/lightdm-tiny-greeter/default.nix
+++ b/pkgs/applications/display-managers/lightdm-tiny-greeter/default.nix
@ -0,0 +1,46 @@
+{ stdenv, linkFarm, lightdm-tiny-greeter, fetchFromGitHub
+, pkgconfig, lightdm, gtk3, glib, wrapGAppsHook, conf ? "" }:
+
+stdenv.mkDerivation rec {
+  pname = "lightdm-tiny-greeter";
+  version = "1.2";
+
+  src = fetchFromGitHub {
+    owner = "off-world";
+    repo = "lightdm-tiny-greeter";
+    rev = version;
+    sha256 = "08azpj7b5qgac9bgi1xvd6qy6x2nb7iapa0v40ggr3d1fabyhrg6";
+  };
+
+  nativeBuildInputs = [ pkgconfig wrapGAppsHook ];
+  buildInputs = [ lightdm gtk3 glib ];
+
+  postUnpack = if conf != "" then ''
+    cp ${builtins.toFile "config.h" conf} source/config.h
+  '' else "";
+
+  buildPhase = ''
+    mkdir -p $out/bin $out/share/xgreeters
+    make ${pname}
+    mv ${pname} $out/bin/.
+    mv lightdm-tiny-greeter.desktop $out/share/xgreeters
+  '';
+
+  installPhase = ''
+    substituteInPlace "$out/share/xgreeters/lightdm-tiny-greeter.desktop" \
+      --replace "Exec=lightdm-tiny-greeter" "Exec=$out/bin/lightdm-tiny-greeter"
+  '';
+
+  passthru.xgreeters = linkFarm "lightdm-tiny-greeter-xgreeters" [{
+    path = "${lightdm-tiny-greeter}/share/xgreeters/lightdm-tiny-greeter.desktop";
+    name = "lightdm-tiny-greeter.desktop";
+  }];
+
+  meta = with stdenv.lib; {
+    description = "A tiny multi user lightdm greeter";
+    homepage = https://github.com/off-world/lightdm-tiny-greeter;
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ edwtjo ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/editors/amp/default.nix
+++ b/pkgs/applications/editors/amp/default.nix
@ -3,19 +3,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "amp";
-  version = "0.6.1";
+  version = "0.6.2";

  src = fetchFromGitHub {
    owner = "jmacdonald";
    repo = pname;
    rev = version;
-    sha256 = "0jhxyl27nwp7rp0lc3kic69g8x55d0azrwlwwhz3z74icqa8f03j";
+    sha256 = "0l1vpcfq6jrq2dkrmsa4ghwdpp7c54f46gz3n7nk0i41b12hnigw";
  };

-  # Delete this on next update; see #79975 for details
-  legacyCargoFetcher = true;
-
-  cargoSha256 = "0rk5c8knx8swqzmj7wd18hq2h5ndkzvcbq4lzggpavkk01a8hlb1";
+  cargoSha256 = "09v991rl2w4c4jh7ga7q1lk6wyl2vr71j5cpniij8mcvszrz78qf";

  nativeBuildInputs = [ cmake pkgconfig ];
  buildInputs = [ openssl python3 xorg.libxcb libgit2 ] ++ stdenv.lib.optionals stdenv.isDarwin
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -18,9 +18,9 @@ let
    sha256Hash = "0ibp54wcss4ihm454hbavv1bhar6cd4alp5b0z248ryjr5w9mixf";
  };
  latestVersion = { # canary & dev
-    version = "4.1.0.1"; # "Android Studio 4.1 Canary 1"
-    build = "193.6224510";
-    sha256Hash = "0misff7xx8jcg4zr5ahc8qdwvlkx605il0shzd9i1cm9v1br3sqx";
+    version = "4.1.0.2"; # "Android Studio 4.1 Canary 2"
+    build = "193.6264773";
+    sha256Hash = "0m09q4jp653i9jlqsjplx3d64xkdm27c35781yz6h5rw0a1sq6kz";
  };
 in {
  # Attributes are named by their corresponding release channels
--- a/pkgs/applications/editors/emacs-modes/elpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/elpa-generated.nix
@ -343,10 +343,10 @@
      elpaBuild {
        pname = "bnf-mode";
        ename = "bnf-mode";
-        version = "0.4.3";
+        version = "0.4.4";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/bnf-mode-0.4.3.tar";
-          sha256 = "1hdhk6kw50vsixprrri0jb5i1c2y94ihifipqgq6kil7y4blr614";
+          url = "https://elpa.gnu.org/packages/bnf-mode-0.4.4.tar";
+          sha256 = "0acr3x96zknxs90dc9mpnrwiaa81883h36lx5q1lxfn78vjfw14x";
        };
        packageRequires = [ cl-lib emacs ];
        meta = {
@ -2007,6 +2007,36 @@
          license = lib.licenses.free;
        };
      }) {};
+    modus-operandi-theme = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "modus-operandi-theme";
+        ename = "modus-operandi-theme";
+        version = "0.6.0";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/modus-operandi-theme-0.6.0.el";
+          sha256 = "10smvzaxp90lsg0g61s2nzmfxwnlrxq9dv4rn771vlhra249y08v";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/modus-operandi-theme.html";
+          license = lib.licenses.free;
+        };
+      }) {};
+    modus-vivendi-theme = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "modus-vivendi-theme";
+        ename = "modus-vivendi-theme";
+        version = "0.6.0";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/modus-vivendi-theme-0.6.0.el";
+          sha256 = "1b7wkz779f020gpil4spbdzmg2fx6l48wk1138564cv9kx3nkkz2";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/modus-vivendi-theme.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    multishell = callPackage ({ cl-lib ? null, elpaBuild, fetchurl, lib }:
      elpaBuild {
        pname = "multishell";
@ -2765,10 +2795,10 @@
      elpaBuild {
        pname = "relint";
        ename = "relint";
-        version = "1.14";
+        version = "1.15";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/relint-1.14.tar";
-          sha256 = "0hjzhxcygb2r2s3g2pk3z9x3appy1y8gkw8gpg9cpkl6lpwcsh2f";
+          url = "https://elpa.gnu.org/packages/relint-1.15.tar";
+          sha256 = "0sxmdsacj8my942k8j76m2y68nzab7190acv7cwgflc5n4f07yxa";
        };
        packageRequires = [ emacs xr ];
        meta = {
@ -3041,10 +3071,10 @@
      elpaBuild {
        pname = "ssh-deploy";
        ename = "ssh-deploy";
-        version = "3.1.10";
+        version = "3.1.11";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ssh-deploy-3.1.10.tar";
-          sha256 = "0gckc6yhgi8pn3s8vdyzz8x1s2d4wmsw6yjwsaqcr5nra50glbpg";
+          url = "https://elpa.gnu.org/packages/ssh-deploy-3.1.11.tar";
+          sha256 = "1xd09kfn7lqw6jzfkrn0p5agdpcz1z9zbazqigylpqfcywr5snhk";
        };
        packageRequires = [ emacs ];
        meta = {
@ -3157,7 +3187,11 @@
          license = lib.licenses.free;
        };
      }) {};
-    timerfunctions = callPackage ({ cl-lib ? null, elpaBuild, fetchurl, lib }:
+    timerfunctions = callPackage ({ cl-lib ? null
+                                  , elpaBuild
+                                  , emacs
+                                  , fetchurl
+                                  , lib }:
      elpaBuild {
        pname = "timerfunctions";
        ename = "timerfunctions";
@ -3166,7 +3200,7 @@
          url = "https://elpa.gnu.org/packages/timerfunctions-1.4.2.el";
          sha256 = "122q8nv08pz1mkgilvi9qfrs7rsnc5picr7jyz2jpnvpd9qw6jw5";
        };
-        packageRequires = [ cl-lib ];
+        packageRequires = [ cl-lib emacs ];
        meta = {
          homepage = "https://elpa.gnu.org/packages/timerfunctions.html";
          license = lib.licenses.free;
@ -3675,10 +3709,10 @@
      elpaBuild {
        pname = "xr";
        ename = "xr";
-        version = "1.16";
+        version = "1.18";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/xr-1.16.tar";
-          sha256 = "1s6pkbr7gkan0r9gfmix75m587d8cg6l11722v70zzgf2z9w2xg9";
+          url = "https://elpa.gnu.org/packages/xr-1.18.tar";
+          sha256 = "1nq9pj47sxgpkw97c2xrkhgcwh3zsfd2a22qiqbl4i9zf2l9yy91";
        };
        packageRequires = [ emacs ];
        meta = {
--- a/pkgs/applications/editors/emacs-modes/recipes-archive-melpa.json
+++ b/pkgs/applications/editors/emacs-modes/recipes-archive-melpa.json
--- a/pkgs/applications/editors/neovim/gnvim/default.nix
+++ b/pkgs/applications/editors/neovim/gnvim/default.nix
@ -11,10 +11,7 @@ rustPlatform.buildRustPackage rec {
    sha256 = "11gb59lhc1sp5dxj2fdm6072f4nxxay0war3kmchdwsk41nvxlrh";
  };

-  # Delete this on next update; see #79975 for details
-  legacyCargoFetcher = true;
-
-  cargoSha256 = "00r5jf5qdw02vcv3522qqrnwj14mip0l58prcncbvyg4pxlm2rb2";
+  cargoSha256 = "0ay7hx5bzchp772ywgxzia12c44kbyarrshl689cmqh59wphsrx5";

  buildInputs = [ gtk webkitgtk ];

@ -43,8 +40,7 @@ rustPlatform.buildRustPackage rec {
  meta = with stdenv.lib; {
    description = "GUI for neovim, without any web bloat";
    homepage = "https://github.com/vhakulinen/gnvim";
-    license     = licenses.mit;
-    maintainers =  with maintainers; [ minijackson ];
-    inherit version;
+    license = licenses.mit;
+    maintainers = with maintainers; [ minijackson ];
  };
 }
--- a/pkgs/applications/editors/rstudio/default.nix
+++ b/pkgs/applications/editors/rstudio/default.nix
@ -8,7 +8,7 @@ with lib;
 let
  verMajor = "1";
  verMinor = "2";
-  verPatch = "1335";
+  verPatch = "5033";
  version = "${verMajor}.${verMinor}.${verPatch}";
  ginVer = "2.1.2";
  gwtVer = "2.8.1";
@ -26,7 +26,7 @@ mkDerivation rec {
    owner = "rstudio";
    repo = "rstudio";
    rev = "v${version}";
-    sha256 = "0jv1d4yznv2lzwp0fdf377vqpg0k2q4z9qvji4sj86fabj835lqd";
+    sha256 = "0f3p2anz9xay2859bxj3bvyj582igsp628qxsccpkgn0jifvi4np";
  };

  # Hack RStudio to only use the input R and provided libclang.
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@ -11,15 +11,15 @@ let
  archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "0c067qp3aa5kqya3y8pzc9cvyzsafizhgjp9dsibnfl08lvz9hbs";
-    x86_64-darwin = "0vi94nk8p3vp30nx60mwqcmfqbrmrqwvfdjbah0zm480dcjzz7dv";
+    x86_64-linux = "0i8dmh9w7xgzfjii4m116lavydpfpcp7fxs4bcykf0a779pzwv87";
+    x86_64-darwin = "0z0r0dmmzk3k095g7jbrrk9gl1jpb3cai973xrjw17ank1lddcjf";
  }.${system};
 in
  callPackage ./generic.nix rec {
    # The update script doesn't correctly change the hash for darwin, so please:
    # nixpkgs-update: no auto update

-    version = "1.42.1";
+    version = "1.43.0";
    pname = "vscode";

    executableName = "code" + lib.optionalString isInsiders "-insiders";
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -11,8 +11,8 @@ let
  archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "1pac3rv7ps23ymynvy8dwd5k2154aln33ksr75z1d8w859x3f1dy";
-    x86_64-darwin = "1imzgqynbd65c7gbfp2gb1cxjbazx7afvbdvbqnm5qg7pvq22rni";
+    x86_64-linux = "139sqaixlcqlpcrn2vkcp9fxvcjgnhn2dwxclxq3bnb814pw7rba";
+    x86_64-darwin = "0jkd3p1jqg38z9l22k5w7b45fdnxwrhzlgyhinw7wlqz7zvflkn1";
  }.${system};

  sourceRoot = {
@ -25,7 +25,7 @@ in
    # The update script doesn't correctly change the hash for darwin, so please:
    # nixpkgs-update: no auto update

-    version = "1.42.1";
+    version = "1.43.0";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/graphics/renderdoc/default.nix
+++ b/pkgs/applications/graphics/renderdoc/default.nix
@ -1,6 +1,6 @@
 { stdenv, fetchFromGitHub, cmake, pkgconfig, mkDerivation
 , qtbase, qtx11extras, qtsvg, makeWrapper
-, vulkan-loader, xorg, python3, python3Packages
+, vulkan-loader, libglvnd, xorg, python3, python3Packages
 , bison, pcre, automake, autoconf, addOpenGLRunpath
 }:
 let
@ -13,14 +13,14 @@ let
  pythonPackages = python3Packages;
 in
 mkDerivation rec {
-  version = "1.6";
+  version = "1.7";
  pname = "renderdoc";

  src = fetchFromGitHub {
    owner = "baldurk";
    repo = "renderdoc";
    rev = "v${version}";
-    sha256 = "0b2f9m5azzvcjbmxkwcl1d7jvvp720b81zwn19rrskznfcc2r1i8";
+    sha256 = "0r0y0lx48hkyf39pgippsc9q8hdcf57bdva6gx7f35vlhicx5hlz";
  };

  buildInputs = [
@ -52,8 +52,8 @@ mkDerivation rec {

  dontWrapQtApps = true;
  preFixup = ''
-    wrapQtApp $out/bin/qrenderdoc --suffix LD_LIBRARY_PATH : "$out/lib:${vulkan-loader}/lib"
-    wrapProgram $out/bin/renderdoccmd --suffix LD_LIBRARY_PATH : "$out/lib:${vulkan-loader}/lib"
+    wrapQtApp $out/bin/qrenderdoc --suffix LD_LIBRARY_PATH : "$out/lib:${vulkan-loader}/lib:${libglvnd}/lib"
+    wrapProgram $out/bin/renderdoccmd --suffix LD_LIBRARY_PATH : "$out/lib:${vulkan-loader}/lib:${libglvnd}/lib"
  '';

  # The only documentation for this so far is in pkgs/build-support/add-opengl-runpath/setup-hook.sh
--- a/pkgs/applications/graphics/scantailor/advanced.nix
+++ b/pkgs/applications/graphics/scantailor/advanced.nix
@ -1,8 +1,8 @@
-{ stdenv, fetchFromGitHub
+{ stdenv, fetchFromGitHub, mkDerivation
 , cmake, libjpeg, libpng, libtiff, boost
 , qtbase, qttools }:

-stdenv.mkDerivation rec {
+mkDerivation rec {
  pname = "scantailor-advanced";
  version = "1.0.16";

--- a/pkgs/applications/graphics/tev/default.nix
+++ b/pkgs/applications/graphics/tev/default.nix
@ -5,14 +5,14 @@

 stdenv.mkDerivation rec {
  pname = "tev";
-  version = "1.14";
+  version = "1.15";

  src = fetchFromGitHub {
    owner = "Tom94";
    repo = pname;
    rev = "v${version}";
    fetchSubmodules = true;
-    sha256 = "1g86wl0sdn0wprfxff2q1yc1hiq9fndmzhyvj09cw51lzbab5faw";
+    sha256 = "173nxvj30xmbdj8fc3rbw0mlicxy6zbhxv01i7z5nmcdvpamkdx6";
  };

  nativeBuildInputs = [ cmake wrapGAppsHook ];
@ -46,6 +46,7 @@ stdenv.mkDerivation rec {
      types of images can also be loaded.
    '';
    inherit (src.meta) homepage;
+    changelog = "https://github.com/Tom94/tev/releases/tag/v${version}";
    license = licenses.bsd3;
    platforms = platforms.unix;
    maintainers = with maintainers; [ primeos ];
--- a/pkgs/applications/misc/bitcoinarmory/default.nix
+++ b/pkgs/applications/misc/bitcoinarmory/default.nix
@ -1,92 +0,0 @@
-{ stdenv, fetchFromGitHub, pythonPackages
-, pkgconfig, autoreconfHook, rsync
-, swig, qt48Full, fcgi
-, bitcoin, procps, utillinux
-}:
-let
-
-  version = "0.96.1";
-  inherit (pythonPackages) buildPythonApplication pyqt4 psutil twisted;
-
-in buildPythonApplication {
-
-  pname = "bitcoinarmory";
-  inherit version;
-
-  src = fetchFromGitHub {
-    owner = "goatpig";
-    repo = "BitcoinArmory";
-    rev = "v${version}";
-    sha256 = "0pjk5qx16n3kvs9py62666qkwp2awkgd87by4karbj7vk6p1l14h"; fetchSubmodules = true;
-  };
-
-  format = "other";
-
-  # FIXME bitcoind doesn't die on shutdown. Need some sort of patch to fix that.
-  #patches = [ ./shutdown-fix.patch ];
-
-  nativeBuildInputs = [
-    autoreconfHook
-    pkgconfig
-    swig
-    pyqt4
-    qt48Full
-    rsync # used by silly install script (TODO patch upstream)
-  ];
-  buildInputs = [
-    qt48Full
-    fcgi
-  ];
-
-  propagatedBuildInputs = [
-    pyqt4
-    psutil
-    twisted
-  ];
-
-  makeFlags = [ "PREFIX=$(out)" ];
-
-  makeWrapperArgs = [
-    "--prefix            PATH : ${bitcoin}/bin"   # for `bitcoind`
-    "--prefix            PATH : ${procps}/bin"    # for `free`
-    "--prefix            PATH : ${utillinux}/bin" # for `whereis`
-    "--suffix LD_LIBRARY_PATH : $out/lib"         # for python bindings built as .so files
-    "--run    cd\\ $out/lib/armory"               # so that GUI resources can be loaded
-  ];
-
-  # auditTmpdir runs during fixupPhase, so patchelf before that
-  preFixup = ''
-    newRpath=$(patchelf --print-rpath $out/bin/ArmoryDB | sed -r 's|(.*)(/tmp/nix-build-.*libfcgi/.libs:?)(.*)|\1\3|')
-    patchelf --set-rpath $out/lib:$newRpath $out/bin/ArmoryDB
-  '';
-
-  # fixupPhase of mkPythonDerivation wraps $out/bin/*, so this needs to come after
-  postFixup = ''
-    wrapPythonProgramsIn $out/lib/armory "$out $pythonPath"
-    ln -sf $out/lib/armory/ArmoryQt.py $out/bin/armory
-  '';
-
-  meta = {
-    description = "Bitcoin wallet with cold storage and multi-signature support";
-    longDescription = ''
-      Armory is the most secure and full featured solution available for users
-      and institutions to generate and store Bitcoin private keys. This means
-      users never have to trust the Armory team and can use it with the Glacier
-      Protocol. Satoshi would be proud!
-
-      Users are empowered with multiple encrypted Bitcoin wallets and permanent
-      one-time ‘paper backups’. Armory pioneered cold storage and distributed
-      multi-signature. Bitcoin cold storage is a system for securely storing
-      Bitcoins on a completely air-gapped offline computer.
-
-      Maintainer's note: The original authors at https://bitcoinarmory.com/
-      discontinued development. I elected instead to package GitHub user
-      @goatpig's fork, as it's the most active, at time of this writing.
-    '';
-    homepage = https://github.com/goatpig/BitcoinArmory;
-    license = stdenv.lib.licenses.agpl3Plus;
-    maintainers = with stdenv.lib.maintainers; [ elitak ];
-    platforms = [ "i686-linux" "x86_64-linux" ];
-  };
-
-}
--- a/pkgs/applications/misc/electron-cash/default.nix
+++ b/pkgs/applications/misc/electron-cash/default.nix
@ -36,7 +36,7 @@ python3Packages.buildPythonApplication rec {

  postPatch = ''
    substituteInPlace contrib/requirements/requirements.txt \
-      --replace "qdarkstyle<2.6" "qdarkstyle<3"
+      --replace "qdarkstyle==2.6.8" "qdarkstyle<3"

    substituteInPlace setup.py \
      --replace "(share_dir" "(\"share\""
--- a/pkgs/applications/misc/etesync-dav/default.nix
+++ b/pkgs/applications/misc/etesync-dav/default.nix
@ -2,11 +2,11 @@

 python3Packages.buildPythonApplication rec {
  pname = "etesync-dav";
-  version = "0.14.2";
+  version = "0.15.0";

  src = python3Packages.fetchPypi {
    inherit pname version;
-    sha256 = "05kzy74r2hd44sqjgd0bc588ganrzbz5brpiginb8sh8z38igb60";
+    sha256 = "1rjp4lhxs6g5yw99rrdg5v98vcvagsabkqf51k1fhhsmbj47mdsm";
  };

  propagatedBuildInputs = with python3Packages; [
--- a/pkgs/applications/misc/fusee-interfacee-tk/default.nix
+++ b/pkgs/applications/misc/fusee-interfacee-tk/default.nix
@ -0,0 +1,40 @@
+{ stdenv , fetchFromGitHub , python3 , makeWrapper }: 
+
+let pythonEnv = python3.withPackages(ps: [ ps.tkinter ps.pyusb ]); 
+in stdenv.mkDerivation rec { 
+  pname = "fusee-interfacee-tk";
+  version = "1.0.0";
+
+  src = fetchFromGitHub { 
+    owner = "nh-server";
+    repo = pname;
+    rev = "V${version}"; 
+    sha256 = "0ycsxv71b5yvkcawxmcnmywxfvn8fdg1lyq71xdw7qrskxv5fgq7";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ pythonEnv ];
+
+  installPhase = '' 
+    mkdir -p $out/bin
+			      
+    # The program isn't just called app, so I'm renaming it based on the repo name 
+    # It also isn't a standard program, so we need to append the shebang to the top
+    echo "#!${pythonEnv.interpreter}" > $out/bin/fusee-interfacee-tk 
+    cat app.py >> $out/bin/fusee-interfacee-tk
+    chmod +x $out/bin/fusee-interfacee-tk 
+							      
+    # app.py depends on these to run 
+    cp *.py $out/bin/ 
+    cp intermezzo.bin $out/bin/intermezzo.bin
+  '';
+
+  meta = with stdenv.lib; { 
+    homepage = "https://github.com/nh-server/fusee-interfacee-tk";
+    description = "A tool to send .bin files to a Nintendo Switch in RCM mode";
+    longDescription = "A mod of falquinhos Fusée Launcher for use with Nintendo Homebrew Switch Guide. It also adds the ability to mount SD while in RCM. 
+    Must be run as sudo.";
+    maintainers = with maintainers; [ kristian-brucaj ];
+    license = licenses.gpl2;
+  };
+} 
--- a/pkgs/applications/misc/gomatrix/default.nix
+++ b/pkgs/applications/misc/gomatrix/default.nix
@ -0,0 +1,22 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "gomatrix";
+  version = "101.0.0";
+
+  src = fetchFromGitHub {
+    owner = "GeertJohan";
+    repo = "gomatrix";
+    rev = "v${version}";
+    sha256 = "1wq55rvpyz0gjn8kiwwj49awsmi86zy1fdjcphzgb7883xalgr2m";
+  };
+
+  modSha256 = "13higizadnf4ypk8qn1b5s6mdg7n6l3indb43mjp1b4cfzjsyl91";
+
+  meta = with lib; {
+    description = ''Displays "The Matrix" in a terminal'';
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ skykanin ];
+    homepage = "https://github.com/GeertJohan/gomatrix";
+  };
+}
--- a/pkgs/applications/misc/gummi/default.nix
+++ b/pkgs/applications/misc/gummi/default.nix
@ -1,37 +1,33 @@
-{ stdenv, pkgs, makeWrapper, pango
-, glib, gnome2, gnome3, gtk2-x11, gtkspell2, poppler
+{ stdenv, pkgs
+, glib, gnome3, gtk3, gtksourceview3, gtkspell3, poppler, texlive
 , pkgconfig, intltool, autoreconfHook, wrapGAppsHook
 }:

 stdenv.mkDerivation rec {
-  version = "0.6.6";
+  version = "0.8.1";
  pname = "gummi";

  src = pkgs.fetchFromGitHub {
    owner = "alexandervdm";
    repo = "gummi";
    rev = version;
-    sha256 = "1vw8rhv8qj82l6l22kpysgm9mxilnki2kjmvxsnajbqcagr6s7cn";
+    sha256 = "0wxgmzazqiq77cw42i5fn2hc22hhxf5gbpl9g8y3zlnp21lw9y16";
  };

  nativeBuildInputs = [
-    pkgconfig intltool autoreconfHook makeWrapper wrapGAppsHook
+    pkgconfig intltool autoreconfHook wrapGAppsHook
  ];
  buildInputs = [
-    glib gnome2.gtksourceview pango gtk2-x11 gtkspell2 poppler
-    gnome3.adwaita-icon-theme
+    glib gtksourceview3 gtk3 gtkspell3 poppler
+    texlive.bin.core # needed for synctex
  ];

-  preConfigure = ''
-    gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${pkgs.gnome2.gtksourceview}/share")
-  '';
-
  postInstall = ''
    install -Dpm644 COPYING $out/share/licenses/$name/COPYING
  '';

  meta = {
-    homepage = http://gummi.midnightcoding.org/;
+    homepage = "https://gummi.app";
    description = "Simple LaTex editor for GTK users";
    license = stdenv.lib.licenses.mit;
    maintainers = with stdenv.lib.maintainers; [ flokli ];
--- a/pkgs/applications/misc/hugo/default.nix
+++ b/pkgs/applications/misc/hugo/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "hugo";
-  version = "0.66.0";
+  version = "0.67.0";

  goPackagePath = "github.com/gohugoio/hugo";

@ -10,7 +10,7 @@ buildGoModule rec {
    owner = "gohugoio";
    repo = pname;
    rev = "v${version}";
-    sha256 = "177vqxzmldpkpaj7giqlbl39091fa2ga2pnshdj6gc393rw52f0a";
+    sha256 = "0rgwrcs1ydwccyf714zpn3427p8zlwynn0q1v8k5j63zxr91jdbq";
  };

  modSha256 = "1f320zbqnv2ybsp3qmlgn3rsjgp2zdb24qjd3gcys30mw48cx3na";
--- a/pkgs/applications/misc/kitty/default.nix
+++ b/pkgs/applications/misc/kitty/default.nix
@ -2,6 +2,7 @@
  harfbuzz, fontconfig, pkgconfig, ncurses, imagemagick, xsel,
  libstartup_notification, libGL, libX11, libXrandr, libXinerama, libXcursor,
  libxkbcommon, libXi, libXext, wayland-protocols, wayland,
+  installShellFiles,
  which, dbus,
  Cocoa,
  CoreGraphics,
@ -12,8 +13,6 @@
  libcanberra,
  libicns,
  libpng,
-  librsvg,
-  optipng,
  python3,
  zlib,
 }:
@ -55,8 +54,7 @@ buildPythonApplication rec {
  ] ++ stdenv.lib.optionals stdenv.isDarwin [
    imagemagick
    libicns  # For the png2icns tool.
-    librsvg
-    optipng
+    installShellFiles
  ];

  propagatedBuildInputs = stdenv.lib.optional stdenv.isLinux libGL;
@ -82,6 +80,7 @@ buildPythonApplication rec {

  buildPhase = if stdenv.isDarwin then ''
    ${python.interpreter} setup.py kitty.app --update-check-interval=0
+    make man
  '' else ''
    ${python.interpreter} setup.py linux-package --update-check-interval=0
  '';
@ -94,6 +93,8 @@ buildPythonApplication rec {
    ln -s ../Applications/kitty.app/Contents/MacOS/kitty "$out/bin/kitty"
    mkdir "$out/Applications"
    cp -r kitty.app "$out/Applications/kitty.app"
+
+    installManPage 'docs/_build/man/kitty.1'
    '' else ''
    cp -r linux-package/{bin,share,lib} $out
    ''}
--- a/pkgs/applications/misc/pytrainer/default.nix
+++ b/pkgs/applications/misc/pytrainer/default.nix
@ -57,6 +57,7 @@ python3.pkgs.buildPythonApplication rec {
    psycopg2
    requests
    certifi
+    setuptools
  ];

  nativeBuildInputs = [
--- a/pkgs/applications/networking/browsers/chromium/patches/vaapi-fix.patch
+++ b/pkgs/applications/networking/browsers/chromium/patches/vaapi-fix.patch
@ -1,6 +1,6 @@
 --- a/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
 +++ b/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
-@@ -635,6 +635,7 @@
+@@ -641,6 +641,7 @@ void VaapiVideoDecodeAccelerator::AssignPictureBuffers(
   // |vpp_vaapi_wrapper_| for VaapiPicture to DownloadFromSurface() the VA's
   // internal decoded frame.
   if (buffer_allocation_mode_ != BufferAllocationMode::kNone &&
@ -8,24 +8,22 @@
       !vpp_vaapi_wrapper_) {
     vpp_vaapi_wrapper_ = VaapiWrapper::Create(
         VaapiWrapper::kVideoProcess, VAProfileNone,
-@@ -650,7 +651,8 @@
-     // only used as a copy destination. Therefore, the VaapiWrapper used and
-     // owned by |picture| is |vpp_vaapi_wrapper_|.
+@@ -665,7 +666,8 @@ void VaapiVideoDecodeAccelerator::AssignPictureBuffers(
+     PictureBuffer buffer = buffers[i];
+     buffer.set_size(requested_pic_size_);
     std::unique_ptr<VaapiPicture> picture = vaapi_picture_factory_->Create(
 -        (buffer_allocation_mode_ == BufferAllocationMode::kNone)
 +        ((buffer_allocation_mode_ == BufferAllocationMode::kNone) ||
 +         (buffer_allocation_mode_ == BufferAllocationMode::kWrapVdpau))
             ? vaapi_wrapper_
             : vpp_vaapi_wrapper_,
-         make_context_current_cb_, bind_image_cb_, buffers[i]);
-@@ -1077,6 +1079,14 @@
+         make_context_current_cb_, bind_image_cb_, buffer);
+@@ -1093,6 +1095,12 @@ VaapiVideoDecodeAccelerator::GetSupportedProfiles() {

 VaapiVideoDecodeAccelerator::BufferAllocationMode
 VaapiVideoDecodeAccelerator::DecideBufferAllocationMode() {
 +  // NVIDIA blobs use VDPAU
-+  if (base::StartsWith(VaapiWrapper::GetVendorStringForTesting(),
-+              "Splitted-Desktop Systems VDPAU",
-+              base::CompareCase::SENSITIVE)) {
+  if (VaapiWrapper::GetImplementationType() == VAImplementation::kNVIDIAVDPAU) {
 +    LOG(INFO) << "VA-API driver on VDPAU backend";
 +    return BufferAllocationMode::kWrapVdpau;
 +  }
@ -33,7 +31,7 @@
   // TODO(crbug.com/912295): Enable a better BufferAllocationMode for IMPORT
   // |output_mode_| as well.
   if (output_mode_ == VideoDecodeAccelerator::Config::OutputMode::IMPORT)
-@@ -1089,7 +1099,7 @@
+@@ -1105,7 +1113,7 @@ VaapiVideoDecodeAccelerator::DecideBufferAllocationMode() {
   // depends on the bitstream and sometimes it's not enough to cover the amount
   // of frames needed by the client pipeline (see b/133733739).
   // TODO(crbug.com/911754): Enable for VP9 Profile 2.
@ -44,7 +42,7 @@
     // an extra allocation for both |client_| and |decoder_|, see
 --- a/media/gpu/vaapi/vaapi_video_decode_accelerator.h
 +++ b/media/gpu/vaapi/vaapi_video_decode_accelerator.h
-@@ -204,6 +204,7 @@
+@@ -204,6 +204,7 @@ class MEDIA_GPU_EXPORT VaapiVideoDecodeAccelerator
     // Using |client_|s provided PictureBuffers and as many internally
     // allocated.
     kNormal,
@ -52,3 +50,25 @@
   };

   // Decides the concrete buffer allocation mode, depending on the hardware
+--- a/media/gpu/vaapi/vaapi_wrapper.cc
+++ b/media/gpu/vaapi/vaapi_wrapper.cc
+@@ -131,6 +131,9 @@ media::VAImplementation VendorStringToImplementationType(
+   } else if (base::StartsWith(va_vendor_string, "Intel iHD driver",
+                               base::CompareCase::SENSITIVE)) {
+     return media::VAImplementation::kIntelIHD;
+  } else if (base::StartsWith(va_vendor_string, "Splitted-Desktop Systems VDPAU",
+                              base::CompareCase::SENSITIVE)) {
+    return media::VAImplementation::kNVIDIAVDPAU;
+   }
+   return media::VAImplementation::kOther;
+ }
+--- a/media/gpu/vaapi/vaapi_wrapper.h
+++ b/media/gpu/vaapi/vaapi_wrapper.h
+@@ -79,6 +79,7 @@ enum class VAImplementation {
+   kIntelIHD,
+   kOther,
+   kInvalid,
+  kNVIDIAVDPAU,
+ };
+
+ // This class handles VA-API calls and ensures proper locking of VA-API calls
--- a/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/beta_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/devedition_sources.nix
--- a/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
+++ b/pkgs/applications/networking/browsers/firefox-bin/release_sources.nix
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -93,16 +93,12 @@ stdenv.mkDerivation ({

  patches = [
    ./env_var_for_system_dir.patch
-  ] ++ lib.optionals (stdenv.isAarch64) [
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/archlinuxarm/PKGBUILDs/09c7fa0dc1d87922e3b464c0fa084df1227fca79/extra/firefox/arm.patch";
-      sha256 = "1vbpih23imhv5r3g21m3m541z08n9n9j1nvmqax76bmyhn7mxp32";
-    })
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/archlinuxarm/PKGBUILDs/09c7fa0dc1d87922e3b464c0fa084df1227fca79/extra/firefox/build-arm-libopus.patch";
-      sha256 = "1zg56v3lc346fkzcjjx21vjip2s9hb2xw4pvza1dsfdnhsnzppfp";
-    })
  ]
+  ++ lib.optional (lib.versionAtLeast ffversion "73") (fetchpatch {
+    # https://phabricator.services.mozilla.com/D60667
+    url = "https://hg.mozilla.org/mozilla-central/raw-rev/b3d8b08265b800165d684281d19ac845a8ff9a66";
+    sha256 = "0b4s75w7sl619rglcjmlyvyibpj2ar5cpy6pnywl1xpd9qzyb27p";
+  })
  ++ patches;


--- a/pkgs/applications/networking/browsers/firefox/packages.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages.nix
@ -33,10 +33,10 @@ rec {

  firefox-esr-68 = common rec {
    pname = "firefox-esr";
-    ffversion = "68.5.0esr";
+    ffversion = "68.6.0esr";
    src = fetchurl {
      url = "mirror://mozilla/firefox/releases/${ffversion}/source/firefox-${ffversion}.source.tar.xz";
-      sha512 = "39i05r7r4rh2jvc8v4m2s2i6d33qaa075a1lc8m9gx7s3rw8yxja2c42cv5hq1imr9zc4dldbk88paz6lv1w8rhncm0dkxw8z6lxkqa";
+      sha512 = "2ipajk86s7hfz7qky9lh24i5fgzgpv9hl12invr1rr6jhpp0h6gbb44ffim0z9lmcj49cr01cgqis0swhb4vph8dl1jvgfq9rjmsml4";
    };

    patches = [
--- a/pkgs/applications/networking/browsers/next/default.nix
+++ b/pkgs/applications/networking/browsers/next/default.nix
@ -15,13 +15,13 @@ in

 stdenv.mkDerivation rec {
  pname = "next";
-  version = "1.4.0";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "atlas-engineer";
    repo = "next";
    rev = version;
-    sha256 = "1gkmr746rqqg94698a051gv79fblc8n9dq0zg04llba44adhpmjl";
+    sha256 = "1gqkp185wcwaxr8py90hqk44nqjblrrdwvig19gizrbzr2gx2zhy";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@ -15,13 +15,13 @@ with lib;

 stdenv.mkDerivation rec {
  pname = "kubernetes";
-  version = "1.16.5";
+  version = "1.17.3";

  src = fetchFromGitHub {
    owner = "kubernetes";
    repo = "kubernetes";
    rev = "v${version}";
-    sha256 = "12ks79sjgbd0c97pipid4j3l5fwiimaxa25rvmf2vccdrw4ngx4m";
+    sha256 = "0caqczz8hrwqb8j94158hz6919i7c9v1v0zknh9m2zbbng4b1awi";
  };

  buildInputs = [ removeReferencesTo makeWrapper which go rsync go-bindata ];
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -2,7 +2,7 @@

 buildGoPackage rec {
  pname = "terragrunt";
-  version = "0.21.11";
+  version = "0.23.2";

  goPackagePath = "github.com/gruntwork-io/terragrunt";

@ -10,7 +10,7 @@ buildGoPackage rec {
    owner  = "gruntwork-io";
    repo   = "terragrunt";
    rev    = "v${version}";
-    sha256 = "1w64skk67i0sxjd2mkyqh3nglc32wc7schk7h8fwszpa1rw4dfcn";
+    sha256 = "1r3q7faxys0h147cr9154pcix1qgj36v41ja9hhbggm4c7vig4s1";
  };

  goDeps = ./deps.nix;
--- a/pkgs/applications/networking/cluster/terragrunt/deps.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/deps.nix
@ -5,8 +5,17 @@
    fetch = {
      type = "git";
      url = "https://code.googlesource.com/gocloud";
-      rev =  "28a4bc8c44b3acbcc482cff0cdf7de29a4688b61";
-      sha256 = "0j40msxm72m8gs87rpwkk19iagjj387r42xwxszmrna7il8g0sbl";
+      rev =  "d96ccb2ba7586bb79a416471882d347754a78ce5";
+      sha256 = "18f1l28665x1a8j8a5bh2i7wb2vrwj050d1g5qda50isgqaybixd";
+    };
+  }
+  {
+    goPackagePath  = "github.com/BurntSushi/toml";
+    fetch = {
+      type = "git";
+      url = "https://github.com/BurntSushi/toml";
+      rev =  "3012a1dbe2e4bd1391d42b32f0577cb7bbc7f005";
+      sha256 = "1fjdwwfzyzllgiwydknf1pwjvy49qxfsczqx5gz3y0izs7as99j6";
    };
  }
  {
@ -243,6 +252,15 @@
      sha256 = "1r6w7ydx8ydryxk3sfhzsk8m6f1nsik9jg3i1zhi69v4kfl4d5cz";
    };
  }
+  {
+    goPackagePath  = "github.com/jstemmer/go-junit-report";
+    fetch = {
+      type = "git";
+      url = "https://github.com/jstemmer/go-junit-report";
+      rev =  "cc1f095d5cc5eca2844f5c5ea7bb37f6b9bf6cac";
+      sha256 = "1knip80yir1cdsjlb3rzy0a4w3kl4ljpiciaz6hjzwqlfhnv7bkw";
+    };
+  }
  {
    goPackagePath  = "github.com/mattn/go-colorable";
    fetch = {
@ -378,6 +396,33 @@
      sha256 = "17g8fb9vy2sqq8vgz8jdvf6c6d2290gm2qs0i4yzsd86mgn4dlrg";
    };
  }
+  {
+    goPackagePath  = "golang.org/x/exp";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/exp";
+      rev =  "f17229e696bd4e065144fd6ae1313e41515abbdc";
+      sha256 = "0q1fij8izg7xcnx7wqh0zdnya11k3d9a5fqm0yb2r93jhlf3x128";
+    };
+  }
+  {
+    goPackagePath  = "golang.org/x/lint";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/lint";
+      rev =  "910be7a94367618fd0fd25eaabbee4fdc0ac7092";
+      sha256 = "08gskshgfwxhmm9i4vgd4q7kqd5i7yihqh33v6r07br6kqd0g995";
+    };
+  }
+  {
+    goPackagePath  = "golang.org/x/mod";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/mod";
+      rev =  "ed3ec21bb8e252814c380df79a80f366440ddb2d";
+      sha256 = "1fp6885dclq77mh73v7i54v2b9llpv4di193zc8vmsbbkkc483cl";
+    };
+  }
  {
    goPackagePath  = "golang.org/x/net";
    fetch = {
@ -414,13 +459,31 @@
      sha256 = "0flv9idw0jm5nm8lx25xqanbkqgfiym6619w575p7nrdh0riqwqh";
    };
  }
+  {
+    goPackagePath  = "golang.org/x/tools";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/tools";
+      rev =  "49b8ac185c84c5092be0953fb92b7660db9b8162";
+      sha256 = "0ccsm8p9i83f0s0z5c7jwyzj7jgcg60zf20hzrmp705669wn5y67";
+    };
+  }
+  {
+    goPackagePath  = "golang.org/x/xerrors";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/xerrors";
+      rev =  "9bdfabe68543c54f90421aeb9a60ef8061b5b544";
+      sha256 = "1yjfi1bk9xb81lqn85nnm13zz725wazvrx3b50hx19qmwg7a4b0c";
+    };
+  }
  {
    goPackagePath  = "google.golang.org/api";
    fetch = {
      type = "git";
      url = "https://code.googlesource.com/google-api-go-client";
-      rev =  "890e5eb51fe205e56dc55eb68d63e82039730816";
-      sha256 = "05r2wsjnmszsz4y59w8q6qknc7zq1mc56kya61i2133dqxyc55ai";
+      rev =  "e9c39defab7fc4be8ec95d4ce422dbeae4070400";
+      sha256 = "01wjr07xnb9s32y2jc6d0rba3jxwccd2wydm6cql41yhyr3x84rd";
    };
  }
  {
@ -446,8 +509,17 @@
    fetch = {
      type = "git";
      url = "https://github.com/grpc/grpc-go";
-      rev =  "501c41df7f472c740d0674ff27122f3f48c80ce7";
-      sha256 = "0hla9rjvyi6wjak4cw39ic8jkdcd0lsymhrz9sa52bfybxsczf38";
+      rev =  "f495f5b15ae7ccda3b38c53a1bfcde4c1a58a2bc";
+      sha256 = "09phrrsafgq6hnbw8cawvx44bdpk1p584fys17x1bwn0j0451zzs";
+    };
+  }
+  {
+    goPackagePath  = "honnef.co/go/tools";
+    fetch = {
+      type = "git";
+      url = "https://github.com/dominikh/go-tools";
+      rev =  "afd67930eec2a9ed3e9b19f684d17a062285f16a";
+      sha256 = "1rwwahmbs4dwxncwjj56likir1kps9937vm2id3rygxzzla40zal";
    };
  }
 ]
--- a/pkgs/applications/networking/datovka/default.nix
+++ b/pkgs/applications/networking/datovka/default.nix
@ -11,11 +11,11 @@

 mkDerivation rec {
  pname = "datovka";
-  version = "4.14.1";
+  version = "4.15.0";

  src = fetchurl {
    url = "https://secure.nic.cz/files/datove_schranky/${version}/${pname}-${version}.tar.xz";
-    sha256 = "0jinxsm2zw77294vz9pjiqpgpzdwx5nijsi4nqzxna5rkmwdyxk6";
+    sha256 = "1f311qnyiay34iqpik4x492py46my89j4nnbdf6qcidnydzas8r1";
  };

  buildInputs = [ libisds qmake qtbase qtsvg libxml2 ];
--- a/pkgs/applications/networking/dyndns/cfdyndns/default.nix
+++ b/pkgs/applications/networking/dyndns/cfdyndns/default.nix
@ -1,23 +1,21 @@
-{ stdenv, fetchFromGitHub, rustPlatform, makeWrapper, openssl }:
+{ stdenv, fetchFromGitHub, rustPlatform, pkg-config, openssl }:

 with rustPlatform;

 buildRustPackage rec {
  pname = "cfdyndns";
-  version = "0.0.1";
+  version = "0.0.3";
  src = fetchFromGitHub {
    owner = "colemickens";
    repo = "cfdyndns";
    rev = "v${version}";
-    sha256 = "1mcdjykrgh0jq6k6y664lai8sbgzk6j7k0r944f43vg63d1jql5b";
+    sha256 = "1fba0w2979dmc2wyggqx4fj52rrl1s2vpjk6mkj1811a848l1hdi";
  };

-  # Delete this on next update; see #79975 for details
-  legacyCargoFetcher = true;
+  cargoSha256 = "04ryin24z3pfxjxy4smngy66xs7k85g6gdzsl77cij8ifb29im99";

-  cargoSha256 = "1d7jpffkw2m2v37bfdqsl9sqwsl19cgglpa00lwy4ih09kzbc2n9";
-
-  buildInputs = [ makeWrapper openssl ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ];

  installPhase = ''
    mkdir -p $out/bin
@ -30,6 +28,5 @@ buildRustPackage rec {
    license = stdenv.lib.licenses.mit;
    maintainers = with maintainers; [ colemickens ];
    platforms = with platforms; linux;
-    broken = true;
  };
 }
--- a/pkgs/applications/networking/flexget/default.nix
+++ b/pkgs/applications/networking/flexget/default.nix
@ -52,6 +52,8 @@ python3Packages.buildPythonApplication rec {
    sqlalchemy
    terminaltables
    zxcvbn
+    # plugins
+    transmissionrpc
  ];

  meta = with lib; {
--- a/pkgs/applications/networking/instant-messengers/ripcord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ripcord/default.nix
@ -0,0 +1,69 @@
+{ lib, mkDerivation, fetchurl, makeFontsConf, appimageTools,
+  qtbase, qtsvg, qtmultimedia, qtwebsockets, qtimageformats,
+  autoPatchelfHook, desktop-file-utils, imagemagick, makeWrapper,
+  twemoji-color-font, xorg, libsodium, libopus, libGL, zlib, alsaLib }:
+
+mkDerivation rec {
+  pname = "ripcord";
+  version = "0.4.23";
+
+  src = let
+    appimage = fetchurl {
+      url = "https://cancel.fm/dl/Ripcord-${version}-x86_64.AppImage";
+      sha256 = "0395w0pwr1cz8ichcbyrsscmm2p7srgjk4vkqvqgwyx41prm0x2h";
+      name = "${pname}-${version}.AppImage";
+    };
+  in appimageTools.extract {
+    name = "${pname}-${version}";
+    src = appimage;
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook desktop-file-utils imagemagick ];
+  buildInputs = [ libsodium libopus libGL alsaLib ] ++
+                [ qtbase qtsvg qtmultimedia qtwebsockets qtimageformats ] ++
+                (with xorg; [ libX11 libXScrnSaver libXcursor xkeyboardconfig ]);
+
+  fontsConf = makeFontsConf {
+    fontDirectories = [ twemoji-color-font ];
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out
+    cp -r ${src}/{qt.conf,translations,twemoji.ripdb} $out
+
+    for size in 16 32 48 64 72 96 128 192 256 512 1024; do
+      mkdir -p $out/share/icons/hicolor/"$size"x"$size"/apps
+      convert -resize "$size"x"$size" ${src}/Ripcord_Icon.png $out/share/icons/hicolor/"$size"x"$size"/apps/ripcord.png
+    done
+
+    desktop-file-install --dir $out/share/applications \
+      --set-key Exec --set-value ripcord \
+      --set-key Icon --set-value ripcord \
+      --set-key Comment --set-value "${meta.description}" \
+      ${src}/Ripcord.desktop
+    mv $out/share/applications/Ripcord.desktop $out/share/applications/ripcord.desktop
+
+    install -Dm755 ${src}/Ripcord $out/Ripcord
+    patchelf --replace-needed libsodium.so.18 libsodium.so $out/Ripcord
+    makeQtWrapper $out/Ripcord $out/bin/ripcord \
+      --run "cd $out" \
+      --set FONTCONFIG_FILE "${fontsConf}" \
+      --prefix LD_LIBRARY_PATH ":" "${xorg.libXcursor}/lib" \
+      --prefix QT_XKB_CONFIG_ROOT ":" "${xorg.xkeyboardconfig}/share/X11/xkb"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Desktop chat client for Slack and Discord";
+    homepage = "https://cancel.fm/ripcord/";
+
+    # See: https://cancel.fm/ripcord/shareware-redistribution/
+    license = licenses.unfreeRedistributable;
+
+    maintainers = with maintainers; [ infinisil ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/networking/irc/weechat/scripts/weechat-autosort/default.nix
+++ b/pkgs/applications/networking/irc/weechat/scripts/weechat-autosort/default.nix
@ -20,6 +20,6 @@ stdenv.mkDerivation rec {
    description = "Autosort is a weechat script to automatically or manually keep your buffers sorted";
    homepage = https://github.com/de-vri-es/weechat-autosort;
    license = licenses.gpl3;
-    maintainers = with maintainers; [ ma27 emily ];
+    maintainers = with maintainers; [ emily ];
  };
 }
--- a/pkgs/applications/networking/maestral/default.nix
+++ b/pkgs/applications/networking/maestral/default.nix
@ -1,24 +1,40 @@
-{ stdenv, lib, python3Packages, fetchFromGitHub
-, withGui ? false, wrapQtAppsHook ? null }:
+{ stdenv
+, lib
+, fetchFromGitHub
+, python3
+, withGui ? false
+, wrapQtAppsHook ? null
+}:

-python3Packages.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication rec {
  pname = "maestral${lib.optionalString withGui "-gui"}";
-  version = "0.4.2";
+  version = "0.6.1";
+
+  disabled = python3.pkgs.pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "SamSchott";
    repo = "maestral-dropbox";
    rev = "v${version}";
-    sha256 = "0xis0cqfp3wgajwk44dmi2gbfirmz0a0zi25qxdzpdn0z19hp88m";
+    sha256 = "06i3c7i85x879np158156mba7kxz2cwh75390sc9gwwngc95d9h9";
  };

-  disabled = python3Packages.pythonOlder "3.6";
-
-  propagatedBuildInputs = (with python3Packages; [
-    blinker click dropbox keyring keyrings-alt Pyro4 requests u-msgpack-python watchdog
+  propagatedBuildInputs = with python3.pkgs; [
+    blinker
+    bugsnag
+    click
+    dropbox
+    keyring
+    keyrings-alt
+    lockfile
+    Pyro5
+    requests
+    u-msgpack-python
+    watchdog
  ] ++ lib.optionals stdenv.isLinux [
-    sdnotify systemd
-  ] ++ lib.optional withGui pyqt5);
+    sdnotify
+    systemd
+  ] ++ lib.optional withGui pyqt5;

  nativeBuildInputs = lib.optional withGui wrapQtAppsHook;

--- a/pkgs/applications/networking/p2p/soulseekqt/default.nix
+++ b/pkgs/applications/networking/p2p/soulseekqt/default.nix
@ -1,59 +1,57 @@
-{ stdenv, lib, fetchurl, mkDerivation
+{ stdenv, lib, fetchzip, mkDerivation
+, appimageTools
 , autoPatchelfHook
-, dbus
 , desktop-file-utils
-, fontconfig
-, libjson
-, pythonPackages
+, imagemagick
 , qtmultimedia
-, squashfsTools
-, zlib
 }:

 mkDerivation rec {
  pname = "soulseekqt";
  version = "2018-1-30";
+  name="${pname}-${version}";

-  src = fetchurl {
-      urls = [
-        "https://www.dropbox.com/s/0vi87eef3ooh7iy/SoulseekQt-${version}.tgz"
-        "https://www.slsknet.org/SoulseekQt/Linux/SoulseekQt-${version}-64bit-appimage.tgz"
-      ];
-      sha256 = "0d1cayxr1a4j19bc5a3qp9pg22ggzmd55b6f5av3lc6lvwqqg4w6";
-    };
+  src = fetchzip {
+      url = "https://www.slsknet.org/SoulseekQt/Linux/SoulseekQt-${version}-64bit-appimage.tgz";
+      sha256 = "16ncnvv8h33f161mgy7qc0wjvvqahsbwvby65qhgfh9pbbgb4xgg";
+  };
+
+  appextracted = appimageTools.extractType2 {
+    inherit name;
+    src="${src}/SoulseekQt-2018-1-30-64bit.AppImage";
+  };

  dontBuild = true;
-
-  nativeBuildInputs = [ autoPatchelfHook pythonPackages.binwalk squashfsTools desktop-file-utils ];
+  dontConfigure = true;
+  
+  nativeBuildInputs = [ imagemagick autoPatchelfHook desktop-file-utils ];
  buildInputs = [ qtmultimedia stdenv.cc.cc ];

-  # avoid usage of appimage's runner option --appimage-extract
-  unpackCmd = ''
-    export HOME=$(pwd) # workaround for binwalk
-    appimage=$(tar xvf $curSrc) && binwalk --quiet \
-       $appimage -D 'squashfs:squashfs:unsquashfs %e'
-    '';
-
-  patchPhase = ''
-    cd squashfs-root/
-    binary="$(readlink AppRun)"
-
-    # fixup desktop file
-    desktop-file-edit --set-key Exec --set-value $binary default.desktop
-    desktop-file-edit --set-key Comment --set-value "${meta.description}" default.desktop
-    desktop-file-edit --set-key Categories --set-value Network default.desktop
-  '';
-
  installPhase = ''
-    mkdir -p $out/{bin,share/applications,share/icons/}
-    cp default.desktop $out/share/applications/$binary.desktop
-    cp soulseek.png $out/share/icons/
-    cp $binary $out/bin/
-  '';
+      # directory in /nix/store so readonly
+      cd $appextracted
+
+      binary="$(readlink AppRun)"
+      install -Dm755 $binary -t $out/bin
+
+      # fixup and install desktop file
+      desktop-file-install --dir $out/share/applications \
+        --set-key Exec --set-value $binary \
+        --set-key Comment --set-value "${meta.description}" \
+        --set-key Categories --set-value Network default.desktop
+      mv $out/share/applications/default.desktop $out/share/applications/SoulseekQt.desktop
+
+      #TODO: write generic code to read icon path from $binary.desktop
+      icon="$(readlink .DirIcon)"
+      for size in 16 32 48 64 72 96 128 192 256 512 1024; do
+        mkdir -p $out/share/icons/hicolor/"$size"x"$size"/apps
+        convert -resize "$size"x"$size" $icon $out/share/icons/hicolor/"$size"x"$size"/apps/$icon
+      done
+    '';

  meta = with lib; {
    description = "Official Qt SoulSeek client";
-    homepage = http://www.soulseekqt.net;
+    homepage = https://www.slsknet.org;
    license = licenses.unfree;
    maintainers = [ maintainers.genesis ];
    platforms = [ "x86_64-linux" ];
--- a/pkgs/applications/office/softmaker/freeoffice.nix
+++ b/pkgs/applications/office/softmaker/freeoffice.nix
@ -2,13 +2,13 @@

 callPackage ./generic.nix (args // rec {
  pname = "freeoffice";
-  version = "973";
+  version = "974";
  edition = "2018";
  suiteName = "FreeOffice";

  src = fetchurl {
    url = "https://www.softmaker.net/down/softmaker-freeoffice-${version}-amd64.tgz";
-    sha256 = "0xac4ynf1lfh8qmni5bhp4ybaamdfngva4bqaq21n1m4pgrx1ba5";
+    sha256 = "0z7131qmqyv1m9phm7wzvb5z7wkh27h59lsa3zc0zjkykikmjrp2";
  };

  archive = "freeoffice${edition}.tar.lzma";
--- a/pkgs/applications/science/logic/potassco/clingcon.nix
+++ b/pkgs/applications/science/logic/potassco/clingcon.nix
@ -0,0 +1,43 @@
+{ stdenv
+, fetchFromGitHub
+, cmake
+, bison
+, re2c
+}:
+
+stdenv.mkDerivation rec {
+  pname = "clingcon";
+  version = "3.3.0";
+
+  src = fetchFromGitHub {
+    owner = "potassco";
+    repo = "${pname}";
+    rev = "v${version}";
+    fetchSubmodules = true;
+    sha256 = "1q7517h10jfvjdk2czq8d6y57r8kr1j1jj2k2ip2qxkpyfigk4rs";
+   };
+
+  # deal with clingcon through git submodules recursively importing
+  # an outdated version of libpotassco which uses deprecated <xlocale.h> header in .cpp files
+  postPatch = ''
+    find ./ -type f -exec sed -i 's/<xlocale.h>/<locale.h>/g' {} \;
+  '';
+
+  nativeBuildInputs = [ cmake bison re2c ];
+
+  cmakeFlags = [
+    "-DCLINGCON_MANAGE_RPATH=ON"
+    "-DCLINGO_BUILD_WITH_PYTHON=OFF"
+    "-DCLINGO_BUILD_WITH_LUA=OFF"
+  ];
+
+  meta = {
+    inherit version;
+    description = "Extension of clingo to handle constraints over integers";
+    license = stdenv.lib.licenses.gpl3; # for now GPL3, next version MIT!
+    platforms = stdenv.lib.platforms.unix;
+    homepage = "https://potassco.org/";
+    downloadPage = "https://github.com/potassco/clingcon/releases/";
+    changelog = "https://github.com/potassco/clingcon/releases/tag/v${version}";
+  };
+}
--- a/pkgs/applications/science/logic/satallax/default.nix
+++ b/pkgs/applications/science/logic/satallax/default.nix
@ -9,6 +9,11 @@ stdenv.mkDerivation rec {
    sha256 = "1kvxn8mc35igk4vigi5cp7w3wpxk2z3bgwllfm4n3h2jfs0vkpib";
  };

+  patches = [
+    # GCC9 doesn't allow default value in friend declaration.
+    ./fix-declaration-gcc9.patch
+  ];
+
  preConfigure = ''
    mkdir fake-tools
    echo "echo 'Nix-build-host.localdomain'" > fake-tools/hostname
--- a/pkgs/applications/science/logic/satallax/fix-declaration-gcc9.patch
+++ b/pkgs/applications/science/logic/satallax/fix-declaration-gcc9.patch
@ -0,0 +1,21 @@
+diff --git i/minisat/core/SolverTypes.h w/minisat/core/SolverTypes.h
+--- i/minisat/core/SolverTypes.h
+++ w/minisat/core/SolverTypes.h
+@@ -47,7 +47,7 @@ struct Lit {
+     int     x;
+ 
+     // Use this as a constructor:
+-    friend Lit mkLit(Var var, bool sign = false);
+    friend Lit mkLit(Var var, bool sign);
+ 
+     bool operator == (Lit p) const { return x == p.x; }
+     bool operator != (Lit p) const { return x != p.x; }
+@@ -55,7 +55,7 @@ struct Lit {
+ };
+ 
+ 
+-inline  Lit  mkLit     (Var var, bool sign) { Lit p; p.x = var + var + (int)sign; return p; }
+inline  Lit  mkLit     (Var var, bool sign = false) { Lit p; p.x = var + var + (int)sign; return p; }
+ inline  Lit  operator ~(Lit p)              { Lit q; q.x = p.x ^ 1; return q; }
+ inline  Lit  operator ^(Lit p, bool b)      { Lit q; q.x = p.x ^ (unsigned int)b; return q; }
+ inline  bool sign      (Lit p)              { return p.x & 1; }
--- a/pkgs/applications/science/math/pari/default.nix
+++ b/pkgs/applications/science/math/pari/default.nix
@ -12,11 +12,11 @@ assert withThread -> libpthreadstubs != null;

 stdenv.mkDerivation rec {
  pname = "pari";
-  version = "2.11.2";
+  version = "2.11.3";

  src = fetchurl {
    url = "https://pari.math.u-bordeaux.fr/pub/pari/unix/${pname}-${version}.tar.gz";
-    sha256 = "0fck8ssmirl8fy7s4mspgrxjs5sag76xbshqlqzkcl3kqyrk4raa";
+    sha256 = "1jd65h2psrmba2dx7rkf5qidf9ka0cwbsg20pd18k45ggr30l467";
  };

  buildInputs = [
--- a/pkgs/applications/science/math/qalculate-gtk/default.nix
+++ b/pkgs/applications/science/math/qalculate-gtk/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "qalculate-gtk";
-  version = "3.7.0";
+  version = "3.8.0";

  src = fetchFromGitHub {
    owner = "qalculate";
    repo = "qalculate-gtk";
    rev = "v${version}";
-    sha256 = "1zzvxkpman75lxhhvyggwzvrlc6v0rd5ak76rmcny51i4xirmrc0";
+    sha256 = "0nsg6dzg5r7rzqr671nvrf1c50rjwpz7bxv5f20i4s7agizgv840";
  };

  patchPhase = ''
@ -23,7 +23,7 @@ stdenv.mkDerivation rec {

  meta = with stdenv.lib; {
    description = "The ultimate desktop calculator";
-    homepage = http://qalculate.github.io;
+    homepage = "http://qalculate.github.io";
    maintainers = with maintainers; [ gebner ];
    platforms = platforms.all;
  };
--- a/pkgs/applications/science/math/sage/patches/docutils-0.15.patch
+++ b/pkgs/applications/science/math/sage/patches/docutils-0.15.patch
@ -0,0 +1,24 @@
+diff --git a/src/sage/misc/sphinxify.py b/src/sage/misc/sphinxify.py
+index 4849c2bffa..76b7bc8602 100644
+--- a/src/sage/misc/sphinxify.py
+++ b/src/sage/misc/sphinxify.py
+@@ -25,6 +25,7 @@ from __future__ import absolute_import, print_function
+ import os
+ import re
+ import shutil
+import warnings
+ from tempfile import mkdtemp
+ from sphinx.application import Sphinx
+ 
+@@ -120,7 +121,10 @@ smart_quotes = no""")
+     # buildername, confoverrides, status, warning, freshenv).
+     sphinx_app = Sphinx(srcdir, confdir, outdir, doctreedir, format,
+                         confoverrides, None, None, True)
+-    sphinx_app.build(None, [rst_name])
+    with warnings.catch_warnings():
+        # Quick and dirty workaround for https://trac.sagemath.org/ticket/28856#comment:19
+        warnings.simplefilter("ignore")
+        sphinx_app.build(None, [rst_name])
+     sys.path = old_sys_path
+ 
+     # We need to remove "_" from __builtin__ that the gettext module installs
--- a/pkgs/applications/science/math/sage/sage-src.nix
+++ b/pkgs/applications/science/math/sage/sage-src.nix
@ -52,6 +52,11 @@ stdenv.mkDerivation rec {
    # Parallelize docubuild using subprocesses, fixing an isolation issue. See
    # https://groups.google.com/forum/#!topic/sage-packaging/YGOm8tkADrE
    ./patches/sphinx-docbuild-subprocesses.patch
+
+    # Fix doctest failures with docutils 0.15:
+    # https://nix-cache.s3.amazonaws.com/log/dzmzrb2zvardsmpy7idg7djkizmkzdhs-sage-tests-8.9.drv
+    # https://trac.sagemath.org/ticket/28856#comment:19
+    ./patches/docutils-0.15.patch
  ];

  # Since sage unfortunately does not release bugfix releases, packagers must
--- a/pkgs/applications/science/math/symmetrica/default.nix
+++ b/pkgs/applications/science/math/symmetrica/default.nix
@ -1,62 +1,36 @@
 { stdenv
-, fetchurl
+, lib
+, fetchFromGitLab
 , fetchpatch
+, autoreconfHook
 }:
 stdenv.mkDerivation rec {
  pname = "symmetrica";
-  version = "2.0";
+  version = "3.0.1";

-  src = fetchurl {
-    url = "http://www.algorithm.uni-bayreuth.de/en/research/SYMMETRICA/SYM2_0_tar.gz";
-    sha256 = "1qhfrbd5ybb0sinl9pad64rscr08qvlfzrzmi4p4hk61xn6phlmz";
-    name = "symmetrica-2.0.tar.gz";
+  # Fork of the original symmetrica, which can be found here
+  # http://www.algorithm.uni-bayreuth.de/en/research/SYMMETRICA/index.html
+  # "This fork was created to modernize the codebase, and to resume making
+  # releases with the fixes that have accrued over the years."
+  # Also see https://trac.sagemath.org/ticket/29061#comment:3.
+  src = fetchFromGitLab {
+    owner = "sagemath";
+    repo = "symmetrica";
+    rev = version;
+    sha256 = "0wfmrzw82f5i91d7rf24mcdqcj2fmgrgy02pw4pliz7ncwaq14w3";
  };

-  sourceRoot = ".";
-
-  patches = [
-      # don't show banner ("SYMMETRICA VERSION X - STARTING)
-      # it doesn't contain very much helpful information and a banner is not ideal for a library
-      (fetchpatch {
-        url = "https://git.sagemath.org/sage.git/plain/build/pkgs/symmetrica/patches/de.patch?id=07d6c37d18811e2b377a9689790a7c5e24da16ba";
-        sha256 = "0df0vqixcfpzny6dkhyj87h8aznz3xn3zfwwlj8pd10bpb90k6gb";
-      })
-
-      # use int32_t and uint32_t for type INT
-      # see https://trac.sagemath.org/ticket/13413
-      (fetchpatch {
-        name = "fix_64bit_integer_overflow.patch";
-        url = "https://git.sagemath.org/sage.git/plain/build/pkgs/symmetrica/patches/int32.patch?id=07d6c37d18811e2b377a9689790a7c5e24da16ba";
-        sha256 = "0p33c85ck4kd453z687ni4bdcqr1pqx2756j7aq11bf63vjz4cyz";
-      })
-
-      (fetchpatch {
-        url = "https://git.sagemath.org/sage.git/plain/build/pkgs/symmetrica/patches/return_values.patch?id=1615f58890e8f9881c4228c78a6b39b9aab1303a";
-        sha256 = "0dmczkicwl50sivc07w3wm3jpfk78wm576dr25999jdj2ipsb7nk";
-      })
+  nativeBuildInputs = [
+    autoreconfHook
  ];

-  postPatch = ''
-    substituteInPlace makefile --replace gcc cc
-  '';
-
  enableParallelBuilding = true;

-  installPhase = ''
-    mkdir -p "$out"/{lib,share/doc/symmetrica,include/symmetrica}
-    ar crs libsymmetrica.a *.o
-    ranlib libsymmetrica.a
-    cp libsymmetrica.a "$out/lib"
-    cp *.h "$out/include/symmetrica"
-    cp README *.doc "$out/share/doc/symmetrica"
-  '';
-
-  meta = {
-    inherit version;
+  meta = with lib; {
    description = ''A collection of routines for representation theory and combinatorics'';
-    license = stdenv.lib.licenses.publicDomain;
-    maintainers = [stdenv.lib.maintainers.raskin];
-    platforms = stdenv.lib.platforms.unix;
-    homepage = http://www.algorithm.uni-bayreuth.de/en/research/SYMMETRICA/index.html;
+    license = licenses.isc;
+    maintainers = with maintainers; [raskin timokau];
+    platforms = platforms.unix;
+    homepage = "https://gitlab.com/sagemath/symmetrica";
  };
 }
--- a/pkgs/applications/science/math/wxmaxima/default.nix
+++ b/pkgs/applications/science/math/wxmaxima/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "wxmaxima";
-  version = "19.03.0";
+  version = "20.02.4";

  src = fetchFromGitHub {
-    owner = "andrejv";
+    owner = "wxMaxima-developers";
    repo = "wxmaxima";
    rev = "Version-${version}";
-    sha256 = "0s7bdykc77slqix28cyaa6x8wvxrn8461mkdgxflvi2apwsl56aa";
+    sha256 = "106a7jrjwfmymzj70nsv44fm3jbxngr8pmkaghhpwy0ln38lhf54";
  };

  buildInputs = [ wxGTK maxima gnome3.adwaita-icon-theme ];
@ -21,12 +21,10 @@ stdenv.mkDerivation rec {
    gappsWrapperArgs+=(--prefix PATH ":" ${maxima}/bin)
  '';

-  enableParallelBuilding = true;
-
  meta = with stdenv.lib; {
    description = "Cross platform GUI for the computer algebra system Maxima";
    license = licenses.gpl2;
-    homepage = https://wxmaxima-developers.github.io/wxmaxima/;
+    homepage = "https://wxmaxima-developers.github.io/wxmaxima/";
    platforms = platforms.linux;
    maintainers = [ maintainers.peti ];
  };
--- a/pkgs/applications/system/glances/default.nix
+++ b/pkgs/applications/system/glances/default.nix
@ -8,31 +8,18 @@

 buildPythonApplication rec {
  pname = "glances";
-  version = "3.1.3";
+  version = "3.1.4";
  disabled = isPyPy;

  src = fetchFromGitHub {
    owner = "nicolargo";
    repo = "glances";
    rev = "v${version}";
-    sha256 = "15yz8sbw3k3n0729g2zcwsxc5iyhkyrhqza6fnipxxpsskwgqbwp";
+    sha256 = "1lr186rc3fvldy2m2yx1hxzdlxll93pjabs01sxz48kkpsvbiydi";
  };

  # Some tests fail in the sandbox (they e.g. require access to /sys/class/power_supply):
-  patches = lib.optional (doCheck && stdenv.isLinux) ./skip-failing-tests.patch
-    ++ [
-      (fetchpatch {
-        # Correct unitest
-        url = "https://github.com/nicolargo/glances/commit/abf64ffde31113f5f46ef286703ff061fc57395f.patch";
-        sha256 = "00krahqq89jvbgrqx2359cndmvq5maffhpj163z10s1n7q80kxp1";
-      })
-
-      (fetchpatch {
-        # Fix IP plugin initialization issue
-        url = "https://github.com/nicolargo/glances/commit/48cb5ef8053d823302e7e53490fb22cec2fabb0f.patch";
-        sha256 = "1590qgcr8w3d9ddpgd9mk5j6q6aq29341vr8bi202yjwwiv2bia9";
-      })
-    ];
+  patches = lib.optional (doCheck && stdenv.isLinux) ./skip-failing-tests.patch;

  # On Darwin this package segfaults due to mismatch of pure and impure
  # CoreFoundation. This issues was solved for binaries but for interpreted
@ -64,6 +51,7 @@ buildPythonApplication rec {
  meta = with lib; {
    homepage = "https://nicolargo.github.io/glances/";
    description = "Cross-platform curses-based monitoring tool";
+    changelog = "https://github.com/nicolargo/glances/releases/tag/v${version}";
    license = licenses.lgpl3;
    maintainers = with maintainers; [ jonringer primeos koral ];
  };
--- a/pkgs/applications/system/glances/skip-failing-tests.patch
+++ b/pkgs/applications/system/glances/skip-failing-tests.patch
@ -50,11 +50,3 @@ diff --git a/unitest.py b/unitest.py
     def test_006_swap(self):
         """Check MEMSWAP plugin."""
         stats_to_check = ['used', 'free', 'total']
-@@ -191,6 +196,7 @@ class TestGlances(unittest.TestCase):
-         self.assertTrue(type(stats_grab) is list, msg='Folders stats is not a list')
-         print('INFO: Folders stats: %s' % stats_grab)
- 
-+    @unittest.skip("Fails on NixOS (TODO)")
-     def test_012_ip(self):
-         """Check IP plugin."""
-         print('INFO: [TEST_012] Check IP stats')
--- a/pkgs/applications/version-management/cvsq/default.nix
+++ b/pkgs/applications/version-management/cvsq/default.nix
@ -12,11 +12,11 @@

 stdenv.mkDerivation rec {
  pname = "cvsq";
-  version = "1.10";
+  version = "1.11";

  src = fetchurl {
    url = "http://www.linta.de/~aehlig/cvsq/cvsq-${version}.tgz";
-    sha256 = "1a2e5666d4d23f1eb673a505caeb771ac62a86ed69c9ab89c4e2696c2ccd0621";
+    sha256 = "0491k4skk3jyyd6plp2kcihmxxav9rsch7vd1yi697m2fqckp5ws";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/version-management/git-and-tools/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/default.nix
@ -70,6 +70,8 @@ let

  git-codeowners = callPackage ./git-codeowners { };

+  git-codereview = callPackage ./git-codereview { };
+
  git-cola = callPackage ./git-cola { };

  git-crypt = callPackage ./git-crypt { };
@ -138,6 +140,10 @@ let

  git-test = callPackage ./git-test { };

+  git-trim = callPackage ./git-trim {
+    inherit (darwin.apple_sdk.frameworks) Security;
+  };
+
  git-workspace = callPackage ./git-workspace {
    inherit (darwin.apple_sdk.frameworks) Security;
  };
--- a/pkgs/applications/version-management/git-and-tools/git-bug/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-bug/default.nix
@ -1,18 +1,20 @@
-{ stdenv, buildGoPackage, fetchFromGitHub }:
+{ stdenv, buildGoModule, fetchFromGitHub }:

-buildGoPackage rec {
+buildGoModule rec {
  pname = "git-bug";
-  version = "0.6.0";
-  rev = "fc568209f073b9d775a09e0dbb8289cf9e5749bf";
+  version = "0.7.0";
+  rev = "71580c41a931a1ad2c04682e0fd701661b716c95";
  goPackagePath = "github.com/MichaelMure/git-bug";

  src = fetchFromGitHub {
    inherit rev;
    owner = "MichaelMure";
    repo = "git-bug";
-    sha256 = "1s18lzip52qpf52ad6m20j306mr16vnwhz9f7rirsa6b7srmcgli";
+    sha256 = "0mhqvcwa6y3hrrv88vbp22k7swzr8xw6ipm80gdpx85yp8j2wdkh";
  };

+  modSha256 = "1cfn49cijiarzzczrpd28x1k7ib98xyzlvn3zghwk2ngfgiah3ld";
+
  buildFlagsArray = ''
    -ldflags= 
      -X ${goPackagePath}/commands.GitCommit=${rev}
@ -21,10 +23,9 @@ buildGoPackage rec {
  '';

  postInstall = ''
-    cd go/src/${goPackagePath}
-    install -D -m 0644 misc/bash_completion/git-bug "$bin/etc/bash_completion.d/git-bug"
-    install -D -m 0644 misc/zsh_completion/git-bug "$bin/share/zsh/site-functions/git-bug"
-    install -D -m 0644 -t "$bin/share/man/man1" doc/man/*
+    install -D -m 0644 misc/bash_completion/git-bug "$out/etc/bash_completion.d/git-bug"
+    install -D -m 0644 misc/zsh_completion/git-bug "$out/share/zsh/site-functions/git-bug"
+    install -D -m 0644 -t "$out/share/man/man1" doc/man/*
  '';

  meta = with stdenv.lib; {
--- a/pkgs/applications/version-management/git-and-tools/git-codereview/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-codereview/default.nix
@ -0,0 +1,21 @@
+{ lib, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage {
+  pname = "git-codereview";
+  version = "2020-01-15";
+  goPackagePath = "golang.org/x/review";
+
+  src = fetchFromGitHub {
+    owner = "golang";
+    repo = "review";
+    rev = "f51a73253c4da005cfdf18a036e11185c04c8ce3";
+    sha256 = "0c4vsyy5zp7pngqn4q87xipndghxyw2x57dkv1kxnrffckx1s3pc";
+  };
+
+  meta = with lib; {
+    description = "Manage the code review process for Git changes using a Gerrit server";
+    homepage = "https://golang.org/x/review/git-codereview";
+    license = licenses.bsd3;
+    maintainers = [ maintainers.edef ];
+  };
+}
--- a/pkgs/applications/version-management/git-and-tools/git-dit/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-dit/default.nix
@ -26,10 +26,7 @@ buildRustPackage rec {
    sha256 = "1sx6sc2dj3l61gbiqz8vfyhw5w4xjdyfzn1ixz0y8ipm579yc7a2";
  };

-  # Delete this on next update; see #79975 for details
-  legacyCargoFetcher = true;
-
-  cargoSha256 = "10852131aizfw9j1yl4gz180h4gd8y5ymx3wmf5v9cmqiqxy8bgy";
+  cargoSha256 = "1wjbwd3scx71l2fpxgvgwaw05lkpw13rm6d2i1x5crhs7py96ky6";

  nativeBuildInputs = [
    cmake
@ -51,6 +48,10 @@ buildRustPackage rec {
  meta = with stdenv.lib; {
    inherit (src.meta) homepage;
    description = "Decentralized Issue Tracking for git";
+    # This has not had a release in years and its cargo vendored dependencies
+    # fail to compile. It also depends on an unsupported openssl:
+    # https://github.com/NixOS/nixpkgs/issues/77503
+    broken = true;
    license = licenses.gpl2;
    maintainers = with maintainers; [ Profpatsch matthiasbeyer ];
  };
--- a/pkgs/applications/version-management/git-and-tools/git-trim/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-trim/default.nix
@ -0,0 +1,33 @@
+{ stdenv, rustPlatform, fetchFromGitHub, pkg-config, openssl, libiconv, Security }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "git-trim";
+  version = "0.2.4";
+
+  src = fetchFromGitHub {
+    owner = "foriequal0";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0gfmv9bwhh6bv0s9kfbxq9wsvrk3zz3ibavbpp9l8cpqc3145pqy";
+  };
+
+  cargoSha256 = "0xklczk4vbh2mqf76r3rsfyclyza9imf6yss7vbkm9w4ir3ar9f3";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ openssl ] ++ stdenv.lib.optionals stdenv.isDarwin [ libiconv Security ];
+
+  postInstall = ''
+    install -Dm644 docs/git-trim.md.1 $out/share/man/man1/git-trim.1
+  '';
+
+  # fails with sandbox
+  doCheck = false;
+
+  meta = with stdenv.lib; {
+    description = "Automatically trims your branches whose tracking remote refs are merged or gone";
+    homepage = "https://github.com/foriequal0/git-trim";
+    license = licenses.mit;
+    maintainers = [ maintainers.marsam ];
+  };
+}
--- a/pkgs/applications/version-management/git-and-tools/gitstatus/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gitstatus/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation {
  pname = "gitstatus";
-  version = "unstable-2020-02-26";
+  version = "unstable-2020-03-06";

  src = fetchFromGitHub {
    owner = "romkatv";
    repo = "gitstatus";
-    rev = "c0e5a24299c1a1a71434dac1de6ea650e80fbe49";
-    sha256 = "0fj84cvr5a895jqgg86raakx6lqyyhahf1dgzgx05y2gfvnxxh8m";
+    rev = "c07996bc3ea1912652f52a816b830a5a3ee9b49c";
+    sha256 = "07s8hwx3i5mnafi2xfim44z3q2nsvlcibfdxj17w8mkjhfpywi00";
  };

  buildInputs = [ (callPackage ./romkatv_libgit2.nix {}) ];
@ -16,7 +16,7 @@ stdenv.mkDerivation {
    sed -i "1i GITSTATUS_DAEMON=$out/bin/gitstatusd" gitstatus.plugin.zsh
  '';
  installPhase = ''
-    install -Dm755 gitstatusd $out/bin/gitstatusd
+    install -Dm755 usrbin/gitstatusd $out/bin/gitstatusd
    install -Dm444 gitstatus.plugin.zsh $out
  '';

--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,11 +1,11 @@
 {
-  "version": "12.8.2",
-  "repo_hash": "1d27s61kglryr5pashwfq55z7fh16fxkx1m4gc82xihwfzarf4x9",
+  "version": "12.8.5",
+  "repo_hash": "1y5606p793w1js39420jcd2bj42cripczgrdxgg2cq0r2kq8axk8",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v12.8.2-ee",
+  "rev": "v12.8.5-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "12.8.2",
+    "GITALY_SERVER_VERSION": "12.8.5",
    "GITLAB_PAGES_VERSION": "1.16.0",
    "GITLAB_SHELL_VERSION": "11.0.0",
    "GITLAB_WORKHORSE_VERSION": "8.21.0"
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -28,14 +28,14 @@ let
    };
  });
 in buildGoPackage rec {
-  version = "12.8.2";
+  version = "12.8.5";
  pname = "gitaly";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitaly";
    rev = "v${version}";
-    sha256 = "1zc44y5yl799vqg12w3iaivk4xwj9i4k6f198svplipa760nl9ic";
+    sha256 = "19pwffncihhywfac7ybry38vyj3pmdz66g5nqrvwn4xxw7ypvd24";
  };

  # Fix a check which assumes that hook files are writeable by their
--- a/pkgs/applications/version-management/gitlab/gitaly/deps.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/deps.nix
@ -1319,8 +1319,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/ugorji/go";
-      rev = "d75b2dcb6bc8";
-      sha256 = "0di1k35gpq9bp958ywranpbskx2vdwlb38s22vl9rybm3wa5g3ps";
+      rev = "v1.1.4";
+      sha256 = "0ma2qvn5wqvjidpdz74x832a813qnr1cxbx6n6n125ak9b3wbn5w";
    };
  }
  {
--- a/pkgs/applications/version-management/nbstripout/default.nix
+++ b/pkgs/applications/version-management/nbstripout/default.nix
@ -2,7 +2,7 @@

 with python.pkgs;
 buildPythonApplication rec {
-  version = "0.3.6";
+  version = "0.3.7";
  pname = "nbstripout";

  # Mercurial should be added as a build input but because it's a Python
@ -14,7 +14,7 @@ buildPythonApplication rec {

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1x6010akw7iqxn7ba5m6malfr2fvaf0bjp3cdh983qn1s7vwlq0r";
+    sha256 = "13w2zhw8vrfv6637bw5ygygj1dky55fvvncz11hq0abwkkzb3wb2";
  };

  # for some reason, darwin uses /bin/sh echo native instead of echo binary, so
--- a/pkgs/applications/version-management/sit/default.nix
+++ b/pkgs/applications/version-management/sit/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchFromGitHub, rustPlatform, cmake, libzip, gnupg, 
+{ stdenv, fetchFromGitHub, rustPlatform, cmake, libzip, gnupg,
  # Darwin
  libiconv, CoreFoundation, Security }:

@ -20,10 +20,7 @@ rustPlatform.buildRustPackage rec {
    export HOME=$(mktemp -d)
  '';

-  # Delete this on next update; see #79975 for details
-  legacyCargoFetcher = true;
-
-  cargoSha256 = "0kijx7s7zh6yisrsjz213h9x5jx43ixr44vy5rb3wwbn9dgsr528";
+  cargoSha256 = "092yfpr2svp1qy7xis1q0sdkbsjmmswmdwb0rklrc0yhydcsghp9";

  meta = with stdenv.lib; {
    description = "Serverless Information Tracker";
@ -31,5 +28,8 @@ rustPlatform.buildRustPackage rec {
    license = with licenses; [ asl20 /* or */ mit ];
    maintainers = with maintainers; [ dywedir yrashk ];
    platforms = platforms.all;
+    # Upstream has not had a release in several years, and dependencies no
+    # longer compile with the latest Rust compiler.
+    broken = true;
  };
 }
--- a/pkgs/applications/video/jellyfin-mpv-shim/default.nix
+++ b/pkgs/applications/video/jellyfin-mpv-shim/default.nix
@ -0,0 +1,49 @@
+{ stdenv, buildPythonApplication, fetchFromGitHub, fetchurl
+, mpv, python-mpv-jsonipc, jellyfin-apiclient-python
+, pillow, tkinter, pystray, jinja2, pywebview }:
+
+buildPythonApplication rec {
+  pname = "jellyfin-mpv-shim";
+  version = "1.4.1";
+
+  src = fetchFromGitHub {
+    owner = "iwalton3";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "195vplq4182pq62sn6ci0a8p57k6zv8pk1gmifmwdv69wzaph043";
+    fetchSubmodules = true; # needed for display_mirror css file
+  };
+
+  # override $HOME directory:
+  #   error: [Errno 13] Permission denied: '/homeless-shelter'
+  #
+  # remove jellyfin_mpv_shim/win_utils.py:
+  #   ModuleNotFoundError: No module named 'win32gui'
+  preCheck = ''
+    export HOME=$TMPDIR
+
+    rm jellyfin_mpv_shim/win_utils.py
+  '';
+
+  propagatedBuildInputs = [
+    jellyfin-apiclient-python
+    mpv
+    pillow
+    python-mpv-jsonipc
+
+    # gui dependencies
+    pystray
+    tkinter
+
+    # display_mirror dependencies
+    jinja2
+    pywebview
+  ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/iwalton3/jellyfin-mpv-shim";
+    description = "Allows casting of videos to MPV via the jellyfin mobile and web app.";
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ jojosch ];
+  };
+}
--- a/pkgs/applications/video/mkvtoolnix/default.nix
+++ b/pkgs/applications/video/mkvtoolnix/default.nix
@ -13,13 +13,13 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  pname = "mkvtoolnix";
-  version = "43.0.0";
+  version = "44.0.0";

  src = fetchFromGitLab {
    owner  = "mbunkus";
    repo   = "mkvtoolnix";
    rev    = "release-${version}";
-    sha256 = "0ra9kgvhh5yhbr0hsia1va5lw45zr4kdwcdjhas5ljjyj75mlyxc";
+    sha256 = "072sw51svaizqi9f6kscic23wxcjarwgb7nv52yd5si5w8s0qh9r";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@ -4,13 +4,13 @@ with lib;

 buildGoPackage rec {
  pname = "containerd";
-  version = "1.2.6";
+  version = "1.2.13";

  src = fetchFromGitHub {
    owner = "containerd";
    repo = "containerd";
    rev = "v${version}";
-    sha256 = "0sp5mn5wd3xma4svm6hf67hyhiixzkzz6ijhyjkwdrc4alk81357";
+    sha256 = "1rac3iak3jpz57yarxc72bxgxvravwrl0j6s6w2nxrmh2m3kxqzn";
  };

  goPackagePath = "github.com/containerd/containerd";
--- a/pkgs/applications/virtualization/docker-slim/default.nix
+++ b/pkgs/applications/virtualization/docker-slim/default.nix
@ -6,7 +6,7 @@

 buildGoPackage rec {
  pname = "docker-slim";
-  version = "1.27.0";
+  version = "1.28.1";

  goPackagePath = "github.com/docker-slim/docker-slim";

@ -14,7 +14,7 @@ buildGoPackage rec {
    owner = "docker-slim";
    repo = "docker-slim";
    rev = version;
-    sha256 = "1pd9sz981qgr5lx6ikrhdp0n21nyrnpjpnyl8i4r2jx35zr8b5q8";
+    sha256 = "13lws9vgzq3chlqxc8aggz3i5kmir3vld2af0fx15kvcb9kpd79a";
  };

  subPackages = [ "cmd/docker-slim" "cmd/docker-slim-sensor" ];
--- a/pkgs/applications/virtualization/podman/default.nix
+++ b/pkgs/applications/virtualization/podman/default.nix
@ -5,13 +5,13 @@

 buildGoPackage rec {
  pname = "podman";
-  version = "1.8.0";
+  version = "1.8.1";

  src = fetchFromGitHub {
    owner  = "containers";
    repo   = "libpod";
    rev    = "v${version}";
-    sha256 = "1rbapks11xg0vgl9m322mijirx0wm6c4yav8aw2y41wsr7qd7db4";
+    sha256 = "047nji6vbrdb1pm8ymxz4dv07xdnp5c624bq2cfy58m5l4f1dn75";
  };

  goPackagePath = "github.com/containers/libpod";
@ -38,7 +38,7 @@ buildGoPackage rec {
  '';

  meta = with stdenv.lib; {
-    homepage = https://podman.io/;
+    homepage = "https://podman.io/";
    description = "A program for managing pods, containers and container images";
    license = licenses.asl20;
    maintainers = with maintainers; [ vdemeester saschagrunert marsam ];
--- a/Show More
+++ b/Show More