Merge staging-next into staging

2020-11-23 18:10:33 +01:00 · 2020-11-23 18:10:33 +01:00 · 587538d087
commit 587538d087
parent 31b7ef797a 9f591befb1
274 changed files with 11677 additions and 6622 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -213,7 +213,7 @@
 /doc/builders/images/dockertools.xml         @roberth

 # Blockchains
-/pkgs/applications/blockchains  @mmahut
+/pkgs/applications/blockchains  @mmahut @RaghavSood

 # Go
 /pkgs/development/compilers/go @kalbasit @Mic92 @zowoq
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -9998,4 +9998,10 @@
    github = "pulsation";
    githubId = 1838397;
  };
+  zupo = {
+    name = "Nejc Zupan";
+    email = "nejczupan+nix@gmail.com";
+    github = "zupo";
+    githubId = 311580;
+  };
 }
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -113,6 +113,7 @@ with lib.maintainers; {
    members = [
      timokau
      omasanori
+      raskin
    ];
    scope = "Maintain SageMath and the dependencies that are likely to break it.";
  };
--- a/nixos/doc/manual/configuration/configuration.xml
+++ b/nixos/doc/manual/configuration/configuration.xml
@ -23,6 +23,7 @@
 <xi:include href="xfce.xml" />
 <xi:include href="networking.xml" />
 <xi:include href="linux-kernel.xml" />
+ <xi:include href="subversion.xml" />
 <xi:include href="../generated/modules.xml" xpointer="xpointer(//section[@id='modules']/*)" />
 <xi:include href="profiles.xml" />
 <xi:include href="kubernetes.xml" />
--- a/nixos/doc/manual/configuration/subversion.xml
+++ b/nixos/doc/manual/configuration/subversion.xml
@ -0,0 +1,140 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="module-services-subversion">
+  <title>Subversion</title>
+
+ <para>
+  <link xlink:href="https://subversion.apache.org/">Subversion</link>
+  is a centralized version-control system.  It can use a <link
+  xlink:href="http://svnbook.red-bean.com/en/1.7/svn-book.html#svn.serverconfig.choosing">variety
+  of protocols</link> for communication between client and server.
+ </para>
+ <section xml:id="module-services-subversion-apache-httpd">
+  <title>Subversion inside Apache HTTP</title>
+
+   <para>
+   This section focuses on configuring a web-based server on top of
+   the Apache HTTP server, which uses
+   <link xlink:href="http://www.webdav.org/">WebDAV</link>/<link
+   xlink:href="http://www.webdav.org/deltav/WWW10/deltav-intro.htm">DeltaV</link>
+   for communication.
+   </para>
+
+   <para>For more information on the general setup, please refer to
+   the <link
+   xlink:href="http://svnbook.red-bean.com/en/1.7/svn-book.html#svn.serverconfig.httpd">the
+   appropriate section of the Subversion book</link>.
+   </para>
+
+   <para>To configure, include in
+   <literal>/etc/nixos/configuration.nix</literal> code to activate
+   Apache HTTP, setting <xref linkend="opt-services.httpd.adminAddr" />
+   appropriately:
+   </para>
+
+    <para>
+<programlisting>
+  services.httpd.enable = true;
+  services.httpd.adminAddr = ...;
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+</programlisting>
+    </para>
+
+    <para>For a simple Subversion server with basic authentication,
+    configure the Subversion module for Apache as follows, setting
+    <literal>hostName</literal> and <literal>documentRoot</literal>
+    appropriately, and <literal>SVNParentPath</literal> to the parent
+    directory of the repositories,
+    <literal>AuthzSVNAccessFile</literal> to the location of the
+    <code>.authz</code> file describing access permission, and
+    <literal>AuthUserFile</literal> to the password file.
+    </para>
+    <para>
+<programlisting>
+services.httpd.extraModules = [
+    # note that order is *super* important here
+    { name = "dav_svn"; path = "${pkgs.apacheHttpdPackages.subversion}/modules/mod_dav_svn.so"; }
+    { name = "authz_svn"; path = "${pkgs.apacheHttpdPackages.subversion}/modules/mod_authz_svn.so"; }
+  ];
+  services.httpd.virtualHosts = {
+    "svn" = {
+       hostName = HOSTNAME;
+       documentRoot = DOCUMENTROOT;
+       locations."/svn".extraConfig = ''
+           DAV svn
+           SVNParentPath REPO_PARENT
+           AuthzSVNAccessFile ACCESS_FILE
+           AuthName "SVN Repositories"
+           AuthType Basic
+           AuthUserFile PASSWORD_FILE
+           Require valid-user
+      '';
+    }
+</programlisting>
+    </para>
+
+    <para>
+    The key <code>"svn"</code> is just a symbolic name identifying the
+    virtual host.  The <code>"/svn"</code> in
+    <code>locations."/svn".extraConfig</code> is the path underneath
+    which the repositories will be served.
+    </para>
+
+    <para><link
+              xlink:href="https://wiki.archlinux.org/index.php/Subversion">This
+    page</link> explains how to set up the Subversion configuration
+    itself.  This boils down to the following:
+    </para>
+    <para>
+      Underneath <literal>REPO_PARENT</literal> repositories can be set up
+      as follows:
+    </para>
+    <para>
+<screen>
+<prompt>$ </prompt> svn create REPO_NAME
+</screen>
+    </para>
+    <para>Repository files need to be accessible by
+    <literal>wwwrun</literal>:
+    </para>
+    <para>
+<screen>
+<prompt>$ </prompt> chown -R wwwrun:wwwrun REPO_PARENT
+</screen>
+    </para>
+    <para>
+      The password file <literal>PASSWORD_FILE</literal> can be created as follows:
+    </para>
+    <para>
+<screen>
+<prompt>$ </prompt> htpasswd -cs PASSWORD_FILE USER_NAME
+</screen>
+    </para>
+    <para>
+    Additional users can be set up similarly, omitting the
+    <code>c</code> flag:
+    </para>
+    <para>
+<screen>
+<prompt>$ </prompt> htpasswd -s PASSWORD_FILE USER_NAME
+</screen>
+    </para>
+    <para>
+      The file describing access permissions
+      <literal>ACCESS_FILE</literal> will look something like
+      the following:
+    </para>
+    <para>
+<programlisting>
+[/]
+* = r
+
+[REPO_NAME:/]
+USER_NAME = rw
+</programlisting>
+    </para>
+    <para>The Subversion repositories will be accessible as <code>http://HOSTNAME/svn/REPO_NAME</code>.</para>
+ </section>
+</chapter>
--- a/nixos/doc/manual/release-notes/rl-2103.xml
+++ b/nixos/doc/manual/release-notes/rl-2103.xml
@ -185,6 +185,48 @@
     which is the new stable release.  OpenAFS 1.6 was removed.
    </para>
   </listitem>
+   <listitem>
+    <para>
+      The <literal>openldap</literal> module now has support for OLC-style
+      configuration, users of the <literal>configDir</literal> option may wish
+      to migrate. If you continue to use <literal>configDir</literal>, ensure that
+      <literal>olcPidFile</literal> is set to <literal>/run/slapd/slapd.pid</literal>.
+    </para>
+    <para>
+      As a result, <literal>extraConfig</literal> and <literal>extraDatabaseConfig</literal>
+      are removed. To help with migration, you can convert your <literal>slapd.conf</literal>
+      file to OLC configuration with the following script (find the location of this
+      configuration file by running <literal>systemctl status openldap</literal>, it is the
+      <literal>-f</literal> option.
+    </para>
+    <programlisting>
+      TMPDIR=$(mktemp -d)
+      slaptest -f /path/to/slapd.conf $TMPDIR
+      slapcat -F $TMPDIR -n0 -H 'ldap:///???(!(objectClass=olcSchemaConfig))'
+    </programlisting>
+    <para>
+      This will dump your current configuration in LDIF format, which should be
+      straightforward to convert into Nix settings. This does not show your schema
+      configuration, as this is unnecessarily verbose for users of the default schemas
+      and <literal>slaptest</literal> is buggy with schemas directly in the config file.
+    </para>
+   </listitem>
+   <listitem>
+     <para>
+       Amazon EC2 and OpenStack Compute (nova) images now re-fetch instance meta data and user data from the instance
+       metadata service (IMDS) on each boot. For example: stopping an EC2 instance, changing its user data, and
+       restarting the instance will now cause it to fetch and apply the new user data.
+     </para>
+     <warning>
+       <para>
+         Specifically, <literal>/etc/ec2-metadata</literal> is re-populated on each boot. Some NixOS scripts that read
+         from this directory are guarded to only run if the files they want to manipulate do not already exist, and so
+         will not re-apply their changes if the IMDS response changes. Examples: <literal>root</literal>'s SSH key is
+         only added if <literal>/root/.ssh/authorized_keys</literal> does not exist, and SSH host keys are only set from
+         user data if they do not exist in <literal>/etc/ssh</literal>.
+       </para>
+     </warning>
+   </listitem>
  </itemizedlist>
 </section>

--- a/nixos/lib/test-driver/test-driver.py
+++ b/nixos/lib/test-driver/test-driver.py
@ -634,8 +634,7 @@ class Machine:
                shutil.copy(intermediate, abs_target)

    def dump_tty_contents(self, tty: str) -> None:
-        """Debugging: Dump the contents of the TTY<n>
-        """
+        """Debugging: Dump the contents of the TTY<n>"""
        self.execute("fold -w 80 /dev/vcs{} | systemd-cat".format(tty))

    def get_screen_text(self) -> str:
@ -860,8 +859,7 @@ class Machine:
        self.send_monitor_command("set_link virtio-net-pci.1 off")

    def unblock(self) -> None:
-        """Make the machine reachable.
-        """
+        """Make the machine reachable."""
        self.send_monitor_command("set_link virtio-net-pci.1 on")


--- a/nixos/modules/config/malloc.nix
+++ b/nixos/modules/config/malloc.nix
@ -23,7 +23,7 @@ let
    };

    scudo = {
-      libPath = "${pkgs.llvmPackages.compiler-rt}/lib/linux/libclang_rt.scudo-x86_64.so";
+      libPath = "${pkgs.llvmPackages_latest.compiler-rt}/lib/linux/libclang_rt.scudo-x86_64.so";
      description = ''
        A user-mode allocator based on LLVM Sanitizer’s CombinedAllocator,
        which aims at providing additional mitigations against heap based
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@ -135,7 +135,7 @@ in
      #keys = 96; # unused
      #haproxy = 97; # dynamically allocated as of 2020-03-11
      mongodb = 98;
-      openldap = 99;
+      #openldap = 99; # dynamically allocated as of PR#94610
      #users = 100; # unused
      cgminer = 101;
      munin = 102;
@ -451,7 +451,7 @@ in
      keys = 96;
      #haproxy = 97; # dynamically allocated as of 2020-03-11
      #mongodb = 98; # unused
-      openldap = 99;
+      #openldap = 99; # dynamically allocated as of PR#94610
      munin = 102;
      #logcheck = 103; # unused
      #nix-ssh = 104; # unused
--- a/nixos/modules/services/databases/openldap.nix
+++ b/nixos/modules/services/databases/openldap.nix
@ -1,43 +1,121 @@
 { config, lib, pkgs, ... }:

 with lib;
-
 let
-
  cfg = config.services.openldap;
+  legacyOptions = [ "rootpwFile" "suffix" "dataDir" "rootdn" "rootpw" ];
  openldap = cfg.package;
+  configDir = if cfg.configDir != null then cfg.configDir else "/etc/openldap/slapd.d";

-  dataFile = pkgs.writeText "ldap-contents.ldif" cfg.declarativeContents;
-  configFile = pkgs.writeText "slapd.conf" ((optionalString cfg.defaultSchemas ''
-    include ${openldap.out}/etc/schema/core.schema
-    include ${openldap.out}/etc/schema/cosine.schema
-    include ${openldap.out}/etc/schema/inetorgperson.schema
-    include ${openldap.out}/etc/schema/nis.schema
-  '') + ''
-    ${cfg.extraConfig}
-    database ${cfg.database}
-    suffix ${cfg.suffix}
-    rootdn ${cfg.rootdn}
-    ${if (cfg.rootpw != null) then ''
-      rootpw ${cfg.rootpw}
-    '' else ''
-      include ${cfg.rootpwFile}
-    ''}
-    directory ${cfg.dataDir}
-    ${cfg.extraDatabaseConfig}
-  '');
-  configOpts = if cfg.configDir == null then "-f ${configFile}"
-               else "-F ${cfg.configDir}";
-in
-
-{
-
-  ###### interface
+  ldapValueType = let
+    # Can't do types.either with multiple non-overlapping submodules, so define our own
+    singleLdapValueType = lib.mkOptionType rec {
+      name = "LDAP";
+      description = "LDAP value";
+      check = x: lib.isString x || (lib.isAttrs x && (x ? path || x ? base64));
+      merge = lib.mergeEqualOption;
+    };
+    # We don't coerce to lists of single values, as some values must be unique
+  in types.either singleLdapValueType (types.listOf singleLdapValueType);

+  ldapAttrsType =
+    let
      options = {
+        attrs = mkOption {
+          type = types.attrsOf ldapValueType;
+          default = {};
+          description = "Attributes of the parent entry.";
+        };
+        children = mkOption {
+          # Hide the child attributes, to avoid infinite recursion in e.g. documentation
+          # Actual Nix evaluation is lazy, so this is not an issue there
+          type = let
+            hiddenOptions = lib.mapAttrs (name: attr: attr // { visible = false; }) options;
+          in types.attrsOf (types.submodule { options = hiddenOptions; });
+          default = {};
+          description = "Child entries of the current entry, with recursively the same structure.";
+          example = lib.literalExample ''
+            {
+                "cn=schema" = {
+                # The attribute used in the DN must be defined
+                attrs = { cn = "schema"; };
+                children = {
+                    # This entry's DN is expanded to "cn=foo,cn=schema"
+                    "cn=foo" = { ... };
+                };
+                # These includes are inserted after "cn=schema", but before "cn=foo,cn=schema"
+                includes = [ ... ];
+                };
+            }
+          '';
+        };
+        includes = mkOption {
+          type = types.listOf types.path;
+          default = [];
+          description = ''
+            LDIF files to include after the parent's attributes but before its children.
+          '';
+        };
+      };
+    in types.submodule { inherit options; };

+  valueToLdif = attr: values: let
+    listValues = if lib.isList values then values else lib.singleton values;
+  in map (value:
+    if lib.isAttrs value then
+      if lib.hasAttr "path" value
+      then "${attr}:< file://${value.path}"
+      else "${attr}:: ${value.base64}"
+    else "${attr}: ${lib.replaceStrings [ "\n" ] [ "\n " ] value}"
+  ) listValues;
+
+  attrsToLdif = dn: { attrs, children, includes, ... }: [''
+    dn: ${dn}
+    ${lib.concatStringsSep "\n" (lib.flatten (lib.mapAttrsToList valueToLdif attrs))}
+  ''] ++ (map (path: "include: file://${path}\n") includes) ++ (
+    lib.flatten (lib.mapAttrsToList (name: value: attrsToLdif "${name},${dn}" value) children)
+  );
+in {
+  imports = let
+    deprecationNote = "This option is removed due to the deprecation of `slapd.conf` upstream. Please migrate to `services.openldap.settings`, see the release notes for advice with this process.";
+    mkDatabaseOption = old: new:
+      lib.mkChangedOptionModule [ "services" "openldap" old ] [ "services" "openldap" "settings" "children" ]
+        (config: let
+          database = lib.getAttrFromPath [ "services" "openldap" "database" ] config;
+          value = lib.getAttrFromPath [ "services" "openldap" old ] config;
+        in lib.setAttrByPath ([ "olcDatabase={1}${database}" "attrs" ] ++ new) value);
+  in [
+    (lib.mkRemovedOptionModule [ "services" "openldap" "extraConfig" ] deprecationNote)
+    (lib.mkRemovedOptionModule [ "services" "openldap" "extraDatabaseConfig" ] deprecationNote)
+
+    (lib.mkChangedOptionModule [ "services" "openldap" "logLevel" ] [ "services" "openldap" "settings" "attrs" "olcLogLevel" ]
+      (config: lib.splitString " " (lib.getAttrFromPath [ "services" "openldap" "logLevel" ] config)))
+    (lib.mkChangedOptionModule [ "services" "openldap" "defaultSchemas" ] [ "services" "openldap" "settings" "children" "cn=schema" "includes"]
+      (config: lib.optionals (lib.getAttrFromPath [ "services" "openldap" "defaultSchemas" ] config) (
+        map (schema: "${openldap}/etc/schema/${schema}.ldif") [ "core" "cosine" "inetorgperson" "nis" ])))
+
+    (lib.mkChangedOptionModule [ "services" "openldap" "database" ] [ "services" "openldap" "settings" "children" ]
+      (config: let
+        database = lib.getAttrFromPath [ "services" "openldap" "database" ] config;
+      in {
+        "olcDatabase={1}${database}".attrs = {
+          # objectClass is case-insensitive, so don't need to capitalize ${database}
+          objectClass = [ "olcdatabaseconfig" "olc${database}config" ];
+          olcDatabase = "{1}${database}";
+          olcDbDirectory = lib.mkDefault "/var/db/openldap";
+        };
+        "cn=schema".includes = lib.mkDefault (
+          map (schema: "${openldap}/etc/schema/${schema}.ldif") [ "core" "cosine" "inetorgperson" "nis" ]
+        );
+      }))
+    (mkDatabaseOption "rootpwFile" [ "olcRootPW" "path" ])
+    (mkDatabaseOption "suffix" [ "olcSuffix" ])
+    (mkDatabaseOption "dataDir" [ "olcDbDirectory" ])
+    (mkDatabaseOption "rootdn" [ "olcRootDN" ])
+    (mkDatabaseOption "rootpw" [ "olcRootPW" ])
+  ];
+  options = {
    services.openldap = {
-
      enable = mkOption {
        type = types.bool;
        default = false;
@ -77,125 +155,80 @@ in
        example = [ "ldaps:///" ];
      };

-      dataDir = mkOption {
-        type = types.path;
-        default = "/var/db/openldap";
-        description = "The database directory.";
+      settings = mkOption {
+        type = ldapAttrsType;
+        description = "Configuration for OpenLDAP, in OLC format";
+        example = lib.literalExample ''
+          {
+            attrs.olcLogLevel = [ "stats" ];
+            children = {
+              "cn=schema".includes = [
+                 "\${pkgs.openldap}/etc/schema/core.ldif"
+                 "\${pkgs.openldap}/etc/schema/cosine.ldif"
+                 "\${pkgs.openldap}/etc/schema/inetorgperson.ldif"
+              ];
+              "olcDatabase={-1}frontend" = {
+                attrs = {
+                  objectClass = "olcDatabaseConfig";
+                  olcDatabase = "{-1}frontend";
+                  olcAccess = [ "{0}to * by dn.exact=uidNumber=0+gidNumber=0,cn=peercred,cn=external,cn=auth manage stop by * none stop" ];
+                };
+              };
+              "olcDatabase={0}config" = {
+                attrs = {
+                  objectClass = "olcDatabaseConfig";
+                  olcDatabase = "{0}config";
+                  olcAccess = [ "{0}to * by * none break" ];
+                };
+              };
+              "olcDatabase={1}mdb" = {
+                attrs = {
+                  objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
+                  olcDatabase = "{1}mdb";
+                  olcDbDirectory = "/var/db/ldap";
+                  olcDbIndex = [
+                    "objectClass eq"
+                    "cn pres,eq"
+                    "uid pres,eq"
+                    "sn pres,eq,subany"
+                  ];
+                  olcSuffix = "dc=example,dc=com";
+                  olcAccess = [ "{0}to * by * read break" ];
+                };
+              };
+            };
          };
-
-      defaultSchemas = mkOption {
-        type = types.bool;
-        default = true;
-        description = ''
-          Include the default schemas core, cosine, inetorgperson and nis.
-          This setting will be ignored if configDir is set.
        '';
      };

-      database = mkOption {
-        type = types.str;
-        default = "mdb";
-        description = ''
-          Database type to use for the LDAP.
-          This setting will be ignored if configDir is set.
-        '';
-      };
-
-      suffix = mkOption {
-        type = types.str;
-        example = "dc=example,dc=org";
-        description = ''
-          Specify the DN suffix of queries that will be passed to this backend
-          database.
-          This setting will be ignored if configDir is set.
-        '';
-      };
-
-      rootdn = mkOption {
-        type = types.str;
-        example = "cn=admin,dc=example,dc=org";
-        description = ''
-          Specify the distinguished name that is not subject to access control
-          or administrative limit restrictions for operations on this database.
-          This setting will be ignored if configDir is set.
-        '';
-      };
-
-      rootpw = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        description = ''
-          Password for the root user.
-          This setting will be ignored if configDir is set.
-          Using this option will store the root password in plain text in the
-          world-readable nix store. To avoid this the <literal>rootpwFile</literal> can be used.
-        '';
-      };
-
-      rootpwFile = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        description = ''
-          Password file for the root user.
-          The file should contain the string <literal>rootpw</literal> followed by the password.
-          e.g.: <literal>rootpw mysecurepassword</literal>
-        '';
-      };
-
-      logLevel = mkOption {
-        type = types.str;
-        default = "0";
-        example = "acl trace";
-        description = "The log level selector of slapd.";
-      };
-
+      # This option overrides settings
      configDir = mkOption {
        type = types.nullOr types.path;
        default = null;
-        description = "Use this optional config directory instead of using slapd.conf";
+        description = ''
+          Use this config directory instead of generating one from the
+          <literal>settings</literal> option. Overrides all NixOS settings. If
+          you use this option,ensure `olcPidFile` is set to `/run/slapd/slapd.conf`.
+        '';
        example = "/var/db/slapd.d";
      };

-      extraConfig = mkOption {
-        type = types.lines;
-        default = "";
-        description = "
-          slapd.conf configuration
-        ";
-        example = literalExample ''
-            '''
-            include ${openldap.out}/etc/schema/core.schema
-            include ${openldap.out}/etc/schema/cosine.schema
-            include ${openldap.out}/etc/schema/inetorgperson.schema
-            include ${openldap.out}/etc/schema/nis.schema
-
-            database bdb
-            suffix dc=example,dc=org
-            rootdn cn=admin,dc=example,dc=org
-            # NOTE: change after first start
-            rootpw secret
-            directory /var/db/openldap
-            '''
-          '';
-      };
-
      declarativeContents = mkOption {
-        type = with types; nullOr lines;
-        default = null;
+        type = with types; attrsOf lines;
+        default = {};
        description = ''
-          Declarative contents for the LDAP database, in LDIF format.
+          Declarative contents for the LDAP database, in LDIF format by suffix.

-          Note a few facts when using it. First, the database
-          <emphasis>must</emphasis> be stored in the directory defined by
-          <code>dataDir</code>. Second, all <code>dataDir</code> will be erased
-          when starting the LDAP server. Third, modifications to the database
-          are not prevented, they are just dropped on the next reboot of the
-          server. Finally, performance-wise the database and indexes are rebuilt
-          on each server startup, so this will slow down server startup,
+          All data will be erased when starting the LDAP server. Modifications
+          to the database are not prevented, they are just dropped on the next
+          reboot of the server. Performance-wise the database and indexes are
+          rebuilt on each server startup, so this will slow down server startup,
          especially with large databases.
        '';
-        example = ''
-          dn: dc=example,dc=org
+        example = lib.literalExample ''
+          {
+            "dc=example,dc=org" = '''
+              dn= dn: dc=example,dc=org
              objectClass: domain
              dc: example

@ -204,97 +237,88 @@ in
              ou: users

              # ...
+            ''';
+          }
        '';
      };
-
-      extraDatabaseConfig = mkOption {
-        type = types.lines;
-        default = "";
-        description = ''
-          slapd.conf configuration after the database option.
-          This setting will be ignored if configDir is set.
-        '';
-        example = ''
-          # Indices to maintain for this directory
-          # unique id so equality match only
-          index uid eq
-          # allows general searching on commonname, givenname and email
-          index cn,gn,mail eq,sub
-          # allows multiple variants on surname searching
-          index sn eq,sub
-          # sub above includes subintial,subany,subfinal
-          # optimise department searches
-          index ou eq
-          # if searches will include objectClass uncomment following
-          # index objectClass eq
-          # shows use of default index parameter
-          index default eq,sub
-          # indices missing - uses default eq,sub
-          index telephonenumber
-
-          # other database parameters
-          # read more in slapd.conf reference section
-          cachesize 10000
-          checkpoint 128 15
-        '';
+    };
  };

-    };
-
-  };
-
-  meta = {
-    maintainers = [ lib.maintainers.mic92 ];
-  };
-
-
-  ###### implementation
+  meta.maintainers = with lib.maintainters; [ mic92 kwohlfahrt ];

  config = mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = cfg.configDir != null || cfg.rootpwFile != null || cfg.rootpw != null;
-        message = "services.openldap: Unless configDir is set, either rootpw or rootpwFile must be set";
-      }
-    ];
-
+    assertions = map (opt: {
+      assertion = ((getAttr opt cfg) != "_mkMergedOptionModule") -> (cfg.database != "_mkMergedOptionModule");
+      message = "Legacy OpenLDAP option `services.openldap.${opt}` requires `services.openldap.database` (use value \"mdb\" if unsure)";
+    }) legacyOptions;
    environment.systemPackages = [ openldap ];

+    # Literal attributes must always be set
+    services.openldap.settings = {
+      attrs = {
+        objectClass = "olcGlobal";
+        cn = "config";
+        olcPidFile = "/run/slapd/slapd.pid";
+      };
+      children."cn=schema".attrs = {
+        cn = "schema";
+        objectClass = "olcSchemaConfig";
+      };
+    };
+
    systemd.services.openldap = {
      description = "LDAP server";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
-      preStart = ''
+      preStart = let
+        settingsFile = pkgs.writeText "config.ldif" (lib.concatStringsSep "\n" (attrsToLdif "cn=config" cfg.settings));
+
+        dbSettings = lib.filterAttrs (name: value: lib.hasPrefix "olcDatabase=" name) cfg.settings.children;
+        dataDirs = lib.mapAttrs' (name: value: lib.nameValuePair value.attrs.olcSuffix value.attrs.olcDbDirectory)
+          (lib.filterAttrs (_: value: value.attrs ? olcDbDirectory) dbSettings);
+        dataFiles = lib.mapAttrs (dn: contents: pkgs.writeText "${dn}.ldif" contents) cfg.declarativeContents;
+        mkLoadScript = dn: let
+          dataDir = lib.escapeShellArg (getAttr dn dataDirs);
+        in  ''
+          rm -rf ${dataDir}/*
+          ${openldap}/bin/slapadd -F ${lib.escapeShellArg configDir} -b ${dn} -l ${getAttr dn dataFiles}
+          chown -R "${cfg.user}:${cfg.group}" ${dataDir}
+        '';
+      in ''
        mkdir -p /run/slapd
        chown -R "${cfg.user}:${cfg.group}" /run/slapd
-        ${optionalString (cfg.declarativeContents != null) ''
-          rm -Rf "${cfg.dataDir}"
-        ''}
-        mkdir -p "${cfg.dataDir}"
-        ${optionalString (cfg.declarativeContents != null) ''
-          ${openldap.out}/bin/slapadd ${configOpts} -l ${dataFile}
-        ''}
-        chown -R "${cfg.user}:${cfg.group}" "${cfg.dataDir}"

-        ${openldap}/bin/slaptest ${configOpts}
+        mkdir -p ${lib.escapeShellArg configDir} ${lib.escapeShellArgs (lib.attrValues dataDirs)}
+        chown "${cfg.user}:${cfg.group}" ${lib.escapeShellArg configDir} ${lib.escapeShellArgs (lib.attrValues dataDirs)}
+
+        ${lib.optionalString (cfg.configDir == null) (''
+          rm -Rf ${configDir}/*
+          ${openldap}/bin/slapadd -F ${configDir} -bcn=config -l ${settingsFile}
+        '')}
+        chown -R "${cfg.user}:${cfg.group}" ${lib.escapeShellArg configDir}
+
+        ${lib.concatStrings (map mkLoadScript (lib.attrNames cfg.declarativeContents))}
+        ${openldap}/bin/slaptest -u -F ${lib.escapeShellArg configDir}
      '';
-      serviceConfig.ExecStart =
-        "${openldap.out}/libexec/slapd -d '${cfg.logLevel}' " +
-          "-u '${cfg.user}' -g '${cfg.group}' " +
-          "-h '${concatStringsSep " " cfg.urlList}' " +
-          "${configOpts}";
+      serviceConfig = {
+        ExecStart = lib.escapeShellArgs ([
+          "${openldap}/libexec/slapd" "-u" cfg.user "-g" cfg.group "-F" configDir
+          "-h" (lib.concatStringsSep " " cfg.urlList)
+        ]);
+        Type = "forking";
+        PIDFile = cfg.settings.attrs.olcPidFile;
+      };
    };

-    users.users.openldap =
-      { name = cfg.user;
+    users.users = lib.optionalAttrs (cfg.user == "openldap") {
+      openldap = {
        group = cfg.group;
-        uid = config.ids.uids.openldap;
+        isSystemUser = true;
+      };
    };

-    users.groups.openldap =
-      { name = cfg.group;
-        gid = config.ids.gids.openldap;
+    users.groups = lib.optionalAttrs (cfg.group == "openldap") {
+      openldap = {};
    };
-
  };
 }
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@ -43,9 +43,13 @@ let

    [gitlab-shell]
    dir = "${cfg.packages.gitlab-shell}"
+
+    [gitlab]
    secret_file = "${cfg.statePath}/gitlab_shell_secret"
-    gitlab_url = "http+unix://${pathUrlQuote gitlabSocket}"
-    http_settings = { self_signed_cert = false }
+    url = "http+unix://${pathUrlQuote gitlabSocket}"
+
+    [gitlab.http-settings]
+    self_signed_cert = false

    ${concatStringsSep "\n" (attrValues (mapAttrs (k: v: ''
    [[storage]]
@ -119,6 +123,7 @@ let
        receive_pack = true;
      };
      workhorse.secret_file = "${cfg.statePath}/.gitlab_workhorse_secret";
+      gitlab_kas.secret_file = "${cfg.statePath}/.gitlab_kas_secret";
      git.bin_path = "git";
      monitoring = {
        ip_whitelist = [ "127.0.0.0/8" "::1/128" ];
@ -668,6 +673,7 @@ in {
            rm "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}"
        fi
        $PSQL '${cfg.databaseName}' -tAc "CREATE EXTENSION IF NOT EXISTS pg_trgm"
+        $PSQL '${cfg.databaseName}' -tAc "CREATE EXTENSION IF NOT EXISTS btree_gist;"
      '';

      serviceConfig = {
@ -750,7 +756,8 @@ in {
    };

    systemd.services.gitaly = {
-      after = [ "network.target" ];
+      after = [ "network.target" "gitlab.service" ];
+      requires = [ "gitlab.service" ];
      wantedBy = [ "multi-user.target" ];
      path = with pkgs; [
        openssh
@ -839,7 +846,7 @@ in {
    };

    systemd.services.gitlab = {
-      after = [ "gitlab-workhorse.service" "gitaly.service" "network.target" "gitlab-postgresql.service" "redis.service" ];
+      after = [ "gitlab-workhorse.service" "network.target" "gitlab-postgresql.service" "redis.service" ];
      requires = [ "gitlab-sidekiq.service" ];
      wantedBy = [ "multi-user.target" ];
      environment = gitlabEnv;
--- a/nixos/modules/services/networking/morty.nix
+++ b/nixos/modules/services/networking/morty.nix
@ -29,9 +29,11 @@ in
      key = mkOption {
        type = types.str;
        default = "";
-        description = "HMAC url validation key (hexadecimal encoded).
+        description = ''
+          HMAC url validation key (hexadecimal encoded).
          Leave blank to disable. Without validation key, anyone can
-	submit proxy requests. Leave blank to disable.";
+          submit proxy requests. Leave blank to disable.
+        '';
        defaultText = "No HMAC url validation. Generate with echo -n somevalue | openssl dgst -sha1 -hmac somekey";
      };

--- a/nixos/modules/virtualisation/ec2-metadata-fetcher.nix
+++ b/nixos/modules/virtualisation/ec2-metadata-fetcher.nix
@ -8,9 +8,14 @@
 # Make sure that every package you depend on here is already listed as
 # a channel blocker for both the full-sized and small channels.
 # Otherwise, we risk breaking user deploys in released channels.
+#
+# Also note: OpenStack's metadata service for its instances aims to be
+# compatible with the EC2 IMDS. Where possible, try to keep the set of
+# fetched metadata in sync with ./openstack-metadata-fetcher.nix .
 ''
  metaDir=${targetRoot}etc/ec2-metadata
  mkdir -m 0755 -p "$metaDir"
+  rm -f "$metaDir/*"

  get_imds_token() {
    # retry-delay of 1 selected to give the system a second to get going,
@ -61,19 +66,12 @@

  echo "getting EC2 instance metadata..."

-  if ! [ -e "$metaDir/ami-manifest-path" ]; then
-    wget ${wgetExtraOptions} --header "X-aws-ec2-metadata-token: $IMDS_TOKEN" -O "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path
-  fi
+  wget_imds() {
+    wget ${wgetExtraOptions} --header "X-aws-ec2-metadata-token: $IMDS_TOKEN" "$@";
+  }

-  if ! [ -e "$metaDir/user-data" ]; then
-    wget ${wgetExtraOptions} --header "X-aws-ec2-metadata-token: $IMDS_TOKEN" -O "$metaDir/user-data" http://169.254.169.254/1.0/user-data && chmod 600 "$metaDir/user-data"
-  fi
-
-  if ! [ -e "$metaDir/hostname" ]; then
-    wget ${wgetExtraOptions} --header "X-aws-ec2-metadata-token: $IMDS_TOKEN" -O "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname
-  fi
-
-  if ! [ -e "$metaDir/public-keys-0-openssh-key" ]; then
-    wget ${wgetExtraOptions} --header "X-aws-ec2-metadata-token: $IMDS_TOKEN" -O "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key
-  fi
+  wget_imds -O "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path
+  wget_imds -O "$metaDir/user-data" http://169.254.169.254/1.0/user-data && chmod 600 "$metaDir/user-data"
+  wget_imds -O "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname
+  wget_imds -O "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key
 ''
--- a/nixos/modules/virtualisation/openstack-metadata-fetcher.nix
+++ b/nixos/modules/virtualisation/openstack-metadata-fetcher.nix
@ -1,23 +1,21 @@
 { targetRoot, wgetExtraOptions }:
+
+# OpenStack's metadata service aims to be EC2-compatible. Where
+# possible, try to keep the set of fetched metadata in sync with
+# ./ec2-metadata-fetcher.nix .
 ''
  metaDir=${targetRoot}etc/ec2-metadata
  mkdir -m 0755 -p "$metaDir"
+  rm -f "$metaDir/*"

-  echo "getting EC2 instance metadata..."
+  echo "getting instance metadata..."

-  if ! [ -e "$metaDir/ami-manifest-path" ]; then
-    wget ${wgetExtraOptions} -O "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path
-  fi
+  wget_imds() {
+    wget ${wgetExtraOptions} "$@"
+  }

-  if ! [ -e "$metaDir/user-data" ]; then
-    wget ${wgetExtraOptions} -O "$metaDir/user-data" http://169.254.169.254/1.0/user-data && chmod 600 "$metaDir/user-data"
-  fi
-
-  if ! [ -e "$metaDir/hostname" ]; then
-    wget ${wgetExtraOptions} -O "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname
-  fi
-
-  if ! [ -e "$metaDir/public-keys-0-openssh-key" ]; then
-    wget ${wgetExtraOptions} -O "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key
-  fi
+  wget_imds -O "$metaDir/ami-manifest-path" http://169.254.169.254/1.0/meta-data/ami-manifest-path
+  wget_imds -O "$metaDir/user-data" http://169.254.169.254/1.0/user-data && chmod 600 "$metaDir/user-data"
+  wget_imds -O "$metaDir/hostname" http://169.254.169.254/1.0/meta-data/hostname
+  wget_imds -O "$metaDir/public-keys-0-openssh-key" http://169.254.169.254/1.0/meta-data/public-keys/0/openssh-key
 ''
--- a/nixos/tests/gitlab.nix
+++ b/nixos/tests/gitlab.nix
@ -33,9 +33,9 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : with lib; {
        initialRootPasswordFile = pkgs.writeText "rootPassword" initialRootPassword;
        smtp.enable = true;
        secrets = {
-          secretFile = pkgs.writeText "secret" "Aig5zaic";
-          otpFile = pkgs.writeText "otpsecret" "Riew9mue";
-          dbFile = pkgs.writeText "dbsecret" "we2quaeZ";
+          secretFile = pkgs.writeText "secret" "r8X9keSKynU7p4aKlh4GO1Bo77g5a7vj";
+          otpFile = pkgs.writeText "otpsecret" "Zu5hGx3YvQx40DvI8WoZJQpX2paSDOlG";
+          dbFile = pkgs.writeText "dbsecret" "lsGltKWTejOf6JxCVa7nLDenzkO9wPLR";
          jwsFile = pkgs.runCommand "oidcKeyBase" {} "${pkgs.openssl}/bin/openssl genrsa 2048 > $out";
        };
      };
--- a/nixos/tests/openldap.nix
+++ b/nixos/tests/openldap.nix
@ -1,17 +1,5 @@
-import ./make-test-python.nix {
-  name = "openldap";
-
-  machine = { pkgs, ... }: {
-    services.openldap = {
-      enable = true;
-      suffix = "dc=example";
-      rootdn = "cn=root,dc=example";
-      rootpw = "notapassword";
-      database = "bdb";
-      extraDatabaseConfig = ''
-        directory /var/db/openldap
-      '';
-      declarativeContents = ''
+{ pkgs, system ? builtins.currentSystem, ... }: let
+  dbContents = ''
    dn: dc=example
    objectClass: domain
    dc: example
@ -20,14 +8,118 @@ import ./make-test-python.nix {
    objectClass: organizationalUnit
    ou: users
  '';
-    };
-  };
-
  testScript = ''
    machine.wait_for_unit("openldap.service")
    machine.succeed(
-        "systemctl status openldap.service",
        'ldapsearch -LLL -D "cn=root,dc=example" -w notapassword -b "dc=example"',
    )
  '';
+in {
+  # New-style configuration
+  current = import ./make-test-python.nix {
+    inherit testScript;
+    name = "openldap";
+
+    machine = { pkgs, ... }: {
+      environment.etc."openldap/root_password".text = "notapassword";
+      services.openldap = {
+        enable = true;
+        settings = {
+          children = {
+            "cn=schema".includes = [
+              "${pkgs.openldap}/etc/schema/core.ldif"
+              "${pkgs.openldap}/etc/schema/cosine.ldif"
+              "${pkgs.openldap}/etc/schema/inetorgperson.ldif"
+              "${pkgs.openldap}/etc/schema/nis.ldif"
+            ];
+            "olcDatabase={1}mdb" = {
+              # This tests string, base64 and path values, as well as lists of string values
+              attrs = {
+                objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
+                olcDatabase = "{1}mdb";
+                olcDbDirectory = "/var/db/openldap";
+                olcSuffix = "dc=example";
+                olcRootDN = {
+                  # cn=root,dc=example
+                  base64 = "Y249cm9vdCxkYz1leGFtcGxl";
+                };
+                olcRootPW = {
+                  path = "/etc/openldap/root_password";
+                };
+              };
+            };
+          };
+        };
+        declarativeContents."dc=example" = dbContents;
+      };
+    };
+  };
+
+  # Old-style configuration
+  oldOptions = import ./make-test-python.nix {
+    inherit testScript;
+    name = "openldap";
+
+    machine = { pkgs, ... }: {
+      services.openldap = {
+        enable = true;
+        logLevel = "stats acl";
+        defaultSchemas = true;
+        database = "mdb";
+        suffix = "dc=example";
+        rootdn = "cn=root,dc=example";
+        rootpw = "notapassword";
+        declarativeContents."dc=example" = dbContents;
+      };
+    };
+  };
+
+  # Manually managed configDir, for example if dynamic config is essential
+  manualConfigDir = import ./make-test-python.nix {
+    name = "openldap";
+
+    machine = { pkgs, ... }: {
+      services.openldap = {
+        enable = true;
+        configDir = "/var/db/slapd.d";
+      };
+    };
+
+    testScript = let
+      contents = pkgs.writeText "data.ldif" dbContents;
+      config = pkgs.writeText "config.ldif" ''
+        dn: cn=config
+        cn: config
+        objectClass: olcGlobal
+        olcLogLevel: stats
+        olcPidFile: /run/slapd/slapd.pid
+
+        dn: cn=schema,cn=config
+        cn: schema
+        objectClass: olcSchemaConfig
+
+        include: file://${pkgs.openldap}/etc/schema/core.ldif
+        include: file://${pkgs.openldap}/etc/schema/cosine.ldif
+        include: file://${pkgs.openldap}/etc/schema/inetorgperson.ldif
+
+        dn: olcDatabase={1}mdb,cn=config
+        objectClass: olcDatabaseConfig
+        objectClass: olcMdbConfig
+        olcDatabase: {1}mdb
+        olcDbDirectory: /var/db/openldap
+        olcDbIndex: objectClass eq
+        olcSuffix: dc=example
+        olcRootDN: cn=root,dc=example
+        olcRootPW: notapassword
+      '';
+    in ''
+      machine.succeed(
+          "mkdir -p /var/db/slapd.d /var/db/openldap",
+          "slapadd -F /var/db/slapd.d -n0 -l ${config}",
+          "slapadd -F /var/db/slapd.d -n1 -l ${contents}",
+          "chown -R openldap:openldap /var/db/slapd.d /var/db/openldap",
+          "systemctl restart openldap",
+      )
+    '' + testScript;
+  };
 }
--- a/nixos/tests/sssd-ldap.nix
+++ b/nixos/tests/sssd-ldap.nix
@ -1,4 +1,4 @@
-import ./make-test-python.nix ({ pkgs, ... }:
+({ pkgs, ... }:
  let
    dbDomain = "example.org";
    dbSuffix = "dc=example,dc=org";
@ -7,8 +7,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
    ldapRootPassword = "foobar";

    testUser = "alice";
-  in
-  {
+  in import ./make-test-python.nix {
    name = "sssd-ldap";

    meta = with pkgs.stdenv.lib.maintainers; {
@ -18,10 +17,28 @@ import ./make-test-python.nix ({ pkgs, ... }:
    machine = { pkgs, ... }: {
      services.openldap = {
        enable = true;
-        rootdn = "cn=${ldapRootUser},${dbSuffix}";
-        rootpw = ldapRootPassword;
-        suffix = dbSuffix;
-        declarativeContents = ''
+        settings = {
+          children = {
+            "cn=schema".includes = [
+              "${pkgs.openldap}/etc/schema/core.ldif"
+              "${pkgs.openldap}/etc/schema/cosine.ldif"
+              "${pkgs.openldap}/etc/schema/inetorgperson.ldif"
+              "${pkgs.openldap}/etc/schema/nis.ldif"
+            ];
+            "olcDatabase={1}mdb" = {
+              attrs = {
+                objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
+                olcDatabase = "{1}mdb";
+                olcDbDirectory = "/var/db/openldap";
+                olcSuffix = dbSuffix;
+                olcRootDN = "cn=${ldapRootUser},${dbSuffix}";
+                olcRootPW = ldapRootPassword;
+              };
+            };
+          };
+        };
+        declarativeContents = {
+          ${dbSuffix} = ''
            dn: ${dbSuffix}
            objectClass: top
            objectClass: dcObject
@ -47,6 +64,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
            sn: ""
          '';
        };
+      };

      services.sssd = {
        enable = true;
--- a/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix
+++ b/pkgs/applications/audio/bitwig-studio/bitwig-studio3.nix
@ -1,17 +1,17 @@
-{ fetchurl, bitwig-studio1, pulseaudio, xorg }:
+{ fetchurl, bitwig-studio1, pulseaudio, libjack2, xorg }:

 bitwig-studio1.overrideAttrs (oldAttrs: rec {
  name = "bitwig-studio-${version}";
-  version = "3.2.7";
+  version = "3.2.8";

  src = fetchurl {
    url = "https://downloads.bitwig.com/stable/${version}/bitwig-studio-${version}.deb";
-    sha256 = "1mj9kii4bnk5w2p18hypwy8swkpzkaqw98q5fsjq362x4qm0b3py";
+    sha256 = "18ldgmnv7bigb4mch888kjpf4abalpiwmlhwd7rjb9qf6p72fhpj";
  };

  buildInputs = oldAttrs.buildInputs ++ [ xorg.libXtst ];

-  runtimeDependencies = [ pulseaudio ];
+  runtimeDependencies = [ pulseaudio libjack2 ];

  installPhase = ''
    ${oldAttrs.installPhase}
--- a/pkgs/applications/audio/ft2-clone/default.nix
+++ b/pkgs/applications/audio/ft2-clone/default.nix
@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "ft2-clone";
-  version = "1.40";
+  version = "1.41_fix";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "ft2-clone";
    rev = "v${version}";
-    sha256 = "0qc3hai6fhn4amk5ixmxx3yswsi25qpax0r9nvvnyhbcb6crqcs1";
+    sha256 = "0c7jli79ckachl5n2rbhc4yzml8nc36pl9yzxcwgaz544q8pzmaa";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/audio/luppp/build-install.patch
+++ b/pkgs/applications/audio/luppp/build-install.patch
@ -1,16 +0,0 @@
-commit 4ec09e6f6e00e40622a5207ed24dc657da9a9090
-Author: Pavol Rusnak <stick@gk2.sk>
-Date:   Tue Dec 4 12:06:22 2018 +0100
-
-    build: add install: true to executable in meson.build
-
-diff --git a/meson.build b/meson.build
-index 050e1b1..9224ed5 100644
--- a/meson.build
-+++ b/meson.build
-@@ -39,4 +39,5 @@ endforeach
- 
- # compile the main project
- executable('luppp', luppp_src + [version_hxx],
-+    install: true,
-     dependencies: deps)
--- a/pkgs/applications/audio/luppp/default.nix
+++ b/pkgs/applications/audio/luppp/default.nix
@ -1,4 +1,5 @@
-{ stdenv, fetchFromGitHub
+{ stdenv
+, fetchFromGitHub
 , meson
 , ninja
 , pkgconfig
@ -12,26 +13,32 @@

 stdenv.mkDerivation rec {
  pname = "luppp";
-  version = "1.2.0";
-  patches = [ ./build-install.patch ];
+  version = "1.2.1";

  src = fetchFromGitHub {
    owner = "openAVproductions";
    repo = "openAV-Luppp";
    rev = "release-${version}";
-    sha256 = "194yq0lqc2psq9vyxmzif40ccawcvd9jndcn18mkz4f8h5w5rc1a";
+    sha256 = "1ncbn099fyfnr7jw2bp3wf2g9k738lw53m6ssw6wji2wxwmghv78";
  };

  nativeBuildInputs = [
-    meson ninja pkgconfig
+    meson
+    ninja
+    pkgconfig
  ];

  buildInputs = [
-    jack2 cairo liblo libsndfile libsamplerate ntk
+    jack2
+    cairo
+    liblo
+    libsndfile
+    libsamplerate
+    ntk
  ];

  meta = with stdenv.lib; {
-    homepage = "http://openavproductions.com/luppp/";
+    homepage = "http://openavproductions.com/luppp/";  # https does not work
    description = "A music creation tool, intended for live use";
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ prusnak ];
--- a/pkgs/applications/audio/mamba/default.nix
+++ b/pkgs/applications/audio/mamba/default.nix
@ -13,13 +13,13 @@

 stdenv.mkDerivation rec {
  pname = "mamba";
-  version = "1.7";
+  version = "1.8";

  src = fetchFromGitHub {
    owner = "brummer10";
    repo = "Mamba";
    rev = "v${version}";
-    sha256 = "1i78snpyxap2r4899967nyfr8hg20k45nsbshs9h6hdxbfwhikbc";
+    sha256 = "049gvdvvv3hkh1b47h0bia02g1p71agwh6g7q0n4yxz4d81b8kha";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/audio/midi-visualizer/default.nix
+++ b/pkgs/applications/audio/midi-visualizer/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "MIDIVisualizer";
-  version = "5.1";
+  version = "5.2";

  src = fetchFromGitHub {
    owner = "kosua20";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1fjlfa0qjpnjxl3bx5cq3dkswv9wihxmgfpkjijqp7kvf3q127rq";
+    sha256 = "19z8m6clirz8kwfjp0z1j69fjfna8ar7hkgqnlm3lrc84gyx2rpf";
  };

  nativeBuildInputs = [ cmake pkg-config makeWrapper];
--- a/pkgs/applications/audio/nuclear/default.nix
+++ b/pkgs/applications/audio/nuclear/default.nix
@ -0,0 +1,32 @@
+{ appimageTools, lib, fetchurl }:
+let
+  pname = "nuclear";
+  version = "0.6.6";
+  name = "${pname}-v${version}";
+
+  src = fetchurl {
+    url = "https://github.com/nukeop/nuclear/releases/download/v${version}/${name}.AppImage";
+    sha256 = "0c1335m76fv0wfbk07s8r6ln7zbmlqd66052gqfisakl8a1aafl6";
+  };
+
+  appimageContents = appimageTools.extract { inherit name src; };
+in appimageTools.wrapType2 {
+  inherit name src;
+
+  extraInstallCommands = ''
+    mv $out/bin/${name} $out/bin/${pname}
+
+    install -m 444 -D ${appimageContents}/${pname}.desktop -t $out/share/applications
+    substituteInPlace $out/share/applications/${pname}.desktop \
+      --replace 'Exec=AppRun' 'Exec=$out/bin/nuclear'
+    cp -r ${appimageContents}/usr/share/icons $out/share
+  '';
+
+  meta = with lib; {
+    description = "Streaming music player that finds free music for you";
+    homepage = "https://nuclear.js.org/";
+    license = licenses.agpl3Plus;
+    maintainers = [ maintainers.ivar ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/audio/pd-plugins/gem/default.nix
+++ b/pkgs/applications/audio/pd-plugins/gem/default.nix
@ -15,27 +15,15 @@

 stdenv.mkDerivation rec {
  pname = "gem-unstable";
-  # The patch below applies to the latest release (v0.94), but then the build
-  # fails. I didn't track down what changed between that version and the
-  # current master that fixes the build on Nix
-  version = "2020-03-26";
+  version = "2020-09-22";

  src = fetchFromGitHub {
    owner = "umlaeute";
    repo = "Gem";
-    rev = "f38748d71bfca00e4d2b2f31d6c4e3759c03d599";
-    sha256 = "0bkky5fk0a836bapslrgzil272iq9y704y7hw254cfq5ffjd4qjy";
+    rev = "2edfde4f0587e72ef325e7f53681936dcc19655b";
+    sha256 = "0k5sq128wxi2qhaidspkw310pdgysxs47agv09pkjgvch2n4d5dq";
  };

-  patches = [
-    # Update autoconf OpenGL/GLU/GLUT detection scripts
-    # https://github.com/umlaeute/Gem/pull/251
-    (fetchpatch {
-      url = "https://github.com/umlaeute/Gem/commit/343a486c2b5c3427696f77aeabdff440e6590fc7.diff";
-      sha256 = "0gkzxv80rgg8lgp9av5qp6xng3ldhnbjz9d6r7ym784fw8yx41yj";
-    })
-  ];
-
  nativeBuildInputs = [
    autoreconfHook
    file
--- a/pkgs/applications/audio/picard/default.nix
+++ b/pkgs/applications/audio/picard/default.nix
@ -12,13 +12,13 @@ let
  ;
 in pythonPackages.buildPythonApplication rec {
  pname = "picard";
-  version = "2.5.1";
+  version = "2.5.2";

  src = fetchFromGitHub {
    owner = "metabrainz";
    repo = pname;
    rev = "release-${version}";
-    sha256 = "13q926iqwdba6ds5s3ir57c9bkg8gcv6dhqvhmg00fnzkq9xqk3d";
+    sha256 = "193pk6fhrqar2ra8krj6xdd7sm5qfw0p708iazzwk4b8c8g0q72j";
  };

  nativeBuildInputs = [ gettext qt5.wrapQtAppsHook qt5.qtbase ]
--- a/pkgs/applications/audio/projectm/default.nix
+++ b/pkgs/applications/audio/projectm/default.nix
@ -13,13 +13,13 @@

 mkDerivation rec {
  pname = "projectm";
-  version = "3.1.7";
+  version = "3.1.8";

  src = fetchFromGitHub {
    owner = "projectM-visualizer";
    repo = "projectM";
    rev = "v${version}";
-    sha256 = "1wm5fym6c1yb972pmil7j9axinqqwrj68cwd2sc7ky8c5z2fsdna";
+    sha256 = "17zyxj1q0zj17jskq8w9bn2ijn34ldvdq61wy01yf5wgngax2r4z";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/audio/pt2-clone/default.nix
+++ b/pkgs/applications/audio/pt2-clone/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "pt2-clone";
-  version = "1.23";
+  version = "1.24";

  src = fetchFromGitHub {
    owner = "8bitbubsy";
    repo = "pt2-clone";
    rev = "v${version}";
-    sha256 = "1vixpp0vqpawqviwl44wn8zf602zyyrgqnjzrlwjrmdzydx9c93y";
+    sha256 = "0lw18943dqgydgl4byk440j016m486s82k6hhqjn3w75108b7w1r";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/audio/ptcollab/default.nix
+++ b/pkgs/applications/audio/ptcollab/default.nix
@ -9,13 +9,13 @@

 mkDerivation rec {
  pname = "ptcollab";
-  version = "0.3.5";
+  version = "0.3.5.1";

  src = fetchFromGitHub {
    owner = "yuxshao";
    repo = "ptcollab";
    rev = "v${version}";
-    sha256 = "0mgn7lkpgj72hsybnnj0kpfyls4aha1qvv4nhdyclqdfbb6mldxg";
+    sha256 = "1ahfxjm1chz8k65rs7rgn4s2bgippq58fjcxl8fr21pzn718wqf1";
  };

  nativeBuildInputs = [ qmake ];
--- a/pkgs/applications/audio/strawberry/default.nix
+++ b/pkgs/applications/audio/strawberry/default.nix
@ -35,13 +35,13 @@

 mkDerivation rec {
  pname = "strawberry";
-  version = "0.8.3";
+  version = "0.8.4";

  src = fetchFromGitHub {
    owner = "jonaski";
    repo = pname;
    rev = version;
-    sha256 = "0v3rbpaz6pqkam0cj86ydq8gc2rhas8mhwgvy31djvxng9nv3h5j";
+    sha256 = "145djlfvbkx2b1wqipk51mz82dhm27vmh9x00lkn24q1xz1y6h5n";
  };

  buildInputs = [
--- a/pkgs/applications/blockchains/turbo-geth.nix
+++ b/pkgs/applications/blockchains/turbo-geth.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "turbo-geth";
-  version = "2020.11.02";
+  version = "2020.11.03";

  src = fetchFromGitHub {
    owner = "ledgerwatch";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1bfywbg6mm3q4wd0mslcv5sj779277izzlqawqvqy3yxnpb6cwj5";
+    sha256 = "0fhfrk0k8w1mx4kf81kyirdpa91fm4g5pnvhr9cybrvygc4yx1f7";
  };

  vendorSha256 = "16vawkky612zf45d8dhipjmhrprmi28z9wdcnjy07x3bxdyfbhfr";
--- a/pkgs/applications/editors/emacs/generic.nix
+++ b/pkgs/applications/editors/emacs/generic.nix
@ -145,7 +145,7 @@ in stdenv.mkDerivation {
    rm -rf $siteVersionDir
  '' + lib.optionalString withCsrc ''
    for srcdir in src lisp lwlib ; do
-      dstdir=$siteVersionDir/$srcdir
+      dstdir=$out/share/emacs/$siteVersionDir/$srcdir
      mkdir -p $dstdir
      find $srcdir -name "*.[chm]" -exec cp {} $dstdir \;
      cp $srcdir/TAGS $dstdir
--- a/pkgs/applications/editors/emacs/site-start.el
+++ b/pkgs/applications/editors/emacs/site-start.el
@ -52,9 +52,6 @@ least specific (the system profile)"
         (file-name-directory load-file-name)))) ; .../emacs/site-lisp/
      (version
       (file-name-as-directory
-        (concat
-         (number-to-string emacs-major-version)
-         "."
-         (number-to-string emacs-minor-version))))
+        emacs-version))
      (src (file-name-as-directory "src")))
  (setq find-function-C-source-directory (concat emacs version src)))
--- a/pkgs/applications/editors/glow/default.nix
+++ b/pkgs/applications/editors/glow/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "glow";
-  version = "1.1.0";
+  version = "1.2.0";

  src = fetchFromGitHub {
    owner = "charmbracelet";
    repo = "glow";
    rev = "v${version}";
-    sha256 = "016psbm93ni81k87i9gx3cjr59j1fmpq5x8vz0ydabczzdshd1py";
+    sha256 = "0gwzf2p67s0nsb7my5njcz4znlfl62s9gg7x9ywbk9jzsr9avkhv";
  };

-  vendorSha256 = "0gvlbj8b5sqk93ahg4b2krwrmr8ljz7cah77fxaxcd98apap0pw6";
+  vendorSha256 = "1p50qr7hbc8vyifa23z7xr43b4fpmwdzg7hqs503c124kpbpk45z";

  doCheck = false;

--- a/pkgs/applications/editors/thonny/default.nix
+++ b/pkgs/applications/editors/thonny/default.nix
@ -4,13 +4,13 @@ with python3.pkgs;

 buildPythonApplication rec {
  pname = "thonny";
-  version = "3.2.7";
+  version = "3.3.0";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "0gzvdgg5l4j0wgkh7lp4wjabrpxvvs5m7mnpszqixxijdffjd4cj";
+    sha256 = "1k1iy01az65w463j6id7iyrbinjbjd220i100mrnxyn569dxmf34";
  };

  propagatedBuildInputs = with python3.pkgs; [
--- a/pkgs/applications/editors/tiled/default.nix
+++ b/pkgs/applications/editors/tiled/default.nix
@ -3,13 +3,13 @@

 mkDerivation rec {
  pname = "tiled";
-  version = "1.4.2";
+  version = "1.4.3";

  src = fetchFromGitHub {
    owner = "bjorn";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0b3xjcc86vs9lfxr7xann9d43dz3v3x1g7j1mcn31sy2n68a1wx3";
+    sha256 = "0n8p7bp5pqq72c65av3v7wbazwphh78pw27nqvpiyp9y8k5w4pg0";
  };

  nativeBuildInputs = [ pkgconfig qmake ];
--- a/pkgs/applications/graphics/deskew/default.nix
+++ b/pkgs/applications/graphics/deskew/default.nix
@ -1,13 +1,13 @@
-{ stdenv, fetchFromBitbucket, libtiff, fpc }:
+{ stdenv, fetchFromGitHub, libtiff, fpc }:

 stdenv.mkDerivation rec {

  pname = "deskew";
  version = "1.25";

-  src = fetchFromBitbucket {
+  src = fetchFromGitHub {
    owner = "galfar";
-    repo = "app-deskew";
+    repo = pname;
    rev = "v${version}";
    sha256 = "0zjjj66qhgqkmfxl3q7p78dv4xl4ci918pgl4d5259pqdj1bfgc8";
  };
--- a/pkgs/applications/graphics/digikam/default.nix
+++ b/pkgs/applications/graphics/digikam/default.nix
@ -39,7 +39,7 @@
 , marble
 , libGL
 , libGLU
-, opencv3
+, opencv
 , pcre
 , threadweaver
 , x265
@ -83,7 +83,7 @@ mkDerivation rec {
    libusb1
    libGL
    libGLU
-    opencv3
+    opencv
    pcre
    x265

--- a/pkgs/applications/graphics/drawio/default.nix
+++ b/pkgs/applications/graphics/drawio/default.nix
@ -11,11 +11,11 @@

 stdenv.mkDerivation rec {
  pname = "drawio";
-  version = "13.9.5";
+  version = "13.9.9";

  src = fetchurl {
    url = "https://github.com/jgraph/drawio-desktop/releases/download/v${version}/draw.io-x86_64-${version}.rpm";
-    sha256 = "1glklqpbx28ssi41cdshckgvix24wkqmsw0rgf964vjc28qgfy1s";
+    hash = "sha256-+rNbLHpkFnvM7gDFbZ9AItPIA2IVTmscz+gTXF8riIY=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/imgbrd-grabber/default.nix
+++ b/pkgs/applications/graphics/imgbrd-grabber/default.nix
@ -0,0 +1,87 @@
+{ stdenv
+, cmake
+, fetchFromGitHub
+, wrapQtAppsHook
+, qtmultimedia
+, qttools
+, qtscript
+, qtdeclarative
+, qtbase
+, autogen
+, automake
+, makeWrapper
+, catch2
+, nodejs
+, libpulseaudio
+, openssl
+, rsync
+, typescript
+}:
+stdenv.mkDerivation rec {
+  name = "imgbrd-grabber";
+
+  version = "7.3.2";
+  src = fetchFromGitHub {
+    owner = "Bionus";
+    repo = "imgbrd-grabber";
+    rev = "v${version}";
+    sha256 = "053rwvcr88fcba0447a6r115cgnqsm9rl066z8d5jacqnhdij58k";
+    fetchSubmodules = true;
+  };
+
+  buildInputs = [
+    openssl
+    makeWrapper
+    libpulseaudio
+    typescript
+  ];
+
+  nativeBuildInputs = [
+    qtmultimedia
+    qtbase
+    qtdeclarative
+    qttools
+    nodejs
+    cmake
+    wrapQtAppsHook
+  ];
+
+  extraOutputsToLink = [ "doc" ];
+
+  postPatch = ''
+    # the package.sh script provides some install helpers
+    # using this might make it easier to maintain/less likely for the
+    # install phase to fail across version bumps
+    patchShebangs ./scripts/package.sh
+
+    # ensure the script uses the rsync package from nixpkgs
+    substituteInPlace ../scripts/package.sh --replace "rsync" "${rsync}/bin/rsync"
+
+
+    # the npm build step only runs typescript
+    # run this step directly so it doesn't try and fail to download the unnecessary node_modules, etc.
+    substituteInPlace ./sites/CMakeLists.txt --replace "npm install" "npm run build"
+
+    # remove the vendored catch2
+    rm -rf tests/src/vendor/catch
+
+    # link the catch2 sources from nixpkgs
+    ln -sf ${catch2.src} tests/src/vendor/catch
+  '';
+
+  postInstall = ''
+    # move the binaries to the share/Grabber folder so
+    # some relative links can be resolved (e.g. settings.ini)
+    mv $out/bin/* $out/share/Grabber/
+
+    cd ../..
+    # run the package.sh with $out/share/Grabber as the $APP_DIR
+    sh ./scripts/package.sh $out/share/Grabber
+
+    # add symlinks for the binaries to $out/bin
+    ln -s $out/share/Grabber/Grabber $out/bin/Grabber
+    ln -s $out/share/Grabber/Grabber-cli $out/bin/Grabber-cli
+  '';
+
+  sourceRoot = "source/src";
+}
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@ -19,7 +19,7 @@
 }:

 let
-  version = "4.0.4";
+  version = "4.0.5";

  # electrum is not compatible with dnspython 2.0.0 yet
  # use the latest 1.x release instead
@ -43,7 +43,7 @@ let
    owner = "spesmilo";
    repo = "electrum";
    rev = version;
-    sha256 = "0bzvyfqnd0r0l8syf95hr3nsh8rmmmcs74bvc7v04v0nm5m0fmf1";
+    sha256 = "0fdsgxzgsxvx6hhjag894nzzdfq989bx1d4anljzcz2ppy4ivpxg";

    extraPostFetch = ''
      mv $out ./all
@ -58,7 +58,7 @@ py.pkgs.buildPythonApplication {

  src = fetchurl {
    url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "03dc5jwgp18sism5v4lbqfyn2zljchng8j2yi07yf8i01ivy2mmv";
+    sha256 = "06ml9lwa5k2dp56sm5s7dsl6qirqmgim7rn853cqcq9n45z41437";
  };

  postUnpack = ''
@ -154,6 +154,6 @@ py.pkgs.buildPythonApplication {
    homepage = "https://electrum.org/";
    license = licenses.mit;
    platforms = platforms.all;
-    maintainers = with maintainers; [ ehmry joachifm np ];
+    maintainers = with maintainers; [ ehmry joachifm np prusnak ];
  };
 }
--- a/pkgs/applications/misc/gpx/default.nix
+++ b/pkgs/applications/misc/gpx/default.nix
@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "gpx";
-  version = "2.5.2";
+  version = "2.6.7";

  nativeBuildInputs = [ autoreconfHook ];

@ -10,7 +10,7 @@ stdenv.mkDerivation rec {
    owner = "markwal";
    repo = "GPX";
    rev = version;
-    sha256 = "1yab269x8qyf7rd04vaxyqyjv4pzz9lp4sc4dwh927k23avr3rw5";
+    sha256 = "1dl5vlsx05ipy10h18xigicb3k7m33sa9hfyd46hkpr2glx7jh4p";
  };

  meta = {
--- a/pkgs/applications/misc/hstr/default.nix
+++ b/pkgs/applications/misc/hstr/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "hstr";
-  version = "2.2";
+  version = "2.3";

  src = fetchFromGitHub {
    owner  = "dvorka";
    repo   = "hstr";
    rev    = version;
-    sha256 = "07fkilqlkpygvf9kvxyvl58g3lfq0bwwdp3wczy4hk8qlbhmgihn";
+    sha256 = "1chmfdi1dwg3sarzd01nqa82g65q7wdr6hrnj96l75vikwsg986y";
  };

  nativeBuildInputs = [ autoreconfHook pkgconfig ];
--- a/pkgs/applications/misc/rss-bridge-cli/default.nix
+++ b/pkgs/applications/misc/rss-bridge-cli/default.nix
@ -0,0 +1,28 @@
+{ stdenv, writeShellScriptBin, rss-bridge, php }:
+
+let
+  phpWithExts = (php.withExtensions
+    ({ all, ... }: with all; [
+      curl
+      filter
+      iconv
+      json
+      mbstring
+      openssl
+      simplexml
+      sqlite3
+    ])
+  );
+  phpBin = "${phpWithExts}/bin/php";
+in (writeShellScriptBin "rss-bridge-cli" ''
+  ${phpBin} ${rss-bridge}/index.php "$@"
+'').overrideAttrs (oldAttrs: rec {
+  version = rss-bridge.version;
+
+  meta = with stdenv.lib; {
+    description = "Command-line interface for RSS-Bridge";
+    homepage = "https://github.com/RSS-Bridge/rss-bridge";
+    license = licenses.unlicense;
+    maintainers = with maintainers; [ ymeister ];
+  };
+})
--- a/pkgs/applications/misc/xmrig/default.nix
+++ b/pkgs/applications/misc/xmrig/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "xmrig";
-  version = "6.2.2";
+  version = "6.5.3";

  src = fetchFromGitHub {
    owner = "xmrig";
    repo = "xmrig";
    rev = "v${version}";
-    sha256 = "0ph9mrg8i6cv2xjx79118hlm1gcynfavcmp0x2mvvlraxmghfp7a";
+    sha256 = "0hywdb6zzkmiik93bnsw6pzir7189mnm46brg4v8fyn56vxskfmi";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/misc/xteddy/default.nix
+++ b/pkgs/applications/misc/xteddy/default.nix
@ -6,8 +6,8 @@ stdenv.mkDerivation rec {
  src = fetchFromGitLab {
    domain = "salsa.debian.org";
    owner = "games-team";
-    repo = "xteddy";
-    rev = "debian%2F${version}"; # %2F = urlquote("/");
+    repo = pname;
+    rev = "debian/${version}";
    sha256 = "0rm7w78d6qajq4fvi4agyqm0c70f3c1i0cy2jdb6kqql2k8w78qy";
  };

--- a/pkgs/applications/networking/Sylk/default.nix
+++ b/pkgs/applications/networking/Sylk/default.nix
@ -2,7 +2,7 @@

 let
  pname = "Sylk";
-  version = "2.9.2";
+  version = "2.9.3";
 in

 appimageTools.wrapType2 rec {
@ -10,7 +10,7 @@ appimageTools.wrapType2 rec {

  src = fetchurl {
    url = "http://download.ag-projects.com/Sylk/Sylk-${version}-x86_64.AppImage";
-    hash = "sha256-pfzTeKxY2fs98mgvhzaI/uBbYYkxfnQ+6jQ+gTSeEkA=";
+    hash = "sha256-JH/TUGAYZTIb/L926CoYb5yzPtbOKVmnWRmHO6DxDyY=";
  };

  profile = ''
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -86,11 +86,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.16.72";
+  version = "1.16.76";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "0gcmbqkrkdrjj0cc34bp56iqawhyfz46k7q8x82pw9b1rbjp1x6k";
+    sha256 = "1nbgiwflmr3ik428yarmnpx10dmqai2m4k910miqd92mwmfb0pib";
  };

  dontConfigure = true;
--- a/pkgs/applications/networking/browsers/webbrowser/default.nix
+++ b/pkgs/applications/networking/browsers/webbrowser/default.nix
@ -1,6 +1,6 @@
 { stdenv, lib, fetchgit, makeDesktopItem, pkgconfig, makeWrapper
 # Build
-, python2, autoconf213, yasm, perl, ccache
+, python2, autoconf213, yasm, perl
 , unzip, gnome2, gnum4

 # Runtime
@ -41,7 +41,7 @@ in stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [
-    gnum4 makeWrapper perl pkgconfig python2 ccache
+    gnum4 makeWrapper perl pkgconfig python2
  ];

  buildInputs = [
@ -54,7 +54,6 @@ in stdenv.mkDerivation rec {
  configurePhase = ''
    export MOZCONFIG=$PWD/.mozconfig
    export MOZ_NOSPAM=1
-    export HOME=$PWD # Needed by ccache

    cp $src/doc/mozconfig.example $MOZCONFIG
    # Need to modify it
@ -65,7 +64,8 @@ in stdenv.mkDerivation rec {
      --replace "mk_add_options AUTOCONF=/usr/bin/autoconf-2.13" "mk_add_options AUTOCONF=${autoconf213}/bin/autoconf" \
      --replace 'mk_add_options MOZ_OBJDIR=$HOME/build/wbobjects/' "" \
      --replace "ac_add_options --x-libraries=/usr/lib64" "ac_add_options --x-libraries=${lib.makeLibraryPath [ xorg.libX11 ]}" \
-      --replace "_BUILD_64=1" "_BUILD_64=${lib.optionalString stdenv.hostPlatform.is64bit "1"}"
+      --replace "_BUILD_64=1" "_BUILD_64=${lib.optionalString stdenv.hostPlatform.is64bit "1"}" \
+      --replace "--enable-ccache" "--disable-ccache"

    echo >> $MOZCONFIG '
    #
--- a/pkgs/applications/networking/cloudflared/default.nix
+++ b/pkgs/applications/networking/cloudflared/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "cloudflared";
-  version = "2020.11.5";
+  version = "2020.11.10";

  src = fetchFromGitHub {
    owner  = "cloudflare";
    repo   = "cloudflared";
    rev    = version;
-    sha256 = "09bjqcrz7s40m7afb80dpx7jncp5prn2p6bksspv5wqc84l2nn5d";
+    sha256 = "1jajjfbwbqvkr2cc9y4ryn8z1sh19hwydxidfdpgmq794ci8v4np";
  };

  vendorSha256 = null;
--- a/pkgs/applications/networking/cluster/argo/default.nix
+++ b/pkgs/applications/networking/cluster/argo/default.nix
@ -19,13 +19,13 @@ let
 in
 buildGoModule rec {
  pname = "argo";
-  version = "2.11.7";
+  version = "2.11.8";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo";
    rev = "v${version}";
-    sha256 = "1i7qgghnb39bibnk07f47k64qpkb1k8mi3bbfnx6mxl0jlq335af";
+    sha256 = "19nkkj69506759qjfrz6d7j57z8rqjslgfrdrkx01ri68cil4mfh";
  };

  vendorSha256 = "1ca0ssvbi4vrsn9ljc783hnh9bmf5p8nr1lz5wm8g3gbrrrf1ray";
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@ -2,14 +2,14 @@

 buildGoModule rec {
  pname = "argocd";
-  version = "1.7.8";
+  version = "1.7.10";
  commit = "ef5010c3a0b5e027fd642732d03c5b0391b1e574";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo-cd";
    rev = "v${version}";
-    sha256 = "1pwk6mzmlsx43c75wl5lglpxgc2jkgzra4443hwp6n0wfgzajfp4";
+    sha256 = "1vkdny88lmxkm3iw8qv5rrl0g5xwi16hfm2f6dga8i8xl555m78c";
  };

  vendorSha256 = "0c5gykijwjrq3cx9qg9hm5j7axccngc1kp5qj3429a2ilw80l8pl";
--- a/pkgs/applications/networking/cluster/helmfile/default.nix
+++ b/pkgs/applications/networking/cluster/helmfile/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "helmfile";
-  version = "0.134.1";
+  version = "0.135.0";

  src = fetchFromGitHub {
    owner = "roboll";
    repo = "helmfile";
    rev = "v${version}";
-    sha256 = "14qlz6b4iddc5qxm4w4pvhkbzv60qzymn3bkyrpbx189b2yfvh6c";
+    sha256 = "1ky9mh5n6n84g77ax1dn1cisgxjwyrhnapaikyj4q53zcbyai3ng";
  };

-  vendorSha256 = "0nk2f38qjmhy45pw9yz53acmsdy2fdxswqnasvbmfzrb85b0fnfq";
+  vendorSha256 = "0dycngvk4nymcrkn6pn2q2h2zfvhc69m1zs2pspl58sa0mkakk2p";

  doCheck = false;

--- a/pkgs/applications/networking/cluster/istioctl/default.nix
+++ b/pkgs/applications/networking/cluster/istioctl/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "istioctl";
-  version = "1.7.4";
+  version = "1.7.5";

  src = fetchFromGitHub {
    owner = "istio";
    repo = "istio";
    rev = version;
-    sha256 = "1vy6y6gk7ljnrb7cxxaa60i4ycylsrd2yszbly1aaz5vnh1vsfz9";
+    sha256 = "10h2ak3s74xb1rjvc6bc5yiyq2k8qbv07wxnshiqp5cnd6pjni0w";
  };
-  vendorSha256 = "0f2n8mwnj9i4qifs0f63jrgr61mjs3c1arxnny723i5pialj3zdl";
+  vendorSha256 = "1xj77w2h7qg808v6ll8hm5nvnb2lwky789aikgxli2k6m0cy0c5k";

  doCheck = false;

--- a/pkgs/applications/networking/cluster/minikube/default.nix
+++ b/pkgs/applications/networking/cluster/minikube/default.nix
@ -11,7 +11,7 @@

 buildGoModule rec {
  pname = "minikube";
-  version = "1.15.0";
+  version = "1.15.1";

  vendorSha256 = "1xkk4f8qjqx5x878iniclni3jm2f7ka47va756vc3vk8p5s6vpdk";

@ -21,7 +21,7 @@ buildGoModule rec {
    owner = "kubernetes";
    repo = "minikube";
    rev = "v${version}";
-    sha256 = "1n1jhsa0lrfpqvl7m5il37l3f22ffgg4zv8g42xq24cgna951a1z";
+    sha256 = "03knkc8z3vri73j1aa9ry6p1rxql3d75kphd429x5am856mpnn6g";
  };

  nativeBuildInputs = [ go-bindata installShellFiles pkg-config which ];
--- a/pkgs/applications/networking/cluster/octant/plugins/starboard-octant-plugin.nix
+++ b/pkgs/applications/networking/cluster/octant/plugins/starboard-octant-plugin.nix
@ -0,0 +1,26 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "starboard-octant-plugin";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "aquasecurity";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0rqlks2f7cwx14xynaq95dxlzh18rsdz1w8a2ia24lvfwf8b95rf";
+  };
+
+  vendorSha256 = "1fxb97wf69phhqwqg86wcx4dkzh67snzl1xfmj4wvfq16b9xj11j";
+
+  meta = with lib; {
+    description = "Octant plugin for viewing Starboard security information";
+    longDescription = ''
+      This is an Octant plugin for Starboard which provides visibility into vulnerability assessment reports for
+      Kubernetes workloads stored as custom security resources.
+    '';
+    homepage = src.meta.homepage;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ jk ];
+  };
+}
--- a/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
+++ b/pkgs/applications/networking/cluster/tektoncd-cli/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "tektoncd-cli";
-  version = "0.13.1";
+  version = "0.14.0";

  src = fetchFromGitHub {
    owner = "tektoncd";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "0cjih8h64wwdp022pn70xqxafdk34z2y2ipxb86dlf2zdrf9xv53";
+    sha256 = "1mkbwh4cmhx9in928vlvs7xjjklpsxbv5niv8jmsbnifflg1an8p";
  };

  vendorSha256 = null;
@ -27,10 +27,10 @@ buildGoModule rec {
    mkdir -p "$out/share/man/man1"
    cp docs/man/man1/* "$out/share/man/man1"

-    # TODO: Move to enhanced installShellCompletion when merged: PR #83630
-    $out/bin/tkn completion bash > tkn.bash
-    $out/bin/tkn completion zsh  > _tkn
-    installShellCompletion tkn.bash --zsh _tkn
+    installShellCompletion --cmd tkn \
+      --bash <($out/bin/tkn completion bash) \
+      --fish <($out/bin/tkn completion fish) \
+      --zsh <($out/bin/tkn completion zsh)
  '';

  meta = with lib; {
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -468,11 +468,12 @@
    "version": "1.0.0"
  },
  "kubernetes": {
-    "owner": "terraform-providers",
+    "owner": "hashicorp",
+    "provider-source-address": "registry.terraform.io/hashicorp/kubernetes",
    "repo": "terraform-provider-kubernetes",
-    "rev": "v1.11.3",
-    "sha256": "13j4xwibjgiqpzwbwd0d3z1idv0lwz78ip38khhmhwa78mjjb4zz",
-    "version": "1.11.3"
+    "rev": "v1.13.3",
+    "sha256": "01hkbb81r3k630s3ww6379p66h1fsd5cd1dz14jm833nsr142c0i",
+    "version": "1.13.3"
  },
  "kubernetes-alpha": {
    "owner": "hashicorp",
--- a/pkgs/applications/networking/cluster/terragrunt/default.nix
+++ b/pkgs/applications/networking/cluster/terragrunt/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "terragrunt";
-  version = "0.26.2";
+  version = "0.26.4";

  src = fetchFromGitHub {
    owner = "gruntwork-io";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0bp43rsnkq2ysdl0v28i9agan738m0zk5yn8zza6js28sx0y7kns";
+    sha256 = "0q1dzrjfg97bk1prknwpdgcf5vnpdi0f41wb5ni4550zzqsz3rnk";
  };

  vendorSha256 = "0l85jx02dj9qvxs8l0ln5fln8vssi0fisblm5i1scz9x4a1jqg9n";
--- a/pkgs/applications/networking/cluster/tilt/default.nix
+++ b/pkgs/applications/networking/cluster/tilt/default.nix
@ -5,13 +5,13 @@ buildGoModule rec {
  /* Do not use "dev" as a version. If you do, Tilt will consider itself
    running in development environment and try to serve assets from the
    source tree, which is not there once build completes.  */
-  version = "0.17.2";
+  version = "0.17.11";

  src = fetchFromGitHub {
    owner  = "tilt-dev";
    repo   = pname;
    rev    = "v${version}";
-    sha256 = "0wiqnlam4f7085n3djvb5phhvw9df61bj8w6c5rcpffykg33vhmi";
+    sha256 = "0ggr8l93xpfm4ljjxw0g6kbm0q64hviaamcb5r2vrx9nabz95n95";
  };
  vendorSha256 = null;

--- a/pkgs/applications/networking/instant-messengers/baresip/default.nix
+++ b/pkgs/applications/networking/instant-messengers/baresip/default.nix
@ -1,6 +1,6 @@
 {stdenv, fetchurl, zlib, openssl, libre, librem, pkgconfig, gst_all_1
 , cairo, mpg123, alsaLib, SDL, libv4l, celt, libsndfile, srtp, ffmpeg_3
-, gsm, speex, portaudio, spandsp, libuuid, ccache, libvpx
+, gsm, speex, portaudio, spandsp, libuuid, libvpx
 }:
 stdenv.mkDerivation rec {
  version = "0.6.5";
@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [zlib openssl libre librem cairo mpg123
    alsaLib SDL libv4l celt libsndfile srtp ffmpeg_3 gsm speex portaudio spandsp libuuid
-    ccache libvpx
+    libvpx
  ] ++ (with gst_all_1; [ gstreamer gst-libav gst-plugins-base gst-plugins-bad gst-plugins-good ]);
  makeFlags = [
    "LIBRE_MK=${libre}/share/re/re.mk"
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@ -8,6 +8,7 @@
 # Runtime
 , coreutils, faac, pciutils, procps, utillinux
 , pulseaudioSupport ? true, libpulseaudio ? null
+, alsaSupport ? stdenv.isLinux, alsaLib ? null
 }:

 assert pulseaudioSupport -> libpulseaudio != null;
@ -45,7 +46,8 @@ in mkDerivation {
    qtscript qtwebchannel qtwebengine qtimageformats qtsvg qttools qtwayland
  ];

-  runtimeDependencies = optional pulseaudioSupport libpulseaudio;
+  runtimeDependencies = optional pulseaudioSupport libpulseaudio
+    ++ optional alsaSupport alsaLib;

  installPhase =
    let
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix
@ -1,665 +1,665 @@
 {
-  version = "78.4.3";
+  version = "78.5.0";
  sources = [
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/af/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/af/thunderbird-78.5.0.tar.bz2";
      locale = "af";
      arch = "linux-x86_64";
-      sha256 = "03d4e32b23408b003de5347b2a26d9e3e734f7c3e811510ba81114eff80e6fa3";
+      sha256 = "011468ce085f2b5da8968b0622733d9fa25b47ec5e83b3bf4171323948aebb35";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/ar/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/ar/thunderbird-78.5.0.tar.bz2";
      locale = "ar";
      arch = "linux-x86_64";
-      sha256 = "5aefbc61f46d59de19061a0e76949642e254a13867881b40b6bac289791c281e";
+      sha256 = "661b0f1981b21df20b910f9d833d86c2812b189097ad7e1affc7338abb4f0c5c";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/ast/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/ast/thunderbird-78.5.0.tar.bz2";
      locale = "ast";
      arch = "linux-x86_64";
-      sha256 = "1e328339808efed1db23ed372841ff65f64e1bda8e1d4be81fd00039468bbb1f";
+      sha256 = "c1acc2b6d5dd22adeab3106c3c6925ce0c1a434e1d38b3f699fab4ca319eab14";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/be/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/be/thunderbird-78.5.0.tar.bz2";
      locale = "be";
      arch = "linux-x86_64";
-      sha256 = "f42230768f2907fb3d23a03a56fc20f14ff5ded7b4418debb3e77c4942eb7db8";
+      sha256 = "6f76341164c182dd8392d2d1abbb0408a3ab773a7389dbf1eb9bb4042d49f500";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/bg/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/bg/thunderbird-78.5.0.tar.bz2";
      locale = "bg";
      arch = "linux-x86_64";
-      sha256 = "27a72288cbaaaaee6a24a36bb2e463a0426810e97938cbfe012dceb1a3800fd0";
+      sha256 = "4e97b38383d3a145645ca518449e37e42b5b25cbb98cb72f52657b4813f2b343";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/br/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/br/thunderbird-78.5.0.tar.bz2";
      locale = "br";
      arch = "linux-x86_64";
-      sha256 = "fa1b6c891e3d9d097857a08181030e1df2201240ae466c4adc6fc0be0982d002";
+      sha256 = "1d5bcb706bf2eb589aa0c64589fc5b22021977947d6e1099f339a46c55a56f84";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/ca/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/ca/thunderbird-78.5.0.tar.bz2";
      locale = "ca";
      arch = "linux-x86_64";
-      sha256 = "6bcc123c7ecccbf42022e302b63683cdf77f6f6f2a615b12c5ea9e6a081fb900";
+      sha256 = "3284b98707ee67977f148bd20d88750cc03799d9ba4aa5668c44901846fb8bcf";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/cak/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/cak/thunderbird-78.5.0.tar.bz2";
      locale = "cak";
      arch = "linux-x86_64";
-      sha256 = "392cc166ee9be6c5cf8294f727f97cb21b6ad7ebb77d263bba273f02cb15e661";
+      sha256 = "7998d66eaf3edc4ee156dff06a30de8abae08ff66b380ea93d7ec0b827a0ea29";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/cs/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/cs/thunderbird-78.5.0.tar.bz2";
      locale = "cs";
      arch = "linux-x86_64";
-      sha256 = "60f5ea97e75f965ac0947e51c8cb8e709e5fa8f67ea478babe936032dee5a912";
+      sha256 = "5ba37c9dd7a1fc291bcc8b24ef025432dbd5f8a45ea2a4d1273177c6a7c8f6bd";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/cy/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/cy/thunderbird-78.5.0.tar.bz2";
      locale = "cy";
      arch = "linux-x86_64";
-      sha256 = "93aa92633d2414ad59aedea8b1a820b158a21c042cbfaedd8abd2b5a41e31c5c";
+      sha256 = "baaad2ef28f51b6f57fa6f0583e8e0125c50ea3b4c94dea5854faf9826aecad0";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/da/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/da/thunderbird-78.5.0.tar.bz2";
      locale = "da";
      arch = "linux-x86_64";
-      sha256 = "dc263e9d186f4ca8cd404b6e5bd13f9d2874e0e2507eaa55e99a6b5ab3b05179";
+      sha256 = "6113ed3f5a36f16e64f0cc499eb683a0d7d377d0cce37882f46f203893b789d8";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/de/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/de/thunderbird-78.5.0.tar.bz2";
      locale = "de";
      arch = "linux-x86_64";
-      sha256 = "d9dbf07f3c57f688b08f75673074562ad9d4a9b138159f353415d63f9ccac80b";
+      sha256 = "81490e8cd8110285177c27f4057ff48ed1bdb55c94c83cc78e262b9cfcbd87ea";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/dsb/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/dsb/thunderbird-78.5.0.tar.bz2";
      locale = "dsb";
      arch = "linux-x86_64";
-      sha256 = "084ef3ef3628d003c75dea9a9fa5897424e6e564cb18fb5bca33b341c8c511cc";
+      sha256 = "4c6abc365842c902ff184b403a6c271760bd8e71da9efa90d30310e032b03729";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/el/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/el/thunderbird-78.5.0.tar.bz2";
      locale = "el";
      arch = "linux-x86_64";
-      sha256 = "4e91e7d21d0a3d524de7e41201ce8af58518a7e0292c11fc2961a84e9b7d04fb";
+      sha256 = "d492a83d3ddaf5beead77fd90a2334ca4ed90023d4c4ad478249a360f49cd5be";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/en-CA/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/en-CA/thunderbird-78.5.0.tar.bz2";
      locale = "en-CA";
      arch = "linux-x86_64";
-      sha256 = "922220811fb0083e8dc51c7cbd703530acdfeb0e9403d1a0909ba1618db020bf";
+      sha256 = "d7ddc5a22e89827067255726824e46d3355906441051c9faa04e6241cb833955";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/en-GB/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/en-GB/thunderbird-78.5.0.tar.bz2";
      locale = "en-GB";
      arch = "linux-x86_64";
-      sha256 = "090806f6ebf12efbc5c20a920451feeb0d88d1e7366a074553b79080869687c4";
+      sha256 = "10ff106bb933374661e3398ea4ce02c205242d1f7a647504161e295b5e3d1e11";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/en-US/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/en-US/thunderbird-78.5.0.tar.bz2";
      locale = "en-US";
      arch = "linux-x86_64";
-      sha256 = "7fa3769297600c47c54902bac696e718053c48fc02e54698cb05ef81a4eec873";
+      sha256 = "297429aff3f10ab7c2859a37ec351b6b0a478495b8a34e8b492ae3473f052c7f";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/es-AR/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/es-AR/thunderbird-78.5.0.tar.bz2";
      locale = "es-AR";
      arch = "linux-x86_64";
-      sha256 = "51be3a453bb3e3f1353b88ab31fffa3fc0c135cb91facb7807c967a9d4afa659";
+      sha256 = "c8bafb3476d127d28f565ea5dd749b0c870087f395e0aabfb848a004846498e9";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/es-ES/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/es-ES/thunderbird-78.5.0.tar.bz2";
      locale = "es-ES";
      arch = "linux-x86_64";
-      sha256 = "8828e5ff82e84c5f69afd60ae5dbba445d766e2a2d7fbbcd8f0dc8f255d8fc02";
+      sha256 = "d8c5350627e7e6f48fbfa863bed1971254104ee299d81d1f36b99d6c6ee54313";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/et/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/et/thunderbird-78.5.0.tar.bz2";
      locale = "et";
      arch = "linux-x86_64";
-      sha256 = "d58404701341bcd9b859f1afb87cb3340fc4b8334cc9490e8ea21446e3f308eb";
+      sha256 = "f2a1001b0bb87965e40cd832102d2233b732273930d36715ff2db900b37c9ed2";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/eu/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/eu/thunderbird-78.5.0.tar.bz2";
      locale = "eu";
      arch = "linux-x86_64";
-      sha256 = "5570472164329f23d3f0be51911402c2b454ea704419ef16b46b359a2c93e821";
+      sha256 = "30c6da377a8fc4596f6a67b189c1c9f7a9075df96ed3a59b4da7e0e77157d950";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/fa/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/fa/thunderbird-78.5.0.tar.bz2";
      locale = "fa";
      arch = "linux-x86_64";
-      sha256 = "cc56e14f1fa17e8b4ec9431ae9ada10159bd90bcade39432c647ba401791e3fe";
+      sha256 = "8f98dd01764a5d244c25c3c409b8dbcaa1d3daf7b3a970c60d3d37fd5ffc4294";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/fi/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/fi/thunderbird-78.5.0.tar.bz2";
      locale = "fi";
      arch = "linux-x86_64";
-      sha256 = "5175e312e8957490b013dd515b84fe4dfcdf57d30c6806f8bdee67caf39659f7";
+      sha256 = "be5f152b28ee21d916b184999023a1a5adddd1d2c7448e7eb37bd08948f6a14c";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/fr/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/fr/thunderbird-78.5.0.tar.bz2";
      locale = "fr";
      arch = "linux-x86_64";
-      sha256 = "5239f8a07f0f6bc4f69b3d4315570dab33c331ab775479a9df39479b71542cc7";
+      sha256 = "c1b2d725c43196dfe3f9bfd291dfae84ba392151222589d80e3921e627667d59";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/fy-NL/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/fy-NL/thunderbird-78.5.0.tar.bz2";
      locale = "fy-NL";
      arch = "linux-x86_64";
-      sha256 = "5747be2c7f9d5463f9c14fd02fd5e66a8f6c4c8adca3a1bf8c3b4333f1ea2adf";
+      sha256 = "622c42950cc7d3889372b6e0c5833dc5c5f608ab23ca9962e0af67ce4b2f8ff5";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/ga-IE/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/ga-IE/thunderbird-78.5.0.tar.bz2";
      locale = "ga-IE";
      arch = "linux-x86_64";
-      sha256 = "8e15ffc9235742ad88a1ecaf587a178f5aeb0bc57e075b33f792e2d458362ab9";
+      sha256 = "7293859380e07d362192cd9dcf88b8da04cde6e102f0b8d51a00021bf8fd9e98";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/gd/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/gd/thunderbird-78.5.0.tar.bz2";
      locale = "gd";
      arch = "linux-x86_64";
-      sha256 = "72f53918cd04e587319d59100da05657a3084f97d70acba7d1ef7b7321add6ff";
+      sha256 = "f54b892150bd49d028337a88d3a0b2df896a47a6904067b381d385281d2c681e";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/gl/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/gl/thunderbird-78.5.0.tar.bz2";
      locale = "gl";
      arch = "linux-x86_64";
-      sha256 = "28beb85fe0ea27a659e5063f7094877e906729602ef2e155f0e55e9e9f6d56ad";
+      sha256 = "58c88bf739fde7e0f7e279106622abde617a0aa267f34f1c10f8d886800dc50b";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/he/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/he/thunderbird-78.5.0.tar.bz2";
      locale = "he";
      arch = "linux-x86_64";
-      sha256 = "718f8605fc8d418c645a0485ce86d97ae1eeded8b776a990e137ced78eb91a68";
+      sha256 = "8278c7580356c360c74ad161a6ee052e9398e39a2a5b75217ac0239db28ee4cf";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/hr/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/hr/thunderbird-78.5.0.tar.bz2";
      locale = "hr";
      arch = "linux-x86_64";
-      sha256 = "febadac023152dc30e72026f6df203c8051b65ad4da0c4e7059a14ab0b4b5f37";
+      sha256 = "b20bef1b7fab8d63c5cc6336dd59264e7c62a9a4c6f2db4232ed27624b26a3cb";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/hsb/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/hsb/thunderbird-78.5.0.tar.bz2";
      locale = "hsb";
      arch = "linux-x86_64";
-      sha256 = "faaaf4606fde4baca3216ed5801209f13cd1bbf34c9671cfc7a7648bb0ac7351";
+      sha256 = "ad4797a36c713b5026a4da131fc46f341cb8b72e5ad2f07a677bfedca8401163";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/hu/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/hu/thunderbird-78.5.0.tar.bz2";
      locale = "hu";
      arch = "linux-x86_64";
-      sha256 = "353633956336852193510c8e77251834355c92ec503ab827a389a0dbc21c05bc";
+      sha256 = "1f3dea138c4f82f91b9aaf891b9959d1cdda273f20af811d967ed55058f69064";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/hy-AM/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/hy-AM/thunderbird-78.5.0.tar.bz2";
      locale = "hy-AM";
      arch = "linux-x86_64";
-      sha256 = "1b5dba6f05ecc8449522d8a54c1d4e7aa5ec7a2e26fafbaefbd754ee3ea5780f";
+      sha256 = "836668531a555d9bd23fbb3c3b27cc647a327d02e6db1903248fc6b3d59c5dc1";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/id/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/id/thunderbird-78.5.0.tar.bz2";
      locale = "id";
      arch = "linux-x86_64";
-      sha256 = "470151868d745ce829f0f38c6377f4ead87be829d43f4383d2e5c3541b93e8d2";
+      sha256 = "1d74cd88cddf7b22ef8b19ee6cfedaaade15cecf68712ec8568888d0708c9c81";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/is/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/is/thunderbird-78.5.0.tar.bz2";
      locale = "is";
      arch = "linux-x86_64";
-      sha256 = "e9d6b36beb61445c3f96ffe6e11b238a8539b398d5f3911f2ded7ee96ec0766c";
+      sha256 = "a6e3320211b207e9a36c6197dbf97e746d2e9e9b7bda444a8511550b5846d329";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/it/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/it/thunderbird-78.5.0.tar.bz2";
      locale = "it";
      arch = "linux-x86_64";
-      sha256 = "95a02afcebb834b14986b8ccd92d5381a8ac64d3ebbba13860ffbd0313a594e1";
+      sha256 = "f0e659e6888590394a652033f3d15b29ff9318b4c88faae51d6347f1441201b3";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/ja/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/ja/thunderbird-78.5.0.tar.bz2";
      locale = "ja";
      arch = "linux-x86_64";
-      sha256 = "d1c4e2a551a5266839da96b843372e71616346ea00361dccc8e1a62628e6315f";
+      sha256 = "a2ffc461e6d942222bef4229a820bf8536ef41dce83efc458d82476d5f98f5a4";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/ka/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/ka/thunderbird-78.5.0.tar.bz2";
      locale = "ka";
      arch = "linux-x86_64";
-      sha256 = "9eb37a69a370b2619724c91c6789471b9ef579190c08363f633f320563dc4df1";
+      sha256 = "6a374b791fac25bfc3f10726d93497291163dd95b1372dc09db70c098822f4f9";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/kab/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/kab/thunderbird-78.5.0.tar.bz2";
      locale = "kab";
      arch = "linux-x86_64";
-      sha256 = "bce07886dc5251ef401141d387c926f27f61d13450f35cb9a9cbc8403b43260a";
+      sha256 = "a23dc5cfef7bcbe32c32363d0048813a24cfbb19f17c3041b23fc751936dcadc";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/kk/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/kk/thunderbird-78.5.0.tar.bz2";
      locale = "kk";
      arch = "linux-x86_64";
-      sha256 = "222647dd8106134d46bbad6dad8638090e5441a64aa2a6725aa5b1d959a2832a";
+      sha256 = "2187f7d763d34787de0d9870f746548459bd0a2ef0676286d2f9ce9bc9092ef1";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/ko/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/ko/thunderbird-78.5.0.tar.bz2";
      locale = "ko";
      arch = "linux-x86_64";
-      sha256 = "be2346d5a48e5323d5cc8c1077adf054927d8aececd2fb45fc2f5c0a9f0b8dc2";
+      sha256 = "ff88da9f6c77e8f5c1bebab542abc51266ba03d97fc5d22b86cf52a26db75e63";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/lt/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/lt/thunderbird-78.5.0.tar.bz2";
      locale = "lt";
      arch = "linux-x86_64";
-      sha256 = "da5cde252d5e167025fb06861a32b67a2d0f7171c767bdd8c5d2ba9fc90d7739";
+      sha256 = "77531cad8587aba9c4091bd22c79e40e45d3c57083b5af3e54af3576ed45134b";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/ms/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/ms/thunderbird-78.5.0.tar.bz2";
      locale = "ms";
      arch = "linux-x86_64";
-      sha256 = "d6ab0652184cbbfe9126a49f61c25fe8852725b88460ad92c37dc1c4d969368f";
+      sha256 = "aaa346d9bcc1cbd84beedb75c9949d4a2cd8bf80496a31e2018c2493fed68339";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/nb-NO/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/nb-NO/thunderbird-78.5.0.tar.bz2";
      locale = "nb-NO";
      arch = "linux-x86_64";
-      sha256 = "2485cc4df1b1dafd0c5fb7d7723e923e7fea10af1dbf9764d5d7447f38825e49";
+      sha256 = "dac3f1eeef73c247f9c79a09b7ffab1498be6c96865b5f21ee28d398941430a1";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/nl/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/nl/thunderbird-78.5.0.tar.bz2";
      locale = "nl";
      arch = "linux-x86_64";
-      sha256 = "0795d2ae4364def43056e77106ea19053c3111e2f95758dbb41875071655ba47";
+      sha256 = "e0b3df7064e08e34f85b9a83d2bef990f66ad0e1bc86f764139fc57d005d1aa3";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/nn-NO/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/nn-NO/thunderbird-78.5.0.tar.bz2";
      locale = "nn-NO";
      arch = "linux-x86_64";
-      sha256 = "b774035d8bff615646d3b3d73228277531d50309fb5dbf3978346e2b988b2491";
+      sha256 = "eb420586e8be191ffc41f4a920506336cc9dccbf229c260a7f193cbe169a6da4";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/pa-IN/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/pa-IN/thunderbird-78.5.0.tar.bz2";
      locale = "pa-IN";
      arch = "linux-x86_64";
-      sha256 = "2a38813c8aa0eaef3d2ec0ac379ab5c85d0b8c2df1f6a2d36ae066f7b0445447";
+      sha256 = "12f7c97b130ce40dd1dcd00a16a20000113b7be33c87ab9002848439ce626abd";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/pl/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/pl/thunderbird-78.5.0.tar.bz2";
      locale = "pl";
      arch = "linux-x86_64";
-      sha256 = "21cdb977bff1f0c07bf913b4feab2075a429b4594760de52ac358538179d9c66";
+      sha256 = "5ad96dee4b422c820da8a76ab64e62e919c21d99b01b92f346a55acada7cf8ac";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/pt-BR/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/pt-BR/thunderbird-78.5.0.tar.bz2";
      locale = "pt-BR";
      arch = "linux-x86_64";
-      sha256 = "d903ccd23367c39779ac2cdd3abe636a0f9e72f8d133a567bead8a739e651589";
+      sha256 = "7d6568c067796f21079a4f6bf3374a1b91807a9b30270587cf815892d86e1590";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/pt-PT/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/pt-PT/thunderbird-78.5.0.tar.bz2";
      locale = "pt-PT";
      arch = "linux-x86_64";
-      sha256 = "f220a8bc90b05dd796c402aa5e79c62a8aa91a4d80dacbdf57abf77ec51d73b0";
+      sha256 = "22058d65e2ba94f39ca6ada6750beacf2bacac0f296a34542fde01e897e4a4e2";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/rm/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/rm/thunderbird-78.5.0.tar.bz2";
      locale = "rm";
      arch = "linux-x86_64";
-      sha256 = "805d08f629e9dda7d6db36bd41dbcc128defe59b4610e4b7d5d47408a07e47b8";
+      sha256 = "c61ff10e4260eb2650fc1a4e0ca8df6c4e4e2e9525168ceaef86a9b8b2ddba54";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/ro/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/ro/thunderbird-78.5.0.tar.bz2";
      locale = "ro";
      arch = "linux-x86_64";
-      sha256 = "3b09b2c59f32a09938a45270e04740616b2a13f8b8a6f40503650d9b0f72fc35";
+      sha256 = "2ec34bfd9fe4a0f0cf17f132146ab2a589c986a8b4317124f3bfc34ac48f732a";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/ru/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/ru/thunderbird-78.5.0.tar.bz2";
      locale = "ru";
      arch = "linux-x86_64";
-      sha256 = "2022473752da127d2ebe4eef7f834ac5feafe38dedbe64ad30defb8ae69c6ebd";
+      sha256 = "b835dd1757f5cdc580a2b91f01a8089c1396d9eacee665fe9976019f8523fdec";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/si/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/si/thunderbird-78.5.0.tar.bz2";
      locale = "si";
      arch = "linux-x86_64";
-      sha256 = "dc5166b0b24bd0a9e98f7dfc483a6bff184a4bfffb0eff8a4007b96fe8205254";
+      sha256 = "3722e47d39024c13dd799e0c89cf79a1302817605f7025388cd5f62fea15d168";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/sk/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/sk/thunderbird-78.5.0.tar.bz2";
      locale = "sk";
      arch = "linux-x86_64";
-      sha256 = "d30e4d3218fbf13a5c531d45f55f0f366aac10aa2d180886ced778c7459c0610";
+      sha256 = "4717620562c338f533053677d8956490d2d42abfd52beb6a0d41466ba3e72a36";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/sl/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/sl/thunderbird-78.5.0.tar.bz2";
      locale = "sl";
      arch = "linux-x86_64";
-      sha256 = "f968618f7b13b6dc4441a09882ac5c826017a5b0ca3887b7cdca8ef6a3b3c266";
+      sha256 = "d712c5b3dddfa181877353d28667d410bea3a1f3d85e92dc058a3f3ac5ff4824";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/sq/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/sq/thunderbird-78.5.0.tar.bz2";
      locale = "sq";
      arch = "linux-x86_64";
-      sha256 = "f4400c6e55859e07705b353cbf211e863e8c3f373490f3fff6bd3e6d360d5b7f";
+      sha256 = "8443ae1161c6b3e807c9d4abc01824e894a11b6f6c9a52d3097b8301461ac0c3";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/sr/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/sr/thunderbird-78.5.0.tar.bz2";
      locale = "sr";
      arch = "linux-x86_64";
-      sha256 = "f6437ffb64b1a98b5c5630f3b386b12866a514467c641fb02c8e86560e4b62d9";
+      sha256 = "13f093880d41748efa8f1566e5884d632f2fa80d4eb4f1a8dd1dc20ea626cee8";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/sv-SE/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/sv-SE/thunderbird-78.5.0.tar.bz2";
      locale = "sv-SE";
      arch = "linux-x86_64";
-      sha256 = "f1af8019698347ac94bad5c33b5e094b65e8ebed9181f5fed5e740cf2029bcef";
+      sha256 = "ee9d7262a8b6cd8460b2f1c4c0102b68f9a0983e1f021f2283ead172f07e3f37";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/th/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/th/thunderbird-78.5.0.tar.bz2";
      locale = "th";
      arch = "linux-x86_64";
-      sha256 = "75830b637302032bbc70342b71012f391b333a2645d8fefb8f4232d432c9dde1";
+      sha256 = "09cd7b862cb8caa511b6d550bb668f0fd51fdfee5b2f6a31814282785688e4de";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/tr/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/tr/thunderbird-78.5.0.tar.bz2";
      locale = "tr";
      arch = "linux-x86_64";
-      sha256 = "3691e5aca6b9713fab9c8a15952d1ceae50d67cc60e362eacc9513a362875dfd";
+      sha256 = "0d9f63aa7b63d571d7414755bd4e8bc27b7c5fd093ee46ed0fc2db469940dcd5";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/uk/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/uk/thunderbird-78.5.0.tar.bz2";
      locale = "uk";
      arch = "linux-x86_64";
-      sha256 = "c4aca974c3a541c312029eb66fb8fdb1c5ecd787deb67a10bda3195f0ca06263";
+      sha256 = "0aa64449381edeed7c37d18e03f74dac2f5038a6c3c5de9fa6ad037b139bb5bb";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/uz/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/uz/thunderbird-78.5.0.tar.bz2";
      locale = "uz";
      arch = "linux-x86_64";
-      sha256 = "2052c0a9a41c81a37aa23fbf28775e286b8350594b01aff629604ccbd74ae90d";
+      sha256 = "eabd24b838a072cb1aa9bebf3c573b3a6e7a364b759aebd62d12b16911956a00";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/vi/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/vi/thunderbird-78.5.0.tar.bz2";
      locale = "vi";
      arch = "linux-x86_64";
-      sha256 = "b142f463cd953bfc423be210eb891f66e948308129de74cdfd415409d4b0cb03";
+      sha256 = "ce9b5afcb60fc0f17a384a9096b26626f3d3f570222910a46872688009aee262";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/zh-CN/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/zh-CN/thunderbird-78.5.0.tar.bz2";
      locale = "zh-CN";
      arch = "linux-x86_64";
-      sha256 = "0664f379ce4e464e2e6dcc3cfa749bd6ae4a597b008b7fd1c97bb6219727da6d";
+      sha256 = "9d69c7ef37282a7741d2392456c9ef5f5700fa1b718889e93bf7010fa99617db";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-x86_64/zh-TW/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-x86_64/zh-TW/thunderbird-78.5.0.tar.bz2";
      locale = "zh-TW";
      arch = "linux-x86_64";
-      sha256 = "2ba4d49b52e6cd699f7bb1fa8f024c330f67d6b9df543a77fea7c3dc87985cc4";
+      sha256 = "6001d4e74212b72b2a3583438925d2431bb28994a661b4b47e77268e7790e526";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/af/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/af/thunderbird-78.5.0.tar.bz2";
      locale = "af";
      arch = "linux-i686";
-      sha256 = "60f62dc28a8433e571b894d33c0d9670c3aebc6a8c556c65f12d8d574e5edceb";
+      sha256 = "e30adc9074f08e04a4477f59eff6af83bcdf22ccafa1aef5ace219a830c50f38";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/ar/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/ar/thunderbird-78.5.0.tar.bz2";
      locale = "ar";
      arch = "linux-i686";
-      sha256 = "cf0fc7d7af09b20dbb35364ac0e47615919ae1627a0b729acf2f13dd99198400";
+      sha256 = "6d9456fd3f76de33a3f7c46d8197d83c36c832922b83de64cf4c2f5a56f7729d";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/ast/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/ast/thunderbird-78.5.0.tar.bz2";
      locale = "ast";
      arch = "linux-i686";
-      sha256 = "cb7ed53eedb55858fa5a5aadab1ed0ae4f2f9e2714406488b211660e56785d21";
+      sha256 = "1427f7741ba5c5da163ecfce3053bdab7b14c8fc2e8c046c244f7eea6d015a2e";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/be/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/be/thunderbird-78.5.0.tar.bz2";
      locale = "be";
      arch = "linux-i686";
-      sha256 = "b04239a6caf488d3fcb5be0373ddf83554643897d41bd197edb6dbaee15b9a4d";
+      sha256 = "97258efe6425869e4710c07e880df2a3f6c14d626e6512374043cff226f141fb";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/bg/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/bg/thunderbird-78.5.0.tar.bz2";
      locale = "bg";
      arch = "linux-i686";
-      sha256 = "fabd2c79cee02328166954d6b793b70bb94cb41162b904ecb124cdf91e5cff0d";
+      sha256 = "a30496a969a954525dbcf1ec0e94d8533baea3809e61d6c1c6e299f883d9676d";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/br/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/br/thunderbird-78.5.0.tar.bz2";
      locale = "br";
      arch = "linux-i686";
-      sha256 = "66584e5c63c58c10cb4f2f8fb81048c4201046adbad03d58faf8f36e405a8e40";
+      sha256 = "16dfc1b869bb10ce7c56f1b22981586678cd81a42e13c4075ebc1da76728258d";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/ca/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/ca/thunderbird-78.5.0.tar.bz2";
      locale = "ca";
      arch = "linux-i686";
-      sha256 = "eca54850e9ed41a19bb4cd23de9c11d9d2851ac1573507b32b4fd33431ad7889";
+      sha256 = "bd29d4b8376355090adca0185194d3c9b6124c336bec0dababaa4a214f9945fb";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/cak/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/cak/thunderbird-78.5.0.tar.bz2";
      locale = "cak";
      arch = "linux-i686";
-      sha256 = "ff8e285bf3198c225c2b5b216678bde7f978443c1f354193e39c0c5d3d7237bd";
+      sha256 = "b9723a8f8b8a61d01f09b18f1dff6529d22c89653586ad032831c87683da12b8";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/cs/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/cs/thunderbird-78.5.0.tar.bz2";
      locale = "cs";
      arch = "linux-i686";
-      sha256 = "72a18f3ac0168478c7b9c8d2641922ba7be5d129b63b711b7f7f133ba3cb1d75";
+      sha256 = "55ff98744b2f120a855c8a3bc435d39209504b7eda92560be40b8cb3fbe007f0";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/cy/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/cy/thunderbird-78.5.0.tar.bz2";
      locale = "cy";
      arch = "linux-i686";
-      sha256 = "16fecfef3f81870befcadf833db5ecf54b7b83d587f2a211c5eaceeaf7a5796f";
+      sha256 = "818a93f5a4f02e8cf7b3373c31c435dffca3fc1f86d5acc3fd4355bca21f9cf0";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/da/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/da/thunderbird-78.5.0.tar.bz2";
      locale = "da";
      arch = "linux-i686";
-      sha256 = "7aac88184c6e2539003905b3a7609116cb2180943a8df219449354297b323455";
+      sha256 = "7df66098805f276e1498fa28c00aa7eaa8a8993b561261c54f7091a808ff6766";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/de/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/de/thunderbird-78.5.0.tar.bz2";
      locale = "de";
      arch = "linux-i686";
-      sha256 = "f3f487f8852b7f50ed49b5375ae97376470282a0f5639c8fc4cb7040da30f946";
+      sha256 = "194831e85294b41a4c1bcec8a2f20f337786054525d50e2fd6dfd6134385d2d8";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/dsb/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/dsb/thunderbird-78.5.0.tar.bz2";
      locale = "dsb";
      arch = "linux-i686";
-      sha256 = "842a084fc74c29d3c7573e473666cfa01f205b75fe6c1ee83acc25cca68d3666";
+      sha256 = "e7344c6b2c90bca56adfca1619e1bfdc0e473f7230d4c1059d6516cee8d51759";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/el/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/el/thunderbird-78.5.0.tar.bz2";
      locale = "el";
      arch = "linux-i686";
-      sha256 = "8df4c2a688b435f60fe0d5646ac5172dad33d254fdd68e35a29a6a83c4bda905";
+      sha256 = "e2d4680ced58f78699f7bdc2c3493d6157cf2c9261aa697cd6092ed0687a7bbe";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/en-CA/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/en-CA/thunderbird-78.5.0.tar.bz2";
      locale = "en-CA";
      arch = "linux-i686";
-      sha256 = "8eab7a0b08e3c65eb5c373eb018d5e1df519b28f8774b06203a5b7743b146cd5";
+      sha256 = "6afd7bb703c62763b787d77b7467881f07d12e73d32d07c6461642307e3b9f5f";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/en-GB/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/en-GB/thunderbird-78.5.0.tar.bz2";
      locale = "en-GB";
      arch = "linux-i686";
-      sha256 = "23c819e15ca0ff1ad366f2d5fb76e934dcea0fae9cec6674b39339e14a3c4254";
+      sha256 = "78114f1a1dff6c5430b148fbb8707e03cd3ec1d05af48082755190ae45e94dd4";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/en-US/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/en-US/thunderbird-78.5.0.tar.bz2";
      locale = "en-US";
      arch = "linux-i686";
-      sha256 = "5cdf4b40f337352a8e966046a2eb1a368c0feef4fb069fd4c22d4f986ea1ed3f";
+      sha256 = "beb328b15c7b981b10f26cad6325a04257be20e25e819fa771f88fe5e5c98aec";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/es-AR/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/es-AR/thunderbird-78.5.0.tar.bz2";
      locale = "es-AR";
      arch = "linux-i686";
-      sha256 = "e7947542ef45cb432991ac5435523987c79811889e9bd5cb6fe4c698897a241e";
+      sha256 = "3c096d5225f8fe273b6f0adc119ea419cf60e7a7723fb3a63a6dec1be6e4c3ef";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/es-ES/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/es-ES/thunderbird-78.5.0.tar.bz2";
      locale = "es-ES";
      arch = "linux-i686";
-      sha256 = "95121f74bc1389e62dfe7acb286d2a4cd60a536f28054c8e367cdfd867babde1";
+      sha256 = "68796cda86944bfb70207b79c162c0b2fdb66b17511300c799204fce58d2c2b2";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/et/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/et/thunderbird-78.5.0.tar.bz2";
      locale = "et";
      arch = "linux-i686";
-      sha256 = "87aedd276bc54360887e81bf2e3b07c54a365b78814d7e478f7ad5ec15c1d451";
+      sha256 = "6187058a289cb43e89916e484ac46c2359fc9c452d07dd4dab2e3ff8ae397c47";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/eu/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/eu/thunderbird-78.5.0.tar.bz2";
      locale = "eu";
      arch = "linux-i686";
-      sha256 = "66168f09ed77b7f31faaf21daff48e9a8bf75314fcab585fad67160db52471b9";
+      sha256 = "ad587a3b25de553b69ab9aa61b9d99c4f4d7dd37b05672540eda7907b21f2857";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/fa/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/fa/thunderbird-78.5.0.tar.bz2";
      locale = "fa";
      arch = "linux-i686";
-      sha256 = "2848f0277f75dc58f371e2025bebdeca1c37d543055fa78258df67d05c67f5bc";
+      sha256 = "8c06bbd83b5485b113bf4d0ca69af9ca21c7854ff38b19831eadae0c586dc606";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/fi/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/fi/thunderbird-78.5.0.tar.bz2";
      locale = "fi";
      arch = "linux-i686";
-      sha256 = "725f0dcd456245e188e32a32401ecd40400b7786da3a39d9f6965c1f674ee954";
+      sha256 = "bac6ecf3d22f6097f8cccb7da81866941426ee7bbb690937a2333b411a305fbd";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/fr/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/fr/thunderbird-78.5.0.tar.bz2";
      locale = "fr";
      arch = "linux-i686";
-      sha256 = "d24ab35a8db7cb32d6098defb9f7b6b007b5c993a070c1a3a5c8991451165e37";
+      sha256 = "859457a9c0bae23e4acf901d38de814858c60fe1a5e28ee897b2c2f4c86bc29a";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/fy-NL/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/fy-NL/thunderbird-78.5.0.tar.bz2";
      locale = "fy-NL";
      arch = "linux-i686";
-      sha256 = "ea3a88b57166b3b8f04922a5c2f6d8d9f94f1a7bb5f3a9e2d6b5f11a13528c18";
+      sha256 = "d5a91d212e0c9c6c533bd7f05edca3dbea93eba0bf0d34eabd1e9ba7c7138e8b";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/ga-IE/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/ga-IE/thunderbird-78.5.0.tar.bz2";
      locale = "ga-IE";
      arch = "linux-i686";
-      sha256 = "763bc901967ec61e1f7f543bbf248bb03ea68b01c000677505408ec8e8c3cbb4";
+      sha256 = "980e053f0bcd5096753213fd6cc252be388312980032132bf912af2d4249278a";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/gd/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/gd/thunderbird-78.5.0.tar.bz2";
      locale = "gd";
      arch = "linux-i686";
-      sha256 = "7394f43ae2ff5816dcf9b37255fd9770dc48dd7309d685ab378bc2de8a5a39b1";
+      sha256 = "7b61b433d2f55191f7ecc63e04ceabcebcc85ab211553b71de575bbf14db05ee";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/gl/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/gl/thunderbird-78.5.0.tar.bz2";
      locale = "gl";
      arch = "linux-i686";
-      sha256 = "7daaacf6af75b34d37d440e2c0b252ef03c3b432523f5acb8ef71f83b5d7b6cb";
+      sha256 = "2dbb2021eacf17f5d42d0f8edc32a3f4d0ae3964cc8b44b0875fcee9bbd8ebbe";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/he/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/he/thunderbird-78.5.0.tar.bz2";
      locale = "he";
      arch = "linux-i686";
-      sha256 = "4831ef263de0a08df6494b13a280475642c3eed7f34c7415fd7b59af192398dc";
+      sha256 = "b64fdf97d7f3029ffe465bbe621735970c73682cbde03935c2ad94325a7a77cf";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/hr/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/hr/thunderbird-78.5.0.tar.bz2";
      locale = "hr";
      arch = "linux-i686";
-      sha256 = "6860b40fc2ba7f9b8ddedcaf50acca8ac01b6451c0895c325b36485f188b5dda";
+      sha256 = "05606268efa91e8266a75f9f53dae8e8095fd70bc1095e2cc160171eb32e9a0a";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/hsb/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/hsb/thunderbird-78.5.0.tar.bz2";
      locale = "hsb";
      arch = "linux-i686";
-      sha256 = "681fc8200f6f9346e911c21d6a1c8206e5ee5ad1adfaa56ddfbc5088225fc561";
+      sha256 = "8a2dd27b17cbfad0846a40b4863c72e0754137e4ae581998ff291b4428a069ef";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/hu/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/hu/thunderbird-78.5.0.tar.bz2";
      locale = "hu";
      arch = "linux-i686";
-      sha256 = "8909d02e58f5b333fa51b15e4ddb5df162d01e36a8052827482c479949da2cb4";
+      sha256 = "01daa9ab4f5d096a9a5e138db4debeee302fb875f885e644eea88103c5c62111";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/hy-AM/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/hy-AM/thunderbird-78.5.0.tar.bz2";
      locale = "hy-AM";
      arch = "linux-i686";
-      sha256 = "12dee2dbe126d2243b674bed4617ffcec7c93f850d266f6253d802c6af5b6d6d";
+      sha256 = "69159084189c5700e5c8c27bf4cc0345fcafe0879b7f7cca285246a41e411578";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/id/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/id/thunderbird-78.5.0.tar.bz2";
      locale = "id";
      arch = "linux-i686";
-      sha256 = "5564c24b01f9a952def885a4fb56e3246643ca30bc5066d6ffa4ed6c6982b33b";
+      sha256 = "798203a12f76cb3c698363da72b235fc9abfc5a68913f3265c9b17b14318eb73";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/is/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/is/thunderbird-78.5.0.tar.bz2";
      locale = "is";
      arch = "linux-i686";
-      sha256 = "fedea70297479b2c828aa19a9a4aa3090597c5490ee842a0f521d0096615d6db";
+      sha256 = "19544548a0b0217f5f5256949d74897c784298dfe762174487ab2ba2557a55e7";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/it/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/it/thunderbird-78.5.0.tar.bz2";
      locale = "it";
      arch = "linux-i686";
-      sha256 = "8466f3dc9988270d4a9166b82dba764d8dbfa14e8c26a1931d35abe011c3160a";
+      sha256 = "b1ae17f3d4533db0107ab280ec4e8ecc610db9581d44ed52d8ca87c821c37c1b";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/ja/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/ja/thunderbird-78.5.0.tar.bz2";
      locale = "ja";
      arch = "linux-i686";
-      sha256 = "3ffe4ae508896ac961a27940a93f5955bb8b29640c88e5378a8251827b4e9ab8";
+      sha256 = "c16c27372c28063a06e31fc440294a655fb72bc033efbfd797d150e99e6ebaed";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/ka/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/ka/thunderbird-78.5.0.tar.bz2";
      locale = "ka";
      arch = "linux-i686";
-      sha256 = "7c099596fbc4666e053bd1079f6b7c45511b2b44db73cd5c099fd392bec8e3e3";
+      sha256 = "3057efd5078776f1690890d601153a73e2450051a0edb61e92d196318b644679";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/kab/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/kab/thunderbird-78.5.0.tar.bz2";
      locale = "kab";
      arch = "linux-i686";
-      sha256 = "5e64e5a276a6e77250ad7647f9b4ecc2b8c9dc360c486f9504b3b17b8da3e467";
+      sha256 = "ce8010b362b601819fac825ce27b9efd8af8f0965f8f1cabb21bfcddb2ec7315";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/kk/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/kk/thunderbird-78.5.0.tar.bz2";
      locale = "kk";
      arch = "linux-i686";
-      sha256 = "4562bced5900bc447a79c53d381b250a1e13b9f076979cb9760f9adaa89c54b3";
+      sha256 = "b73930d1508bdcaecfb9ce280f0d86fd5dc7a3d26160caa0eabbe47243956139";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/ko/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/ko/thunderbird-78.5.0.tar.bz2";
      locale = "ko";
      arch = "linux-i686";
-      sha256 = "b6cb53893d67bedb077547f1262a833a5487e49395187a49eb977659d019e7f8";
+      sha256 = "24d6e557b6419bb3a512646edb6e1e4d01ce1c0e134b9bb9cc54ad5acb6a0675";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/lt/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/lt/thunderbird-78.5.0.tar.bz2";
      locale = "lt";
      arch = "linux-i686";
-      sha256 = "6291d36e9347729920f89a28b949c943d8c92863cba1a03624801c7136eff997";
+      sha256 = "c9dc7dc77a1c1acdc1e244e6b1201ecd3305b5c10ef946ceb880fb66d57c249a";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/ms/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/ms/thunderbird-78.5.0.tar.bz2";
      locale = "ms";
      arch = "linux-i686";
-      sha256 = "5dee2e40dbceea93fbe3b35b744d00472b89b88e745025127a1d07afc79d7df8";
+      sha256 = "d3a0b9fc5b38de919515df9dc6ca696c7c70f629b192e8cae099a55432d466d3";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/nb-NO/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/nb-NO/thunderbird-78.5.0.tar.bz2";
      locale = "nb-NO";
      arch = "linux-i686";
-      sha256 = "491115e7ad1c4245da34dc328e179de3916291d4e42a85ee5fd4fadeae1fcdcd";
+      sha256 = "80f552a61288f1d1a6346d302919fd90f63c2d349a2d33921eac9a65c341a7d9";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/nl/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/nl/thunderbird-78.5.0.tar.bz2";
      locale = "nl";
      arch = "linux-i686";
-      sha256 = "c4631681eb3354a3093acd5a76d5c7ca5ef3e76ac2cef9f1fa4007c40c1e282d";
+      sha256 = "89007857be04b59bf724a2f6c295c0948a885c8da8c7a7060922e04f616baf30";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/nn-NO/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/nn-NO/thunderbird-78.5.0.tar.bz2";
      locale = "nn-NO";
      arch = "linux-i686";
-      sha256 = "aa4d383b90b7cd48ff18f098c9bba429f09fcfb72a2f2a086a992778718a3b1d";
+      sha256 = "b7a8060d3138a55a29374d890b326e77105f41e809053d34c24464a892c6bdbc";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/pa-IN/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/pa-IN/thunderbird-78.5.0.tar.bz2";
      locale = "pa-IN";
      arch = "linux-i686";
-      sha256 = "c5fb66455a59383494890e06559d4529c0762ecf76d17e5ad784eb413277438d";
+      sha256 = "69f803555cc9b3ba7fbf638e101b76bef10a234747cd0764e906e5d2adbb9a97";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/pl/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/pl/thunderbird-78.5.0.tar.bz2";
      locale = "pl";
      arch = "linux-i686";
-      sha256 = "720eea0998d9934960a5dc97466f57c7e68b2048f88125a987569539a8a00579";
+      sha256 = "4cd4da857d9cbdc5d89e07529d30df28a758c3c105160d2217b50206147c21e5";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/pt-BR/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/pt-BR/thunderbird-78.5.0.tar.bz2";
      locale = "pt-BR";
      arch = "linux-i686";
-      sha256 = "d27ab836f5d8753d740e980291a4403656735c206cedbaf7d5c13df26d327150";
+      sha256 = "43fca4ac927932589b58e60f7b3b1cdcdc1d73b6f9073e0c1eb2993527afe9be";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/pt-PT/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/pt-PT/thunderbird-78.5.0.tar.bz2";
      locale = "pt-PT";
      arch = "linux-i686";
-      sha256 = "2b996d07174c24df1b066c41bd92c8b24ebab82767c47d8c658f2205eeff9cb4";
+      sha256 = "25591b73b7ae5d28441baeeae3fb3a5a47f36ea21db763b95782494fd8491122";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/rm/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/rm/thunderbird-78.5.0.tar.bz2";
      locale = "rm";
      arch = "linux-i686";
-      sha256 = "206b2bf82b88ab733bf585e11a3eba49a779c8b8fb7bb249716022fc7ee1a18a";
+      sha256 = "14a0725f1083ab9c4baafe6944604cc5781cc9d3d44cbc406874b5ce01df785d";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/ro/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/ro/thunderbird-78.5.0.tar.bz2";
      locale = "ro";
      arch = "linux-i686";
-      sha256 = "2d06d671114d70ba4e39b2c639eab1debe7ad33de11795113f30f27708d13ae4";
+      sha256 = "f32af00602a13e262e6b34c8b5783b31a991dee72d82c841086d21e37d669dcd";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/ru/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/ru/thunderbird-78.5.0.tar.bz2";
      locale = "ru";
      arch = "linux-i686";
-      sha256 = "08e71802964c340dfbcddf963382d1ccc5b8fd2e262daa1316488cffd04f449f";
+      sha256 = "367e7865f1c5d10eb912fce96a34bf6ce25ca48e4ec9209bce8af06412be7781";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/si/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/si/thunderbird-78.5.0.tar.bz2";
      locale = "si";
      arch = "linux-i686";
-      sha256 = "0f59d187fa15bd08ffe0e08e643bb76954f7eb7730c3768079514385c53df5d3";
+      sha256 = "da0494be7a26f0a531d108ca20a0bc9763860e44adaa6149ea059f46daabbe0c";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/sk/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/sk/thunderbird-78.5.0.tar.bz2";
      locale = "sk";
      arch = "linux-i686";
-      sha256 = "5109939226907517fac9ae9c4e6ee96d732de9a67b9139e390d32cbdea892ef7";
+      sha256 = "1c5078f413207049a35c69be32c6996cad169cadc009b3f079b3adc8a932ca22";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/sl/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/sl/thunderbird-78.5.0.tar.bz2";
      locale = "sl";
      arch = "linux-i686";
-      sha256 = "c56fb54ad65dd453b487813b1f0dde8d83ed6a2f7e428af55c40a80d1c9a35ca";
+      sha256 = "d8a5edf78b5a87c0b3baf0199231e6e9224e1afdf4eff05780b6c9b98657c1ef";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/sq/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/sq/thunderbird-78.5.0.tar.bz2";
      locale = "sq";
      arch = "linux-i686";
-      sha256 = "0b3814c80014108032c9f0376a62c09864704441f36a084accba1c7c0f8156de";
+      sha256 = "fefcb88c0c5f6ee62ba8224417a629d8a4f0c18b20fcb037c36af772b0d2b71c";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/sr/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/sr/thunderbird-78.5.0.tar.bz2";
      locale = "sr";
      arch = "linux-i686";
-      sha256 = "80b01424fae7d18c98a77a0026dd4b50f1913f5f3cce2d3f85d9e56da633a537";
+      sha256 = "c42818c409de6447c1aa00f8aa6422a9fbb6fa16f01d5076331937c1145a4b87";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/sv-SE/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/sv-SE/thunderbird-78.5.0.tar.bz2";
      locale = "sv-SE";
      arch = "linux-i686";
-      sha256 = "ef0154595d85c13d0eac381a907a51da19e9d93d2758c7dc0f052b7b76a7f31f";
+      sha256 = "c27d87cde88f38f3611358b5fb3622611c38860ee37d1d90aaabcb4db614a031";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/th/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/th/thunderbird-78.5.0.tar.bz2";
      locale = "th";
      arch = "linux-i686";
-      sha256 = "939f56c4951e8dbfdff257efe7f0212e93c1bb55547ce1e934f7d908932d3116";
+      sha256 = "df9b827a723675e70131d147fa6f6325f6e6a14a6b95f6f5b6fae4552501c6b0";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/tr/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/tr/thunderbird-78.5.0.tar.bz2";
      locale = "tr";
      arch = "linux-i686";
-      sha256 = "66f4f2cb06f20fca47e59b37d52f07a9e1215b03f0bbf9320cd1436e1d1a7c35";
+      sha256 = "7a9d6e1b5927c7c54b73062a59d366cd5153896a89e95005177fdf4b789eda42";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/uk/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/uk/thunderbird-78.5.0.tar.bz2";
      locale = "uk";
      arch = "linux-i686";
-      sha256 = "33f3b9812b442184c075056cbe7da924655729865d849856093bdaa2d7d84660";
+      sha256 = "c421df09d5bbb5e4de273258757df28e5a6eba291a4eabbf28db71a50cb11da7";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/uz/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/uz/thunderbird-78.5.0.tar.bz2";
      locale = "uz";
      arch = "linux-i686";
-      sha256 = "5abbc17bb66700093eeef5eb97bcab0a5d040ffe20ecf79d8239123248b1affb";
+      sha256 = "296ca42b0c9f67ef0bb545f458334ec26e03be3327fd1e1b066d8324965704b2";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/vi/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/vi/thunderbird-78.5.0.tar.bz2";
      locale = "vi";
      arch = "linux-i686";
-      sha256 = "de5071c3b4a5cf7494f91c69f4a7cf4678bcf57227115e1b6e50cc65a3e716dd";
+      sha256 = "46579d9723f5ccc84700c2544f3d1235db338471306d87a1caa0ac4fb337c8bd";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/zh-CN/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/zh-CN/thunderbird-78.5.0.tar.bz2";
      locale = "zh-CN";
      arch = "linux-i686";
-      sha256 = "07afc2b794439475d0d4db82c7b694728aa5b8e6e80ac79789bae662757ae8d2";
+      sha256 = "9bf0df6568eadf611891f49591975166da95eb4e78e1191eb3354a81637907d2";
    }
-    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.4.3/linux-i686/zh-TW/thunderbird-78.4.3.tar.bz2";
+    { url = "http://archive.mozilla.org/pub/thunderbird/releases/78.5.0/linux-i686/zh-TW/thunderbird-78.5.0.tar.bz2";
      locale = "zh-TW";
      arch = "linux-i686";
-      sha256 = "70a71d0c26fd2cd18dd599374cc6f1c39d22246f3b3c8e8d17659cb7c33a5a77";
+      sha256 = "8fee4fd8980d551317fc8f98f29938034f5ff90b765e73ef8cd09f8fe68f90c8";
    }
    ];
 }
--- a/pkgs/applications/networking/mailreaders/thunderbird/default.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/default.nix
@ -70,13 +70,13 @@ assert waylandSupport -> gtk3Support == true;

 stdenv.mkDerivation rec {
  pname = "thunderbird";
-  version = "78.4.3";
+  version = "78.5.0";

  src = fetchurl {
    url =
      "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
    sha512 =
-      "0h5ddqp1z2dphyy4mjcb7v9mrrxlnjw8rwklm0yqsbvs9m96pc1yyp4clb3wmgs7kzh3wxdwi450842m3b13wdg5h0ls7rhamd1yi0c";
+      "0c32dz8p7rrr0w13l2ynf9snj59ij1v2ld3s75vz1hvks4dikwgcbm44wmvmbisvgyfgzdsphafzlq3kz3j1ja30qjigl0dj709vr6s";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/mpop/default.nix
+++ b/pkgs/applications/networking/mpop/default.nix
@ -4,11 +4,11 @@ with stdenv.lib;

 stdenv.mkDerivation rec {
  pname = "mpop";
-  version = "1.4.10";
+  version = "1.4.11";

  src = fetchurl {
    url = "https://marlam.de/${pname}/releases/${pname}-${version}.tar.xz";
-    sha256 = "1243hazpiwgvz2m3p48cdh0yw1019i6xjxgc7qyhmxcdy0inb6wy";
+    sha256 = "1gcxvhin5y0q47svqbf90r5aip0cgywm8sq6m84ygda7km8xylwv";
  };

  nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/applications/networking/mullvad-vpn/default.nix
+++ b/pkgs/applications/networking/mullvad-vpn/default.nix
@ -41,11 +41,11 @@ in

 stdenv.mkDerivation rec {
  pname = "mullvad-vpn";
-  version = "2020.6";
+  version = "2020.7";

  src = fetchurl {
    url = "https://www.mullvad.net/media/app/MullvadVPN-${version}_amd64.deb";
-    sha256 = "0d9rv874avx86jppl1dky0nfq1633as0z8yz3h3f69nhmcbwhlr3";
+    sha256 = "07vryz1nq8r4m5y9ry0d0v62ykz1cnnsv628x34yvwiyazbav4ri";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "rclone";
-  version = "1.53.2";
+  version = "1.53.3";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "0ns55b6s4zdw94jlialps3knclghj9xqx84ff8hyrl9ksq02kd3w";
+    sha256 = "10nimrq8nmpmfk2d4fx0yp916wk5q027m283izpshrbwvx7l6xx0";
  };

  vendorSha256 = "1l4iz31k1pylvf0zrp4nhxna70s1ma4981x6q1s3dhszjxil5c88";
--- a/pkgs/applications/networking/termius/default.nix
+++ b/pkgs/applications/networking/termius/default.nix
@ -12,11 +12,11 @@

 stdenv.mkDerivation rec {
  pname = "termius";
-  version = "6.4.1";
+  version = "7.1.0";

  src = fetchurl {
    url = "https://deb.termius.com/pool/main/t/termius-app/termius-app_${version}_amd64.deb";
-    sha256 = "0vc4nz5yndg11zhs92xj496jqzlhy9g0vqlfqrmg8zpf9ciygbqz";
+    sha256 = "801579b931ca0ad5340085df8863042336e2b609dd1cd6771260c873f3d2bb73";
  };

  desktopItem = makeDesktopItem {
@ -45,7 +45,6 @@ stdenv.mkDerivation rec {
    cp -R "opt" "$out"
    cp -R "usr/share" "$out/share"
    chmod -R g-w "$out"
-
    # Desktop file
    mkdir -p "$out/share/applications"
    cp "${desktopItem}/share/applications/"* "$out/share/applications"
@ -63,7 +62,7 @@ stdenv.mkDerivation rec {
    homepage = "https://termius.com/";
    downloadPage = "https://termius.com/linux/";
    license = licenses.unfree;
-    maintainers = with maintainers; [ Br1ght0ne ];
+    maintainers = with maintainers; [ Br1ght0ne th0rgal ];
    platforms = [ "x86_64-linux" ];
  };
 }
--- a/pkgs/applications/office/softmaker/freeoffice.nix
+++ b/pkgs/applications/office/softmaker/freeoffice.nix
@ -5,9 +5,9 @@
  # overridable. This is useful when the upstream archive was replaced
  # and nixpkgs is not in sync yet.
 , officeVersion ? {
-  version = "978";
+  version = "980";
  edition = "2018";
-  sha256 = "1c5div1kbyyj48f89wkhc1i1759n70bsbp3w4a42cr0jmllyl60v";
+  sha256 = "19pgil86aagiz6z4kx22gd4cxbbmrx42ix42arkfb6p6hav1plby";
 }

 , ... } @ args:
--- a/pkgs/applications/radio/ebook2cw/Makefile.patch
+++ b/pkgs/applications/radio/ebook2cw/Makefile.patch
@ -0,0 +1,12 @@
+diff --git a/Makefile b/Makefile
+index 005d60d..f69c7fe 100644
+--- a/Makefile
+++ b/Makefile
+@@ -41,6 +41,7 @@ install:
+ 	install -d -v                      $(DESTDIR)/bin/
+ 	install -d -v                      $(DESTDIR)/share/doc/ebook2cw/
+ 	install -d -v                      $(DESTDIR)/share/doc/ebook2cw/examples/
+	install -d -v                      $(DESTDIR)/share/locale/de/LC_MESSAGES/
+ 	install -s -m 0755 ebook2cw        $(DESTDIR)/bin/
+ 	install    -m 0644 ebook2cw.1      $(DESTDIR)/share/man/man1/
+ 	install    -m 0644 README          $(DESTDIR)/share/doc/ebook2cw/
--- a/pkgs/applications/radio/ebook2cw/configfile.patch
+++ b/pkgs/applications/radio/ebook2cw/configfile.patch
@ -1,11 +0,0 @@
--- a/ebook2cw.c	2017-11-08 19:52:58.298131348 -0700
-+++ b/ebook2cw.c	2017-11-08 19:53:02.588231067 -0700
-@@ -136,7 +136,7 @@
- 	char isomap[256][4]; 		/* by these strings */
- 	char utf8map[256][8];
- 
-	char configfile[1025];
-+	char configfile[2048];
- 
- 	char id3_author[80],
- 		id3_title[80],
--- a/pkgs/applications/radio/ebook2cw/default.nix
+++ b/pkgs/applications/radio/ebook2cw/default.nix
@ -1,17 +1,18 @@
-{ stdenv, fetchsvn, lame, libvorbis }:
+{ stdenv, fetchgit, lame, libvorbis, gettext }:

 stdenv.mkDerivation rec {
  pname = "ebook2cw";
-  version = "0.8.2";
+  version = "0.8.3";

-  src = fetchsvn {
-    url = "svn://svn.fkurz.net/ebook2cw/tags/${pname}-${version}";
-    sha256 = "1mvp3nz3k76v757792n9b7fcm5jm3jcwarl1k7cila9fi0c2rsiw";
+  src = fetchgit {
+    url = "https://git.fkurz.net/dj1yfk/ebook2cw.git";
+    rev = "${pname}-${version}";
+    sha256 = "0jqmnjblv3wzr0ppqzndzd8wg02nlkvzg1fqw14vyyp76sdjsh46";
  };

-  buildInputs = [ lame libvorbis ];
+  buildInputs = [ lame libvorbis gettext ];

-  patches = [ ./configfile.patch ];
+  patches = [ ./Makefile.patch ];

  makeFlags = [ "DESTDIR=$(out)" ];

--- a/pkgs/applications/radio/quisk/default.nix
+++ b/pkgs/applications/radio/quisk/default.nix
@ -3,11 +3,11 @@

 python38Packages.buildPythonApplication rec {
  pname = "quisk";
-  version = "4.1.72";
+  version = "4.1.73";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0qw00b9d0l3ysdrmd3nr5a2zlwg9ygdil7krnk2gjp5g8bb778k7";
+    sha256 = "37dfb02a32341025c086b07d66ddf1608d4ee1ae1c62fb51f87c97662f13e0d8";
  };

  buildInputs = [ fftw alsaLib pulseaudio ];
--- a/pkgs/applications/science/robotics/mavproxy/default.nix
+++ b/pkgs/applications/science/robotics/mavproxy/default.nix
@ -3,11 +3,11 @@

 buildPythonApplication rec {
  pname = "MAVProxy";
-  version = "1.8.23";
+  version = "1.8.24";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "46c70e013d3e465daae5523f6a1aad553e6ee0f4db137bb935a3273f7ffcc22e";
+    sha256 = "768deb3c1d96ed8d734a2fe2eb7cc3877309b17fb5353e9d7036830283806885";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/version-management/git-and-tools/cgit/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/cgit/default.nix
@ -69,6 +69,8 @@ stdenv.mkDerivation rec {
    done
  '';

+  stripDebugList = [ "cgit" ];
+
  meta = {
    homepage = "https://git.zx2c4.com/cgit/about/";
    repositories.git = "git://git.zx2c4.com/cgit";
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,13 +1,13 @@
 {
-  "version": "13.0.14",
-  "repo_hash": "15is18x631ifsj4iwmrs1s9lc3i99hwsxxf5v42qldbmsys31l1k",
+  "version": "13.6.0",
+  "repo_hash": "1flri1cgx8drwf46x4sja366aiiif0ww807xrrcxa05pxj0mx8k5",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v13.0.14-ee",
+  "rev": "v13.6.0-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "13.0.14",
-    "GITLAB_PAGES_VERSION": "1.18.0",
-    "GITLAB_SHELL_VERSION": "13.2.0",
-    "GITLAB_WORKHORSE_VERSION": "8.31.2"
+    "GITALY_SERVER_VERSION": "13.6.0",
+    "GITLAB_PAGES_VERSION": "1.30.0",
+    "GITLAB_SHELL_VERSION": "13.13.0",
+    "GITLAB_WORKHORSE_VERSION": "8.54.0"
  }
 }
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, fetchFromGitLab, bundlerEnv
-, ruby, tzdata, git, nettools, nixosTests, nodejs
+, ruby, tzdata, git, nettools, nixosTests, nodejs, openssl
 , gitlabEnterprise ? false, callPackage, yarn
 , fixup_yarn_lock, replace
 }:
@ -28,6 +28,10 @@ let
          patches = [ ./fix-grpc-ar.patch ];
          dontBuild = false;
        };
+        # the openssl needs the openssl include files
+        openssl = x.openssl // {
+          buildInputs = [ openssl ];
+        };
      };
    groups = [
      "default" "unicorn" "ed25519" "metrics" "development" "puma" "test" "kerberos"
@ -89,8 +93,9 @@ let

      bundle exec rake gettext:po_to_json RAILS_ENV=production NODE_ENV=production
      bundle exec rake rake:assets:precompile RAILS_ENV=production NODE_ENV=production
-      bundle exec rake webpack:compile RAILS_ENV=production NODE_ENV=production NODE_OPTIONS="--max_old_space_size=3072"
+      bundle exec rake gitlab:assets:compile_webpack_if_needed RAILS_ENV=production NODE_ENV=production
      bundle exec rake gitlab:assets:fix_urls RAILS_ENV=production NODE_ENV=production
+      bundle exec rake gitlab:assets:check_page_bundle_mixins_css_for_sideeffects RAILS_ENV=production NODE_ENV=production

      runHook postBuild
    '';
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile
@ -1,28 +1,25 @@
 source 'https://rubygems.org'

-# Require bundler >= 1.16.5 to avoid this bug: https://github.com/bundler/bundler/issues/6537
-gem 'bundler', '>= 1.17.3'
-
 gem 'rugged', '~> 0.28'
-gem 'github-linguist', '~> 7.9', require: 'linguist'
+gem 'github-linguist', '~> 7.11', require: 'linguist'
 gem 'gitlab-markup', '~> 1.7.1'
-gem 'activesupport', '~> 6.0.3.1'
+gem 'activesupport', '~> 6.0.3.3'
 gem 'rdoc', '~> 6.0'
 gem 'gitlab-gollum-lib', '~> 4.2.7.9', require: false
 gem 'gitlab-gollum-rugged_adapter', '~> 0.4.4.2', require: false
-gem 'grpc', '~> 1.24.0'
-gem 'sentry-raven', '~> 2.9.0', require: false
-gem 'faraday', '~> 0.12'
+gem 'grpc', '~> 1.30.2'
+gem 'sentry-raven', '~> 3.0', require: false
+gem 'faraday', '~> 1.0'
 gem 'rbtrace', require: false

 # Labkit provides observability functionality
-gem 'gitlab-labkit', '~> 0.12.0'
+gem 'gitlab-labkit', '~> 0.13.2'

 # Detects the open source license the repository includes
 # This version needs to be in sync with GitLab CE/EE
 gem 'licensee', '~> 8.9.0'

-gem 'google-protobuf', '~> 3.8.0'
+gem 'google-protobuf', '~> 3.12'

 group :development, :test do
  gem 'rubocop', '~> 0.69', require: false
@ -32,11 +29,5 @@ group :development, :test do
  gem 'factory_bot', require: false
  gem 'pry', '~> 0.12.2', require: false

-  gem 'grpc-tools', '= 1.0.1'
-
-  # gitlab-shell spec gems
-  gem 'listen', '~> 0.5.0'
-  gem 'simplecov', '~> 0.17.1', require: false
-  gem 'vcr', '~> 4.0.0'
-  gem 'webmock', '~> 3.4.0'
+  gem 'grpc-tools', '= 1.30.2'
 end
--- a/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/gitaly/Gemfile.lock
@ -2,20 +2,20 @@ GEM
  remote: https://rubygems.org/
  specs:
    abstract_type (0.0.7)
-    actionpack (6.0.3.1)
-      actionview (= 6.0.3.1)
-      activesupport (= 6.0.3.1)
+    actionpack (6.0.3.3)
+      actionview (= 6.0.3.3)
+      activesupport (= 6.0.3.3)
      rack (~> 2.0, >= 2.0.8)
      rack-test (>= 0.6.3)
      rails-dom-testing (~> 2.0)
      rails-html-sanitizer (~> 1.0, >= 1.2.0)
-    actionview (6.0.3.1)
-      activesupport (= 6.0.3.1)
+    actionview (6.0.3.3)
+      activesupport (= 6.0.3.3)
      builder (~> 3.1)
      erubi (~> 1.4)
      rails-dom-testing (~> 2.0)
      rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activesupport (6.0.3.1)
+    activesupport (6.0.3.3)
      concurrent-ruby (~> 1.0, >= 1.0.2)
      i18n (>= 0.7, < 2)
      minitest (~> 5.1)
@ -24,34 +24,29 @@ GEM
    adamantium (0.2.0)
      ice_nine (~> 0.11.0)
      memoizable (~> 0.4.0)
-    addressable (2.6.0)
-      public_suffix (>= 2.0.2, < 4.0)
-    ast (2.4.0)
+    ast (2.4.1)
    binding_ninja (0.2.3)
    builder (3.2.4)
-    charlock_holmes (0.7.6)
+    charlock_holmes (0.7.7)
    coderay (1.1.2)
    concord (0.1.5)
      adamantium (~> 0.2.0)
      equalizer (~> 0.0.9)
-    concurrent-ruby (1.1.6)
-    crack (0.4.3)
-      safe_yaml (~> 1.0.0)
+    concurrent-ruby (1.1.7)
    crass (1.0.6)
    diff-lcs (1.3)
-    docile (1.3.2)
    equalizer (0.0.11)
    erubi (1.9.0)
    escape_utils (1.2.1)
    factory_bot (5.0.2)
      activesupport (>= 4.2.0)
-    faraday (0.15.4)
+    faraday (1.0.1)
      multipart-post (>= 1.2, < 3)
-    ffi (1.12.2)
+    ffi (1.13.1)
    gemojione (3.3.0)
      json
-    github-linguist (7.9.0)
-      charlock_holmes (~> 0.7.6)
+    github-linguist (7.11.0)
+      charlock_holmes (~> 0.7.7)
      escape_utils (~> 1.2.0)
      mini_mime (~> 1.0)
      rugged (>= 0.25.1)
@ -67,56 +62,53 @@ GEM
    gitlab-gollum-rugged_adapter (0.4.4.2)
      mime-types (>= 1.15)
      rugged (~> 0.25)
-    gitlab-labkit (0.12.0)
+    gitlab-labkit (0.13.2)
      actionpack (>= 5.0.0, < 6.1.0)
      activesupport (>= 5.0.0, < 6.1.0)
      grpc (~> 1.19)
-      jaeger-client (~> 0.10)
+      jaeger-client (~> 1.1)
      opentracing (~> 0.4)
      redis (> 3.0.0, < 5.0.0)
    gitlab-markup (1.7.1)
-    google-protobuf (3.8.0)
-    googleapis-common-protos-types (1.0.4)
-      google-protobuf (~> 3.0)
-    grpc (1.24.0)
-      google-protobuf (~> 3.8)
+    google-protobuf (3.12.4)
+    googleapis-common-protos-types (1.0.5)
+      google-protobuf (~> 3.11)
+    grpc (1.30.2)
+      google-protobuf (~> 3.12)
      googleapis-common-protos-types (~> 1.0)
-    grpc-tools (1.0.1)
-    hashdiff (0.3.9)
-    i18n (1.8.2)
+    grpc-tools (1.30.2)
+    i18n (1.8.5)
      concurrent-ruby (~> 1.0)
    ice_nine (0.11.2)
-    jaeger-client (0.10.0)
+    jaeger-client (1.1.0)
      opentracing (~> 0.3)
      thrift
-    jaro_winkler (1.5.2)
-    json (2.2.0)
+    json (2.3.1)
    licensee (8.9.2)
      rugged (~> 0.24)
-    listen (0.5.3)
-    loofah (2.5.0)
+    loofah (2.7.0)
      crass (~> 1.0.2)
      nokogiri (>= 1.5.9)
    memoizable (0.4.2)
      thread_safe (~> 0.3, >= 0.3.1)
    method_source (0.9.2)
-    mime-types (3.2.2)
+    mime-types (3.3.1)
      mime-types-data (~> 3.2015)
-    mime-types-data (3.2019.0331)
+    mime-types-data (3.2020.0512)
    mini_mime (1.0.2)
    mini_portile2 (2.4.0)
-    minitest (5.14.0)
-    msgpack (1.3.1)
-    multipart-post (2.0.0)
-    nokogiri (1.10.9)
+    minitest (5.14.2)
+    msgpack (1.3.3)
+    multipart-post (2.1.1)
+    nokogiri (1.10.10)
      mini_portile2 (~> 2.4.0)
    nokogumbo (1.5.0)
      nokogiri
    opentracing (0.5.0)
-    optimist (3.0.0)
-    parallel (1.17.0)
-    parser (2.7.0.5)
-      ast (~> 2.4.0)
+    optimist (3.0.1)
+    parallel (1.19.2)
+    parser (2.7.2.0)
+      ast (~> 2.4.1)
    proc_to_ast (0.1.0)
      coderay
      parser
@ -125,8 +117,7 @@ GEM
    pry (0.12.2)
      coderay (~> 1.1.0)
      method_source (~> 0.9.0)
-    public_suffix (3.0.3)
-    rack (2.1.2)
+    rack (2.2.3)
    rack-test (1.1.0)
      rack (>= 1.0, < 3)
    rails-dom-testing (2.0.3)
@ -135,13 +126,15 @@ GEM
    rails-html-sanitizer (1.3.0)
      loofah (~> 2.3)
    rainbow (3.0.0)
-    rbtrace (0.4.11)
+    rbtrace (0.4.14)
      ffi (>= 1.0.6)
      msgpack (>= 0.4.3)
      optimist (>= 3.0.0)
    rdoc (6.2.0)
    redis (4.1.3)
-    rouge (3.19.0)
+    regexp_parser (1.8.1)
+    rexml (3.2.4)
+    rouge (3.24.0)
    rspec (3.8.0)
      rspec-core (~> 3.8.0)
      rspec-expectations (~> 3.8.0)
@ -161,34 +154,32 @@ GEM
      rspec (>= 2.13, < 4)
      unparser
    rspec-support (3.8.0)
-    rubocop (0.69.0)
-      jaro_winkler (~> 1.5.1)
+    rubocop (0.86.0)
      parallel (~> 1.10)
-      parser (>= 2.6)
+      parser (>= 2.7.0.1)
      rainbow (>= 2.2.2, < 4.0)
+      regexp_parser (>= 1.7)
+      rexml
+      rubocop-ast (>= 0.0.3, < 1.0)
      ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 1.4.0, < 1.7)
-    ruby-progressbar (1.10.0)
+      unicode-display_width (>= 1.4.0, < 2.0)
+    rubocop-ast (0.2.0)
+      parser (>= 2.7.0.1)
+    ruby-progressbar (1.10.1)
    rugged (0.28.4.1)
-    safe_yaml (1.0.5)
    sanitize (4.6.6)
      crass (~> 1.0.2)
      nokogiri (>= 1.4.4)
      nokogumbo (~> 1.4)
-    sentry-raven (2.9.0)
-      faraday (>= 0.7.6, < 1.0)
-    simplecov (0.17.1)
-      docile (~> 1.1)
-      json (>= 1.8, < 3)
-      simplecov-html (~> 0.10.0)
-    simplecov-html (0.10.2)
+    sentry-raven (3.0.4)
+      faraday (>= 1.0)
    stringex (2.8.5)
    thread_safe (0.3.6)
    thrift (0.11.0.0)
    timecop (0.9.1)
    tzinfo (1.2.7)
      thread_safe (~> 0.1)
-    unicode-display_width (1.6.0)
+    unicode-display_width (1.7.0)
    unparser (0.4.7)
      abstract_type (~> 0.0.7)
      adamantium (~> 0.2.0)
@ -197,31 +188,24 @@ GEM
      equalizer (~> 0.0.9)
      parser (>= 2.6.5)
      procto (~> 0.0.2)
-    vcr (4.0.0)
-    webmock (3.4.2)
-      addressable (>= 2.3.6)
-      crack (>= 0.3.2)
-      hashdiff
-    zeitwerk (2.3.0)
+    zeitwerk (2.4.0)

 PLATFORMS
  ruby

 DEPENDENCIES
-  activesupport (~> 6.0.3.1)
-  bundler (>= 1.17.3)
+  activesupport (~> 6.0.3.3)
  factory_bot
-  faraday (~> 0.12)
-  github-linguist (~> 7.9)
+  faraday (~> 1.0)
+  github-linguist (~> 7.11)
  gitlab-gollum-lib (~> 4.2.7.9)
  gitlab-gollum-rugged_adapter (~> 0.4.4.2)
-  gitlab-labkit (~> 0.12.0)
+  gitlab-labkit (~> 0.13.2)
  gitlab-markup (~> 1.7.1)
-  google-protobuf (~> 3.8.0)
-  grpc (~> 1.24.0)
-  grpc-tools (= 1.0.1)
+  google-protobuf (~> 3.12)
+  grpc (~> 1.30.2)
+  grpc-tools (= 1.30.2)
  licensee (~> 8.9.0)
-  listen (~> 0.5.0)
  pry (~> 0.12.2)
  rbtrace
  rdoc (~> 6.0)
@ -229,11 +213,8 @@ DEPENDENCIES
  rspec-parameterized
  rubocop (~> 0.69)
  rugged (~> 0.28)
-  sentry-raven (~> 2.9.0)
-  simplecov (~> 0.17.1)
+  sentry-raven (~> 3.0)
  timecop
-  vcr (~> 4.0.0)
-  webmock (~> 3.4.0)

 BUNDLED WITH
   2.1.4
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -19,22 +19,16 @@ let
      };
  };
 in buildGoPackage rec {
-  version = "13.0.14";
+  version = "13.6.0";
  pname = "gitaly";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitaly";
    rev = "v${version}";
-    sha256 = "16ynkwiv0faa60msashj5w1bc4rdh7yv2qjmpcbf7dwq54gqmlbv";
+    sha256 = "1b3vjg5sxrg8cfxn1nh8j26h847kxrfnn2chbb5v3ivhp1kp6zh2";
  };

-  # Fix a check which assumes that hook files are writeable by their
-  # owner.
-  patches = [
-    ./fix-executable-check.patch
-  ];
-
  goPackagePath = "gitlab.com/gitlab-org/gitaly";

  passthru = {
@ -44,11 +38,11 @@ in buildGoPackage rec {
  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [ rubyEnv.wrappedRuby libgit2_0_27 ];
  goDeps = ./deps.nix;
-  preBuild = "rm -r go/src/gitlab.com/gitlab-org/labkit/vendor";
+  preBuild = "rm -rf go/src/gitlab.com/gitlab-org/labkit/vendor";

  postInstall = ''
    mkdir -p $ruby
-    cp -rv $src/ruby/{bin,lib,proto,git-hooks,gitlab-shell} $ruby
+    cp -rv $src/ruby/{bin,lib,proto,git-hooks} $ruby
  '';

  outputs = [ "out" "ruby" ];
--- a/pkgs/applications/version-management/gitlab/gitaly/deps.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/deps.nix
@ -117,6 +117,15 @@
      sha256 = "1j65b91qb9sbrml9cpabfrcf07wmgzzghrl7809hjjhrmbzri5bl";
    };
  }
+  {
+    goPackagePath = "github.com/alexbrainman/sspi";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alexbrainman/sspi";
+      rev = "4729b3d4d858";
+      sha256 = "12xy7gi9v48z8akm6h33qjk3m06f5nw1q15a6y2r61pd404bkdyc";
+    };
+  }
  {
    goPackagePath = "github.com/armon/consul-api";
    fetch = {
@ -135,6 +144,15 @@
      sha256 = "0y8chspn14n9xpsfb9gxnnf819rfpriaz64v81p7873a42kkhxb4";
    };
  }
+  {
+    goPackagePath = "github.com/avast/retry-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/avast/retry-go";
+      rev = "v2.4.2";
+      sha256 = "0hb4b1668516a4gv8avmflr565b6c1h93phdb068hcjxxj8767ba";
+    };
+  }
  {
    goPackagePath = "github.com/beorn7/perks";
    fetch = {
@ -315,6 +333,15 @@
      sha256 = "1x3l4jgps0v1bjvd446kj4dp0ckswjckxgrng9afm275ixnf83ix";
    };
  }
+  {
+    goPackagePath = "github.com/dpotapov/go-spnego";
+    fetch = {
+      type = "git";
+      url = "https://github.com/dpotapov/go-spnego";
+      rev = "c2c609116ad0";
+      sha256 = "1ba14j1y8sjlagx7rfjmvdwlyc90qblpplfb0p3zwsj8chqaijgf";
+    };
+  }
  {
    goPackagePath = "github.com/dustin/go-humanize";
    fetch = {
@ -401,8 +428,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/getsentry/raven-go";
-      rev = "v0.1.2";
-      sha256 = "1dl80kar4lzdcfl3w6jssi1ld6bv0rmx6sp6bz6rzysfr9ilm02z";
+      rev = "v0.2.0";
+      sha256 = "0imfwmsb72168fqandf2lxhzhngf2flxhzaar8hcnnfjv2a291lf";
    };
  }
  {
@ -410,8 +437,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/getsentry/sentry-go";
-      rev = "v0.5.1";
-      sha256 = "1kfn0gcb4c6amhagv04ydpl6p9cqw7f0lxas688a0rf89iwdzz89";
+      rev = "v0.7.0";
+      sha256 = "13n9r7845wsq9z61rbvlqjjjg4aifplc74v3kv0i1lys2fw8a5k9";
    };
  }
  {
@ -432,6 +459,51 @@
      sha256 = "19nxip48p2s8l7p1p7wpd5li2fcngi4c58rgcg71izdmsmj2iw1d";
    };
  }
+  {
+    goPackagePath = "github.com/git-lfs/git-lfs";
+    fetch = {
+      type = "git";
+      url = "https://github.com/git-lfs/git-lfs";
+      rev = "9ea4eed5b112";
+      sha256 = "02xx8iw48zyccfxm30kc3r3hgwhc64yfrcy7c2bv4b1hqn09wwnz";
+    };
+  }
+  {
+    goPackagePath = "github.com/git-lfs/gitobj";
+    fetch = {
+      type = "git";
+      url = "https://github.com/git-lfs/gitobj";
+      rev = "v2.0.0";
+      sha256 = "15x3q3ad50jyi6rjjw4siw6gxcp1ppwwhmzq3916vs186b0rqdyv";
+    };
+  }
+  {
+    goPackagePath = "github.com/git-lfs/go-netrc";
+    fetch = {
+      type = "git";
+      url = "https://github.com/git-lfs/go-netrc";
+      rev = "e0e9ca483a18";
+      sha256 = "16djli5hasqm4js2d72msk32ym0y5jmk3a4634nrgbncjksnfihi";
+    };
+  }
+  {
+    goPackagePath = "github.com/git-lfs/go-ntlm";
+    fetch = {
+      type = "git";
+      url = "https://github.com/git-lfs/go-ntlm";
+      rev = "c5056e7fa066";
+      sha256 = "1wrv3aczz0g4wqxjw5pvyy9z1cvj2b33q84h5mprik0f1hwyfwnh";
+    };
+  }
+  {
+    goPackagePath = "github.com/git-lfs/wildmatch";
+    fetch = {
+      type = "git";
+      url = "https://github.com/git-lfs/wildmatch";
+      rev = "v1.0.4";
+      sha256 = "19k8a9j9l0ddlv3asxnn7bblryz674fpm9dg8ds0s74fhix6a5dr";
+    };
+  }
  {
    goPackagePath = "github.com/go-check/check";
    fetch = {
@ -572,8 +644,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/gogo/protobuf";
-      rev = "v1.1.1";
-      sha256 = "1525pq7r6h3s8dncvq8gxi893p2nq8dxpzvq0nfl5b4p6mq0v1c2";
+      rev = "v1.2.1";
+      sha256 = "06yqa6h0kw3gr5pc3qmas7f7435a96zf7iw7p0l00r2hqf6fqq6m";
    };
  }
  {
@ -765,6 +837,15 @@
      sha256 = "00nyn8llqzbfm8aflr9kwsvpzi4kv8v45c141v88xskxp5xf6z49";
    };
  }
+  {
+    goPackagePath = "github.com/hashicorp/go-uuid";
+    fetch = {
+      type = "git";
+      url = "https://github.com/hashicorp/go-uuid";
+      rev = "v1.0.2";
+      sha256 = "1azjn5a03cv0bdab3clmkfz8g9807nxxjwy9i7dy73p7d4sikhja";
+    };
+  }
  {
    goPackagePath = "github.com/hashicorp/go-version";
    fetch = {
@ -864,6 +945,15 @@
      sha256 = "1a1lk2ll2xv3ljffmfw4q8mqqw727pj8dzs6c8g2hh0b0b050g79";
    };
  }
+  {
+    goPackagePath = "github.com/jcmturner/gofork";
+    fetch = {
+      type = "git";
+      url = "https://github.com/jcmturner/gofork";
+      rev = "v1.0.0";
+      sha256 = "0xzsnjqv3d59w9pgqzf6550wdwaqnac7zcdgqfd25w65yhcffzhr";
+    };
+  }
  {
    goPackagePath = "github.com/joho/godotenv";
    fetch = {
@ -990,6 +1080,15 @@
      sha256 = "1zcq480ig7wbg4378qcfxznp2gzqmk7x6rbxizflvg9v2f376vrw";
    };
  }
+  {
+    goPackagePath = "github.com/kisielk/errcheck";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kisielk/errcheck";
+      rev = "v1.1.0";
+      sha256 = "19vd4rxmqbk5lpiav3pf7df3yjlz0l0dwx9mn0gjq5f998iyhy6y";
+    };
+  }
  {
    goPackagePath = "github.com/kisielk/gotool";
    fetch = {
@ -1022,8 +1121,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/konsorten/go-windows-terminal-sequences";
-      rev = "v1.0.2";
-      sha256 = "09mn209ika7ciy87xf2x31dq5fnqw39jidgaljvmqxwk7ff1hnx7";
+      rev = "v1.0.3";
+      sha256 = "1yrsd4s8vhjnxhwbigirymz89dn6qfjnhn28i33vvvdgf96j6ypl";
    };
  }
  {
@ -1130,8 +1229,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/mattn/go-isatty";
-      rev = "v0.0.9";
-      sha256 = "0i3km37lajahh1y2392g4hpgvq05arcgiiv93yhzxxyv0fpqj72m";
+      rev = "v0.0.12";
+      sha256 = "1dfsh27d52wmz0nmmzm2382pfrs2fcijvh6cgir7jbb4pnigr5w4";
    };
  }
  {
@ -1296,6 +1395,15 @@
      sha256 = "11zbhg4kds5idsya04bwz4plj0mmiigypzppzih731ppbk2ms1zg";
    };
  }
+  {
+    goPackagePath = "github.com/oklog/ulid";
+    fetch = {
+      type = "git";
+      url = "https://github.com/oklog/ulid";
+      rev = "v2.0.2";
+      sha256 = "1apm4r23kxsm0c9hlxsr7xh6xwrk2cjqylbpxd4ffxbl6bwflja0";
+    };
+  }
  {
    goPackagePath = "github.com/olekukonko/tablewriter";
    fetch = {
@ -1305,6 +1413,15 @@
      sha256 = "1f4mwdh501p8105nfxayprlj5ld14fwzyyy2wbc04xk3wrm1wzlf";
    };
  }
+  {
+    goPackagePath = "github.com/olekukonko/ts";
+    fetch = {
+      type = "git";
+      url = "https://github.com/olekukonko/ts";
+      rev = "78ecb04241c0";
+      sha256 = "0k88n5rvs5k5zalbfa7c71jkjb8dhpk83s425z728qn6aq49c978";
+    };
+  }
  {
    goPackagePath = "github.com/onsi/ginkgo";
    fetch = {
@ -1328,8 +1445,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/opentracing/opentracing-go";
-      rev = "v1.0.2";
-      sha256 = "0i0ghg94dg8lk05mw5n23983wq04yjvkjmdkc9z5y1f3508938h9";
+      rev = "v1.2.0";
+      sha256 = "04rgdwl29kimp2wnm4dycnzp7941hvpj6wym85x23c6fclacm94h";
    };
  }
  {
@ -1359,13 +1476,22 @@
      sha256 = "0kfc95jc2hfgwzcpdfa5hrxgj7s6rzx5jc0n1sn863bsngx2q1ca";
    };
  }
+  {
+    goPackagePath = "github.com/pborman/getopt";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pborman/getopt";
+      rev = "7148bc3a4c30";
+      sha256 = "0zhvvmv671r1fbdd5hbv3flx8k2rb60giqx115w0553c56qkqfpj";
+    };
+  }
  {
    goPackagePath = "github.com/pelletier/go-toml";
    fetch = {
      type = "git";
      url = "https://github.com/pelletier/go-toml";
-      rev = "v1.2.0";
-      sha256 = "1fjzpcjng60mc3a4b2ql5a00d5gah84wj740dabv9kq67mpg8fxy";
+      rev = "v1.8.1";
+      sha256 = "1pi1r9ds0vxjza4qrbk52y98wxrzh1ghwzc9c2v1w6i02pdwdcz9";
    };
  }
  {
@ -1467,6 +1593,15 @@
      sha256 = "0z7y7vsnzjswx51g9hlawnzmwnb8c7rks6ljzf6m1xbimhi4n3kz";
    };
  }
+  {
+    goPackagePath = "github.com/rubyist/tracerx";
+    fetch = {
+      type = "git";
+      url = "https://github.com/rubyist/tracerx";
+      rev = "787959303086";
+      sha256 = "1xj5213r00zjhb7d2l6wlwv62g6mss50jwjpf7g8fk8djv3l29zz";
+    };
+  }
  {
    goPackagePath = "github.com/russross/blackfriday";
    fetch = {
@ -1517,8 +1652,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/sirupsen/logrus";
-      rev = "v1.4.2";
-      sha256 = "087k2lxrr9p9dh68yw71d05h5g9p5v26zbwd6j7lghinjfaw334x";
+      rev = "v1.7.0";
+      sha256 = "1a59pw7zimvm8k423iq9l4f4qjj1ia1xc6pkmhwl2mxc46y2n442";
    };
  }
  {
@ -1593,6 +1728,15 @@
      sha256 = "1829hvf805kda65l59r17wvid7y0vr390s23zfhf4w7vdb4wp3zh";
    };
  }
+  {
+    goPackagePath = "github.com/ssgelm/cookiejarparser";
+    fetch = {
+      type = "git";
+      url = "https://github.com/ssgelm/cookiejarparser";
+      rev = "v1.0.1";
+      sha256 = "0fnm53br0cg3iwzniil0lh9w4xd6xpzfypwfpdiammfqavlqgcw4";
+    };
+  }
  {
    goPackagePath = "github.com/stretchr/objx";
    fetch = {
@ -1607,8 +1751,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/stretchr/testify";
-      rev = "v1.4.0";
-      sha256 = "187i5g88sxfy4vxpm7dw1gwv29pa2qaq475lxrdh5livh69wqfjb";
+      rev = "v1.6.1";
+      sha256 = "1yhiqqzjvi63pf01rgzx68gqkkvjx03fvl5wk30br5l6s81s090l";
    };
  }
  {
@ -1787,8 +1931,8 @@
    fetch = {
      type = "git";
      url = "https://gitlab.com/gitlab-org/gitlab-shell.git";
-      rev = "716e30c55e89";
-      sha256 = "0g2bgwm5rf93xfd40j3d2a5js1a212r2l2qdbds3gp7h0v73npjw";
+      rev = "3f9890ef73dc";
+      sha256 = "1zx7x3g18xzw7fs7cayd20llxabv5r93m2mp6ixgr99ksvi6zix7";
    };
  }
  {
@ -1796,8 +1940,8 @@
    fetch = {
      type = "git";
      url = "https://gitlab.com/gitlab-org/labkit.git";
-      rev = "0149780c759d";
-      sha256 = "1krp5jkwpckpdznbl9xp4yvq6cii750r24agcni3snbbs8hd8gb1";
+      rev = "40dcf811328c";
+      sha256 = "1x22iz53wjg1qps0bnr4lniik09szmy99ny2kb6smjpv9cr6klw7";
    };
  }
  {
@ -1814,8 +1958,8 @@
    fetch = {
      type = "git";
      url = "https://github.com/uber-go/atomic";
-      rev = "v1.3.2";
-      sha256 = "11pzvjys5ddjjgrv94pgk9pnip9yyb54z7idf33zk7p7xylpnsv6";
+      rev = "v1.4.0";
+      sha256 = "0c6yzx15c20719xii3dm0vyjd8i9jx45m0wh5yp1zf29b0gbljcy";
    };
  }
  {
@ -1823,8 +1967,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/crypto";
-      rev = "87dc89f01550";
-      sha256 = "0z4i1m2yn3f31ci7wvcm2rxkx2yiv7a78mfzklncmsz2k97rlh2g";
+      rev = "5c72a883971a";
+      sha256 = "1cimmqpajys001x6yq8ycklc4w34y7iwrksv7ayv7m7fgzhcjn3d";
    };
  }
  {
@ -1877,8 +2021,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/net";
-      rev = "6afb5195e5aa";
-      sha256 = "1aiz41q2yxgg3dxfkn33ff54vhaxbiwcps9j3ia1xx4cqxim38zw";
+      rev = "62affa334b73";
+      sha256 = "0v88xr36220wawwck914f90n9zvvc6lcx33ak3iplkwq0xkgw5fr";
    };
  }
  {
@ -1895,8 +2039,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/sync";
-      rev = "cd5d95a43a6e";
-      sha256 = "1nqkyz2y1qvqcma52ijh02s8aiqmkfb95j08f6zcjhbga3ds6hds";
+      rev = "6e8e738ad208";
+      sha256 = "1avk27pszd5l5df6ff7j78wgla46ir1hhy2jwfl9a3c0ys602yx9";
    };
  }
  {
@ -1904,8 +2048,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/sys";
-      rev = "86b910548bc1";
-      sha256 = "1z8l2wp27q0bd4nc46j31lc7cr6kiw52zi6ix3i121pd3rcyrw44";
+      rev = "e3ed0017c211";
+      sha256 = "0nz91nxgfcbcxirscdrxcq5a97z5pyz0g0k2chjxx228dz59aw1i";
    };
  }
  {
@ -1913,8 +2057,8 @@
    fetch = {
      type = "git";
      url = "https://go.googlesource.com/text";
-      rev = "v0.3.2";
-      sha256 = "0flv9idw0jm5nm8lx25xqanbkqgfiym6619w575p7nrdh0riqwqh";
+      rev = "v0.3.3";
+      sha256 = "19pihqm3phyndmiw6i42pdv6z1rbvlqlsnhsyqf9gsnn0qnmqqlh";
    };
  }
  {
@ -2052,6 +2196,51 @@
      sha256 = "0zwkq4cv71vp7cmpfcs54908g1amr0cdxv1b8h1icf64jjawb1lb";
    };
  }
+  {
+    goPackagePath = "gopkg.in/jcmturner/aescts.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/jcmturner/aescts.v1";
+      rev = "v1.0.1";
+      sha256 = "0rbq4zf3db48xa2gqdp2swws7wizmbwagigqkr1zxzd1ramps6rv";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/jcmturner/dnsutils.v1";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/jcmturner/dnsutils.v1";
+      rev = "v1.0.1";
+      sha256 = "0l543c64pyzbnrc00jspg21672l3a0kjjw9pbdxwna93w8d8m927";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/jcmturner/goidentity.v2";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/jcmturner/goidentity.v2";
+      rev = "v2.0.0";
+      sha256 = "0sfkxrx57dmjlzz4sxfmbsfaxkm32wg6ymjhaga2ggkixlzdd4d7";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/jcmturner/gokrb5.v5";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/jcmturner/gokrb5.v5";
+      rev = "v5.3.0";
+      sha256 = "0jynpkncifdd2ib2pc9qhh0r8q7ab7yw0ygzpzgisdzv8ars1diq";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/jcmturner/rpc.v0";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/jcmturner/rpc.v0";
+      rev = "v0.0.2";
+      sha256 = "0hivgq52gwxsqs5x1my2047k7nqh7wx3yi0llsj3lc3h2mjy4yhd";
+    };
+  }
  {
    goPackagePath = "gopkg.in/mgo.v2";
    fetch = {
@ -2075,8 +2264,17 @@
    fetch = {
      type = "git";
      url = "https://gopkg.in/yaml.v2";
-      rev = "v2.2.8";
-      sha256 = "1inf7svydzscwv9fcjd2rm61a4xjk6jkswknybmns2n58shimapw";
+      rev = "v2.3.0";
+      sha256 = "1md0hlyd9s6myv3663i9l59y74n4xjazifmmyxn43g86fgkc5lzj";
+    };
+  }
+  {
+    goPackagePath = "gopkg.in/yaml.v3";
+    fetch = {
+      type = "git";
+      url = "https://gopkg.in/yaml.v3";
+      rev = "9f266ea9e77c";
+      sha256 = "1bbai3lzb50m0x2vwsdbagrbhvfylj9k1m32hgbqwldqx4p9ay35";
    };
  }
  {
--- a/pkgs/applications/version-management/gitlab/gitaly/fix-executable-check.patch
+++ b/pkgs/applications/version-management/gitlab/gitaly/fix-executable-check.patch
@ -1,13 +0,0 @@
-diff --git a/internal/config/config.go b/internal/config/config.go
-index 037c9602..3d5409dc 100644
--- a/internal/config/config.go
-+++ b/internal/config/config.go
-@@ -185,7 +185,7 @@ func checkExecutable(path string) error {
- 		return err
- 	}
- 
-	if fi.Mode()&0755 < 0755 {
-+	if fi.Mode()&0555 < 0555 {
- 		return fmt.Errorf("not executable: %v", path)
- 	}
- 
--- a/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/gemset.nix
@ -13,10 +13,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1665r4ffqdpykxwpgdnaq7xsaz1nfswc5wjs2qr0npx8bq7g49kh";
+      sha256 = "1p873nqwmpsvmkb5n86d70wndx1qhy15pc9mbcd1mc8sj174578b";
      type = "gem";
    };
-    version = "6.0.3.1";
+    version = "6.0.3.3";
  };
  actionview = {
    dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
@ -24,10 +24,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1n21pswh3k7m33vzhxyrbi5lj64b1138yqv34jjhkhlq3474b4rh";
+      sha256 = "08pvmjddlw01q5r9zdfgddwp4csndpf5i2w47677z5r36jznz36q";
      type = "gem";
    };
-    version = "6.0.3.1";
+    version = "6.0.3.3";
  };
  activesupport = {
    dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo" "zeitwerk"];
@ -35,10 +35,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1l29n9n38c9lpy5smh26r7fy7jp2bpjqlzhxgsr79cv7xpwlrbhs";
+      sha256 = "1dmkqbvndbz011a1byg6f990936vfadbnwjwjw9vjzr4kd8bxk96";
      type = "gem";
    };
-    version = "6.0.3.1";
+    version = "6.0.3.3";
  };
  adamantium = {
    dependencies = ["ice_nine" "memoizable"];
@ -49,24 +49,15 @@
    };
    version = "0.2.0";
  };
-  addressable = {
-    dependencies = ["public_suffix"];
+  ast = {
    groups = ["default" "development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0bcm2hchn897xjhqj9zzsxf3n9xhddymj4lsclz508f4vw3av46l";
+      sha256 = "1l3468czzjmxl93ap40hp7z94yxp4nbag0bxqs789bm30md90m2a";
      type = "gem";
    };
-    version = "2.6.0";
-  };
-  ast = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "184ssy3w93nkajlz2c70ifm79jp3j737294kbc5fjw69v1w0n9x7";
-      type = "gem";
-    };
-    version = "2.4.0";
+    version = "2.4.1";
  };
  binding_ninja = {
    groups = ["default" "development" "test"];
@ -89,12 +80,14 @@
    version = "3.2.4";
  };
  charlock_holmes = {
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1nf1l31n10yaark2rrg5qzyzcx9w80681449s3j09qmnipsl8rl5";
+      sha256 = "0hybw8jw9ryvz5zrki3gc9r88jqy373m6v46ynxsdzv1ysiyr40p";
      type = "gem";
    };
-    version = "0.7.6";
+    version = "0.7.7";
  };
  coderay = {
    source = {
@ -118,19 +111,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "094387x4yasb797mv07cs3g6f08y56virc2rjcpb1k79rzaj3nhl";
+      sha256 = "1vnxrbhi7cq3p4y2v9iwd10v1c7l15is4var14hwnb2jip4fyjzz";
      type = "gem";
    };
-    version = "1.1.6";
-  };
-  crack = {
-    dependencies = ["safe_yaml"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0abb0fvgw00akyik1zxnq7yv391va148151qxdghnzngv66bl62k";
-      type = "gem";
-    };
-    version = "0.4.3";
+    version = "1.1.7";
  };
  crass = {
    groups = ["default"];
@ -150,16 +134,6 @@
    };
    version = "1.3";
  };
-  docile = {
-    groups = ["default" "development" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0qrwiyagxzl8zlx3dafb0ay8l14ib7imb2rsmx70i5cp420v8gif";
-      type = "gem";
-    };
-    version = "1.3.2";
-  };
  equalizer = {
    source = {
      remotes = ["https://rubygems.org"];
@ -203,20 +177,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0s72m05jvzc1pd6cw1i289chas399q0a14xrwg4rvkdwy7bgzrh0";
+      sha256 = "0wwks9652xwgjm7yszcq5xr960pjypc07ivwzbjzpvy9zh2fw6iq";
      type = "gem";
    };
-    version = "0.15.4";
+    version = "1.0.1";
  };
  ffi = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "10lfhahnnc91v63xpvk65apn61pib086zha3z5sp1xk9acfx12h4";
+      sha256 = "12lpwaw82bb0rm9f52v1498bpba8aj2l2q359mkwbxsswhpga5af";
      type = "gem";
    };
-    version = "1.12.2";
+    version = "1.13.1";
  };
  gemojione = {
    dependencies = ["json"];
@ -233,10 +207,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0rhw05d88l928g6y2bngvmr66565b2z822hyynmb13b7khf07y1a";
+      sha256 = "12vwx6msqqdyf10zrrp2zdwr8ixrb82phriyin16rsmndb93cijv";
      type = "gem";
    };
-    version = "7.9.0";
+    version = "7.11.0";
  };
  github-markup = {
    source = {
@ -274,10 +248,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0a63zgjll83b25hiq8m4sk75jci2rj8z46lss0j3bc6zi3pxnzax";
+      sha256 = "0vgd61xdclihifcdivddfs1gipxy1ql0kf9q47k9h0xisscyjhd2";
      type = "gem";
    };
-    version = "0.12.0";
+    version = "0.13.2";
  };
  gitlab-markup = {
    groups = ["default"];
@ -294,10 +268,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0by3289irdklb9gjqw41fq6mg6yja3iyzh99dj8p8z9l4brllqn4";
+      sha256 = "1m3la0yid3bqx9b30raisqbp27d0q7vdrlslazrdasf8v1vhifxj";
      type = "gem";
    };
-    version = "3.8.0";
+    version = "3.12.4";
  };
  googleapis-common-protos-types = {
    dependencies = ["google-protobuf"];
@ -305,10 +279,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0hyr94cafiqj0k8q19hnl658pmbz2b404akikzfv4hdb1j1bwsg1";
+      sha256 = "1aava1b75n056s24gn7ajrkmm6s3xa3swl62dl5q9apw4marghji";
      type = "gem";
    };
-    version = "1.0.4";
+    version = "1.0.5";
  };
  grpc = {
    dependencies = ["google-protobuf" "googleapis-common-protos-types"];
@ -316,30 +290,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "18wikj9qd4jb4lks55cs2cf3q7fifnanm9z9ywnxhpj57vbnilpf";
+      sha256 = "1rsglf7ag17n465iff7vlw83pn2rpl4kv9sb1rpf17nx6xpi7yl5";
      type = "gem";
    };
-    version = "1.24.0";
+    version = "1.30.2";
  };
  grpc-tools = {
    groups = ["development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0pjs2sm43mai2fy0jsbxl8rs9bych8f5j8hv630fjwh0323cmcc9";
+      sha256 = "0k9zhsqhamp02ryzgfb4y2bbick151vlhrhj0kqbbz9lyhms0bd4";
      type = "gem";
    };
-    version = "1.0.1";
-  };
-  hashdiff = {
-    groups = ["default" "development" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1qji49afni3c90zws617x514xi7ik70g2iwngj9skq68mjcq6y4x";
-      type = "gem";
-    };
-    version = "0.3.9";
+    version = "1.30.2";
  };
  i18n = {
    dependencies = ["concurrent-ruby"];
@ -347,10 +311,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0jwrd1l4mxz06iyx6053lr6hz2zy7ah2k3ranfzisvych5q19kwm";
+      sha256 = "153sx77p16vawrs4qpkv7qlzf9v5fks4g7xqcj1dwk40i6g7rfzk";
      type = "gem";
    };
-    version = "1.8.2";
+    version = "1.8.5";
  };
  ice_nine = {
    source = {
@ -366,30 +330,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "198m72c9w3wfwr1mq22dcjjm7d4jd0bci4lrq6zq2zvlzhi04n8l";
+      sha256 = "1a2qlkc1hkr5hkj2574l1a63sm04bdx98gfhh9m8vvp6psdrnpnb";
      type = "gem";
    };
-    version = "0.10.0";
+    version = "1.1.0";
  };
-  jaro_winkler = {
+  json = {
    groups = ["default" "development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1zz27z88qznix4r65gd9h56gl177snlfpgv10b0s69vi8qpl909l";
+      sha256 = "158fawfwmv2sq4whqqaksfykkiad2xxrrj0nmpnc6vnlzi1bp7iz";
      type = "gem";
    };
-    version = "1.5.2";
-  };
-  json = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0sx97bm9by389rbzv8r1f43h06xcz8vwi3h5jv074gvparql7lcx";
-      type = "gem";
-    };
-    version = "2.2.0";
+    version = "2.3.1";
  };
  licensee = {
    dependencies = ["rugged"];
@ -400,24 +354,16 @@
    };
    version = "8.9.2";
  };
-  listen = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0inlw7vix61170vjr87h9izhjm5dbby8rbfrf1iryiv7b3kyvkxl";
-      type = "gem";
-    };
-    version = "0.5.3";
-  };
  loofah = {
    dependencies = ["crass" "nokogiri"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0jk9fgn5ayzbqvzqm11gbkqvas77zdbpkvynlylyiwynclgrn040";
+      sha256 = "1alz1x6rkhbw10qpszr384299rf52rcyasn0619a9p50vzs8vczq";
      type = "gem";
    };
-    version = "2.5.0";
+    version = "2.7.0";
  };
  memoizable = {
    dependencies = ["thread_safe"];
@ -438,22 +384,24 @@
  };
  mime-types = {
    dependencies = ["mime-types-data"];
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0fjxy1jm52ixpnv3vg9ld9pr9f35gy0jp66i1njhqjvmnvq0iwwk";
+      sha256 = "1zj12l9qk62anvk9bjvandpa6vy4xslil15wl6wlivyf51z773vh";
      type = "gem";
    };
-    version = "3.2.2";
+    version = "3.3.1";
  };
  mime-types-data = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1m00pg19cm47n1qlcxgl91ajh2yq0fszvn1vy8fy0s1jkrp9fw4a";
+      sha256 = "1z75svngyhsglx0y2f9rnil2j08f9ab54b3l95bpgz67zq2if753";
      type = "gem";
    };
-    version = "3.2019.0331";
+    version = "3.2020.0512";
  };
  mini_mime = {
    groups = ["default"];
@ -478,28 +426,30 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0g73x65hmjph8dg1h3rkzfg7ys3ffxm35hj35grw75fixmq53qyz";
+      sha256 = "170y2cvx51gm3cm3nhdf7j36sxnkh6vv8ls36p90ric7w8w16h4v";
      type = "gem";
    };
-    version = "5.14.0";
+    version = "5.14.2";
  };
  msgpack = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1qr2mkm2i3m76zarvy7qgjl9596hmvjrg7x6w42vx8cfsbf5p0y1";
+      sha256 = "1lva6bkvb4mfa0m3bqn4lm4s4gi81c40jvdcsrxr6vng49q9daih";
      type = "gem";
    };
-    version = "1.3.1";
+    version = "1.3.3";
  };
  multipart-post = {
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "09k0b3cybqilk1gwrwwain95rdypixb2q9w65gd44gfzsd84xi1x";
+      sha256 = "1zgw9zlwh2a6i1yvhhc4a84ry1hv824d6g2iw2chs3k5aylpmpfj";
      type = "gem";
    };
-    version = "2.0.0";
+    version = "2.1.1";
  };
  nokogiri = {
    dependencies = ["mini_portile2"];
@ -507,10 +457,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "12j76d0bp608932xkzmfi638c7aqah57l437q8494znzbj610qnm";
+      sha256 = "0xmf60nj5kg9vaj5bysy308687sgmkasgx06vbbnf94p52ih7si2";
      type = "gem";
    };
-    version = "1.10.9";
+    version = "1.10.10";
  };
  nokogumbo = {
    dependencies = ["nokogiri"];
@ -532,22 +482,24 @@
    version = "0.5.0";
  };
  optimist = {
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "05jxrp3nbn5iilc1k7ir90mfnwc5abc9h78s5rpm3qafwqxvcj4j";
+      sha256 = "1vg2chy1cfmdj6c1gryl8zvjhhmb3plwgyh1jfnpq4fnfqv7asrk";
      type = "gem";
    };
-    version = "3.0.0";
+    version = "3.0.1";
  };
  parallel = {
    groups = ["default" "development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1x1gzgjrdlkm1aw0hfpyphsxcx90qgs3y4gmp9km3dvf4hc4qm8r";
+      sha256 = "17b127xxmm2yqdz146qwbs57046kn0js1h8synv01dwqz2z1kp2l";
      type = "gem";
    };
-    version = "1.17.0";
+    version = "1.19.2";
  };
  parser = {
    dependencies = ["ast"];
@ -555,10 +507,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0iirjc36irgwpfb58jdf9gli382cj893y9caqhxas8anpzzlikgc";
+      sha256 = "1f7gmm60yla325wlnd3qkxs59qm2y0aan8ljpg6k18rwzrrfil6z";
      type = "gem";
    };
-    version = "2.7.0.5";
+    version = "2.7.2.0";
  };
  proc_to_ast = {
    dependencies = ["coderay" "parser" "unparser"];
@ -586,23 +538,15 @@
    };
    version = "0.12.2";
  };
-  public_suffix = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "08q64b5br692dd3v0a9wq9q5dvycc6kmiqmjbdxkxbfizggsvx6l";
-      type = "gem";
-    };
-    version = "3.0.3";
-  };
  rack = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "04qa0ry26hxfwkmvhi0fjlvbm8irzg66ahnpx2pp3bl6qbdc0i8w";
+      sha256 = "0i5vs0dph9i5jn8dfc6aqd6njcafmb20rwqngrf759c9cvmyff16";
      type = "gem";
    };
-    version = "2.1.2";
+    version = "2.2.3";
  };
  rack-test = {
    dependencies = ["rack"];
@ -647,12 +591,14 @@
  };
  rbtrace = {
    dependencies = ["ffi" "msgpack" "optimist"];
+    groups = ["default"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1lwsq08i0aj8na5q5ba3gg02sx3wl58fi6m52svl5p7cy56ycdwi";
+      sha256 = "0s8prj0klfgpmpfcpdzbf149qrrsdxgnb6w6kkqc9gyars4vyaqn";
      type = "gem";
    };
-    version = "0.4.11";
+    version = "0.4.14";
  };
  rdoc = {
    groups = ["default"];
@ -674,15 +620,35 @@
    };
    version = "4.1.3";
  };
+  regexp_parser = {
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0n9d14ppshnx71i3mi1pnm3hwhcbb6m6vsc0b0dqgsab8r2rs96n";
+      type = "gem";
+    };
+    version = "1.8.1";
+  };
+  rexml = {
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1mkvkcw9fhpaizrhca0pdgjcrbns48rlz4g6lavl5gjjq3rk2sq3";
+      type = "gem";
+    };
+    version = "3.2.4";
+  };
  rouge = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "102rc07d78k5bkl0s9nd1gw6wz0w0zcvg4g5sl7z9xxi4r793c35";
+      sha256 = "1igl00gk0vaq4xxk44m7yflqdzsblgxlzcxj8saz96bmx7mg7392";
      type = "gem";
    };
-    version = "3.19.0";
+    version = "3.24.0";
  };
  rspec = {
    dependencies = ["rspec-core" "rspec-expectations" "rspec-mocks"];
@ -750,23 +716,36 @@
    version = "3.8.0";
  };
  rubocop = {
-    dependencies = ["jaro_winkler" "parallel" "parser" "rainbow" "ruby-progressbar" "unicode-display_width"];
+    dependencies = ["parallel" "parser" "rainbow" "regexp_parser" "rexml" "rubocop-ast" "ruby-progressbar" "unicode-display_width"];
    groups = ["development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1cmw8ajaiidvrzjcsljh47f4l3lmcazqrzljgalj3szkr8ibkk5i";
+      sha256 = "1jl3ghxw1bpj272s5s3gl07l2rbd1vwr9z9jmlxxaa2faldn9gms";
      type = "gem";
    };
-    version = "0.69.0";
+    version = "0.86.0";
  };
-  ruby-progressbar = {
+  rubocop-ast = {
+    dependencies = ["parser"];
+    groups = ["default" "development" "test"];
+    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1cv2ym3rl09svw8940ny67bav7b2db4ms39i4raaqzkf59jmhglk";
+      sha256 = "1w5rjkwxaxkr2jr1sl5wz0nffal27ik6b1qfzx5skl43vfk2jz97";
      type = "gem";
    };
-    version = "1.10.0";
+    version = "0.2.0";
+  };
+  ruby-progressbar = {
+    groups = ["default" "development" "test"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "1k77i0d4wsn23ggdd2msrcwfy0i376cglfqypkk2q77r2l3408zf";
+      type = "gem";
+    };
+    version = "1.10.1";
  };
  rugged = {
    groups = ["default"];
@ -778,16 +757,6 @@
    };
    version = "0.28.4.1";
  };
-  safe_yaml = {
-    groups = ["default" "development" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0j7qv63p0vqcd838i2iy2f76c3dgwzkiz1d1xkg7n0pbnxj2vb56";
-      type = "gem";
-    };
-    version = "1.0.5";
-  };
  sanitize = {
    dependencies = ["crass" "nokogiri" "nokogumbo"];
    source = {
@ -803,31 +772,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1j9rwbig24ry0smgvmkzdjrzyszniaswipinvflzxzzaz52v7483";
+      sha256 = "17j4br2lpnd8066d50mkg9kwk9v70hn3zfiqkvysd8p9nffmqnm0";
      type = "gem";
    };
-    version = "2.9.0";
-  };
-  simplecov = {
-    dependencies = ["docile" "json" "simplecov-html"];
-    groups = ["development" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1135k46nik05sdab30yxb8264lqiz01c8v000g16cl9pjc4mxrdw";
-      type = "gem";
-    };
-    version = "0.17.1";
-  };
-  simplecov-html = {
-    groups = ["default" "development" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1lihraa4rgxk8wbfl77fy9sf0ypk31iivly8vl3w04srd7i0clzn";
-      type = "gem";
-    };
-    version = "0.10.2";
+    version = "3.0.4";
  };
  stringex = {
    groups = ["default"];
@ -881,10 +829,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "08kfiniak1pvg3gn5k6snpigzvhvhyg7slmm0s2qx5zkj62c1z2w";
+      sha256 = "06i3id27s60141x6fdnjn5rar1cywdwy64ilc59cz937303q3mna";
      type = "gem";
    };
-    version = "1.6.0";
+    version = "1.7.0";
  };
  unparser = {
    dependencies = ["abstract_type" "adamantium" "concord" "diff-lcs" "equalizer" "parser" "procto"];
@ -897,31 +845,14 @@
    };
    version = "0.4.7";
  };
-  vcr = {
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0qh7lkj9b0shph84dw1wsrlaprl0jn1i4339fpsfy99402290zrr";
-      type = "gem";
-    };
-    version = "4.0.0";
-  };
-  webmock = {
-    dependencies = ["addressable" "crack" "hashdiff"];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "03994dxs4xayvkxqp01dd1ivhg4xxx7z35f7cxw7y2mwj3xn24ib";
-      type = "gem";
-    };
-    version = "3.4.2";
-  };
  zeitwerk = {
    groups = ["default" "development" "test"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1akpm3pwvyiack2zk6giv9yn3cqb8pw6g40p4394pdc3xmy3s4k0";
+      sha256 = "0jvn50k76kl14fpymk4hdsf9sk00jl84yxzl783xhnw4dicp0m0k";
      type = "gem";
    };
-    version = "2.3.0";
+    version = "2.4.0";
  };
 }
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/default.nix
@ -2,12 +2,12 @@

 buildGoPackage rec {
  pname = "gitlab-shell";
-  version = "13.2.0";
+  version = "13.13.0";
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-shell";
    rev = "v${version}";
-    sha256 = "0drdpg4nmhzrmy8sl1f3hcd1278bpapgf0wmhi94xlyayh47j53a";
+    sha256 = "1zx7x3g18xzw7fs7cayd20llxabv5r93m2mp6ixgr99ksvi6zix7";
  };

  buildInputs = [ ruby ];
@ -17,6 +17,10 @@ buildGoPackage rec {
  goPackagePath = "gitlab.com/gitlab-org/gitlab-shell";
  goDeps = ./deps.nix;

+  preBuild = ''
+    rm -rf "$NIX_BUILD_TOP/go/src/gitlab.com/gitlab-org/labkit/vendor"
+  '';
+
  postInstall = ''
    cp -r "$NIX_BUILD_TOP/go/src/$goPackagePath"/bin/* $out/bin
    cp -r "$NIX_BUILD_TOP/go/src/$goPackagePath"/{support,VERSION} $out/
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/deps.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/deps.nix
--- a/pkgs/applications/version-management/gitlab/gitlab-shell/remove-hardcoded-locations.patch
+++ b/pkgs/applications/version-management/gitlab/gitlab-shell/remove-hardcoded-locations.patch
@ -1,5 +1,5 @@
 diff --git a/internal/config/config.go b/internal/config/config.go
-index 2231851..c869930 100644
+index 79c2a36..12ba31e 100644
 --- a/internal/config/config.go
 +++ b/internal/config/config.go
@@ -3,7 +3,6 @@ package config
@ -10,7 +10,7 @@ index 2231851..c869930 100644
 	"path"
 	"path/filepath"
 
-@@ -38,16 +37,13 @@ type Config struct {
+@@ -59,16 +58,13 @@ func (c *Config) GetHttpClient() *client.HttpClient {
 }
 
 func New() (*Config, error) {
@ -30,14 +30,14 @@ index 2231851..c869930 100644
 
 func newFromFile(filename string) (*Config, error) {
 diff --git a/internal/keyline/key_line.go b/internal/keyline/key_line.go
-index c29a320..c44b701 100644
+index c6f2422..fb0426b 100644
 --- a/internal/keyline/key_line.go
 +++ b/internal/keyline/key_line.go
-@@ -36,7 +36,7 @@ func NewPrincipalKeyLine(keyId string, principal string, rootDir string) (*KeyLi
+@@ -37,7 +37,7 @@ func NewPrincipalKeyLine(keyId, principal string, config *config.Config) (*KeyLi
 }
 
 func (k *KeyLine) ToString() string {
-	command := fmt.Sprintf("%s %s-%s", path.Join(k.RootDir, executable.BinDir, executable.GitlabShell), k.Prefix, k.Id)
+-	command := fmt.Sprintf("%s %s-%s", path.Join(k.Config.RootDir, executable.BinDir, executable.GitlabShell), k.Prefix, k.Id)
 +	command := fmt.Sprintf("%s %s-%s", path.Join("/run/current-system/sw/bin", executable.GitlabShell), k.Prefix, k.Id)
 
 	return fmt.Sprintf(`command="%s",%s %s`, command, SshOptions, k.Value)
@ -55,3 +55,6 @@ index 52ac5ee..d96baa3 100644
   end
 
   def auth_file
+-- 
+2.28.0
+
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -3,13 +3,13 @@
 buildGoPackage rec {
  pname = "gitlab-workhorse";

-  version = "8.31.2";
+  version = "8.54.0";

  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-workhorse";
    rev = "v${version}";
-    sha256 = "0wvhhjfb490mjdrmc9xwr3qfh3941xn3b02c757ghrvzwv329wvg";
+    sha256 = "0fz00sl9q4d3vbslh7y9nsnhjshgfg0x7mv7b7a9sc3mxmabp7gz";
  };

  goPackagePath = "gitlab.com/gitlab-org/gitlab-workhorse";
@ -17,16 +17,6 @@ buildGoPackage rec {
  buildInputs = [ git ];
  buildFlagsArray = "-ldflags=-X main.Version=${version}";

-  # gitlab-workhorse depends on an older version of labkit which
-  # contains old, vendored versions of some packages; gitlab-workhorse
-  # also explicitly depends on newer versions of these libraries,
-  # but buildGoPackage exposes the vendored versions instead,
-  # leading to compilation errors. Since the vendored libraries
-  # aren't used here anyway, we'll just remove them.
-  postConfigure = ''
-    rm -r "$NIX_BUILD_TOP/go/src/gitlab.com/gitlab-org/labkit/vendor"
-  '';
-
  meta = with stdenv.lib; {
    homepage = "http://www.gitlab.com/";
    platforms = platforms.linux;
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/deps.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/deps.nix
--- a/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
+++ b/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
@ -34,7 +34,7 @@ diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.
 index 0bea8a4f4b..290248547b 100644
 --- a/config/initializers/1_settings.rb
 +++ b/config/initializers/1_settings.rb
-@@ -255,7 +255,7 @@ Settings.gitlab['user']       ||= 'git'
+@@ -177,7 +177,7 @@ Settings.gitlab['ssh_user'] ||= Settings.gitlab['user']
 Settings.gitlab['user_home'] ||= begin
   Etc.getpwnam(Settings.gitlab['user']).dir
                                  rescue ArgumentError # no user configured
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile
@ -1,6 +1,6 @@
 source 'https://rubygems.org'

-gem 'rails', '~> 6.0.3'
+gem 'rails', '~> 6.0.3.1'

 gem 'bootsnap', '~> 1.4.6'

@ -19,15 +19,17 @@ gem 'default_value_for', '~> 3.3.0'
 gem 'pg', '~> 1.1'

 gem 'rugged', '~> 0.28'
-gem 'grape-path-helpers', '~> 1.2'
+gem 'grape-path-helpers', '~> 1.5'

-gem 'faraday', '~> 0.12'
-gem 'marginalia', '~> 1.8.0'
+gem 'faraday', '~> 1.0'
+gem 'marginalia', '~> 1.9.0'

 # Authentication libraries
-gem 'devise', '~> 4.6'
-gem 'doorkeeper', '~> 5.0.3'
-gem 'doorkeeper-openid_connect', '~> 1.6.3'
+gem 'devise', '~> 4.7.2'
+# TODO: verify ARM compile issue on 3.1.13+ version (see https://gitlab.com/gitlab-org/gitlab/-/merge_requests/18828)
+gem 'bcrypt', '3.1.12'
+gem 'doorkeeper', '~> 5.3.0'
+gem 'doorkeeper-openid_connect', '~> 1.7.4'
 gem 'omniauth', '~> 1.8'
 gem 'omniauth-auth0', '~> 2.0.0'
 gem 'omniauth-azure-oauth2', '~> 0.0.9'
@ -41,12 +43,12 @@ gem 'omniauth-oauth2-generic', '~> 0.2.2'
 gem 'omniauth-saml', '~> 1.10'
 gem 'omniauth-shibboleth', '~> 1.3.0'
 gem 'omniauth-twitter', '~> 1.4'
-gem 'omniauth_crowd', '~> 2.2.0'
+gem 'omniauth_crowd', '~> 2.4.0'
 gem 'omniauth-authentiq', '~> 0.3.3'
-gem 'omniauth_openid_connect', '~> 0.3.3'
-gem "omniauth-ultraauth", '~> 0.0.2'
+gem 'omniauth_openid_connect', '~> 0.3.5'
 gem 'omniauth-salesforce', '~> 1.0.5'
-gem 'rack-oauth2', '~> 1.9.3'
+gem 'omniauth-atlassian-oauth2', '~> 0.2.0'
+gem 'rack-oauth2', '~> 1.16.0'
 gem 'jwt', '~> 2.1.0'

 # Kerberos authentication. EE-only
@ -64,13 +66,13 @@ gem 'attr_encrypted', '~> 3.1.0'
 gem 'u2f', '~> 0.2.1'

 # GitLab Pages
-gem 'validates_hostname', '~> 1.0.6'
+gem 'validates_hostname', '~> 1.0.10'
 gem 'rubyzip', '~> 2.0.0', require: 'zip'
 # GitLab Pages letsencrypt support
-gem 'acme-client', '~> 2.0.5'
+gem 'acme-client', '~> 2.0', '>= 2.0.6'

 # Browser detection
-gem 'browser', '~> 2.5'
+gem 'browser', '~> 4.2'

 # GPG
 gem 'gpgme', '~> 2.0.19'
@ -82,19 +84,23 @@ gem 'gitlab_omniauth-ldap', '~> 2.1.1', require: 'omniauth-ldap'
 gem 'net-ldap'

 # API
-gem 'grape', '~> 1.1.0'
+# Locked at Grape v1.4.0 until https://github.com/ruby-grape/grape/pull/2088 is merged
+# Remove config/initializers/grape_patch.rb
+gem 'grape', '= 1.4.0'
 gem 'grape-entity', '~> 0.7.1'
 gem 'rack-cors', '~> 1.0.6', require: 'rack/cors'

 # GraphQL API
-gem 'graphql', '~> 1.10.5'
+gem 'graphql', '~> 1.11.4'
 # NOTE: graphiql-rails v1.5+ doesn't work: https://gitlab.com/gitlab-org/gitlab/issues/31771
 # TODO: remove app/views/graphiql/rails/editors/show.html.erb when https://github.com/rmosolgo/graphiql-rails/pull/71 is released:
 # https://gitlab.com/gitlab-org/gitlab/issues/31747
 gem 'graphiql-rails', '~> 1.4.10'
-gem 'apollo_upload_server', '~> 2.0.0.beta3'
+gem 'apollo_upload_server', '~> 2.0.2'
 gem 'graphql-docs', '~> 1.6.0', group: [:development, :test]
+gem 'graphlient', '~> 0.4.0' # Used by BulkImport feature (group::import)

+gem 'hashie'
 # Disable strong_params so that Mash does not respond to :permitted?
 gem 'hashie-forbidden_attributes'

@ -106,21 +112,22 @@ gem 'hamlit', '~> 2.11.0'

 # Files attachments
 gem 'carrierwave', '~> 1.3'
-gem 'mini_magick'
+gem 'mini_magick', '~> 4.10.1'

 # for backups
 gem 'fog-aws', '~> 3.5'
 # Locked until fog-google resolves https://github.com/fog/fog-google/issues/421.
 # Also see config/initializers/fog_core_patch.rb.
 gem 'fog-core', '= 2.1.0'
-gem 'fog-google', '~> 1.9'
+gem 'fog-google', '~> 1.11'
 gem 'fog-local', '~> 0.6'
 gem 'fog-openstack', '~> 1.0'
 gem 'fog-rackspace', '~> 0.1.1'
 gem 'fog-aliyun', '~> 0.3'
+gem 'gitlab-fog-azure-rm', '~> 1.0', require: false

 # for Google storage
-gem 'google-api-client', '~> 0.23'
+gem 'google-api-client', '~> 0.33'

 # for aws storage
 gem 'unf', '~> 0.1.4'
@ -131,9 +138,11 @@ gem 'seed-fu', '~> 2.3.7'
 # Search
 gem 'elasticsearch-model', '~> 6.1'
 gem 'elasticsearch-rails', '~> 6.1', require: 'elasticsearch/rails/instrumentation'
-gem 'elasticsearch-api',   '~> 6.8'
-gem 'aws-sdk'
-gem 'faraday_middleware-aws-signers-v4'
+gem 'elasticsearch-api',   '~> 6.8.2'
+gem 'aws-sdk-core', '~> 3'
+gem 'aws-sdk-cloudformation', '~> 1'
+gem 'aws-sdk-s3', '~> 1'
+gem 'faraday_middleware-aws-sigv4', '~>0.3.0'

 # Markdown and HTML processing
 gem 'html-pipeline', '~> 2.12'
@ -141,6 +150,7 @@ gem 'deckar01-task_list', '2.3.1'
 gem 'gitlab-markup', '~> 1.7.1'
 gem 'github-markup', '~> 1.7.0', require: 'github/markup'
 gem 'commonmarker', '~> 0.20'
+gem 'kramdown', '~> 2.3.0'
 gem 'RedCloth', '~> 4.3.2'
 gem 'rdoc', '~> 6.1.2'
 gem 'org-ruby', '~> 0.9.12'
@ -149,7 +159,7 @@ gem 'wikicloth', '0.8.1'
 gem 'asciidoctor', '~> 2.0.10'
 gem 'asciidoctor-include-ext', '~> 0.3.1', require: false
 gem 'asciidoctor-plantuml', '~> 0.0.12'
-gem 'rouge', '~> 3.19.0'
+gem 'rouge', '~> 3.25.0'
 gem 'truncato', '~> 0.7.11'
 gem 'bootstrap_form', '~> 4.2.0'
 gem 'nokogiri', '~> 1.10.9'
@ -163,7 +173,9 @@ gem 'diffy', '~> 3.3'
 gem 'diff_match_patch', '~> 0.1.0'

 # Application server
-gem 'rack', '~> 2.0.9'
+gem 'rack', '~> 2.2.3'
+# https://github.com/sharpstone/rack-timeout/blob/master/README.md#rails-apps-manually
+gem 'rack-timeout', '~> 0.5.1', require: 'rack/timeout/base'

 group :unicorn do
  gem 'unicorn', '~> 5.5'
@ -173,7 +185,6 @@ end
 group :puma do
  gem 'gitlab-puma', '~> 4.3.3.gitlab.2', require: false
  gem 'gitlab-puma_worker_killer', '~> 0.1.1.gitlab.1', require: false
-  gem 'rack-timeout', require: false
 end

 # State machine
@ -185,7 +196,7 @@ gem 'acts-as-taggable-on', '~> 6.0'
 # Background jobs
 gem 'sidekiq', '~> 5.2.7'
 gem 'sidekiq-cron', '~> 1.0'
-gem 'redis-namespace', '~> 1.6.0'
+gem 'redis-namespace', '~> 1.7.0'
 gem 'gitlab-sidekiq-fetcher', '0.5.2', require: 'sidekiq-reliable-fetch'

 # Cron Parser
@ -211,7 +222,7 @@ gem 're2', '~> 1.2.0'
 gem 'version_sorter', '~> 2.2.4'

 # Export Ruby Regex to Javascript
-gem 'js_regex', '~> 3.1'
+gem 'js_regex', '~> 3.4'

 # User agent parsing
 gem 'device_detector'
@ -237,22 +248,22 @@ gem 'atlassian-jwt', '~> 0.2.0'
 gem 'flowdock', '~> 0.7'

 # Slack integration
-gem 'slack-messenger', '~> 2.3.3'
+gem 'slack-messenger', '~> 2.3.4'

 # Hangouts Chat integration
 gem 'hangouts-chat', '~> 0.0.5'

 # Asana integration
-gem 'asana', '~> 0.9'
+gem 'asana', '0.10.2'

 # FogBugz integration
 gem 'ruby-fogbugz', '~> 0.2.1'

 # Kubernetes integration
-gem 'kubeclient', '~> 4.6.0'
+gem 'kubeclient', '~> 4.9.1'

 # Sanitize user input
-gem 'sanitize', '~> 4.6'
+gem 'sanitize', '~> 5.2.1'
 gem 'babosa', '~> 1.0.2'

 # Sanitizes SVG input
@ -261,11 +272,8 @@ gem 'loofah', '~> 2.2'
 # Working with license
 gem 'licensee', '~> 8.9'

-# Ace editor
-gem 'ace-rails-ap', '~> 4.1.0'
-
 # Detect and convert string character encoding
-gem 'charlock_holmes', '~> 0.7.5'
+gem 'charlock_holmes', '~> 0.7.7'

 # Detect mime content type from content
 gem 'mimemagic', '~> 0.3.2'
@ -277,11 +285,10 @@ gem 'fast_blank'
 gem 'gitlab-chronic', '~> 0.10.5'
 gem 'gitlab_chronic_duration', '~> 0.10.6.2'

-gem 'webpack-rails', '~> 0.9.10'
 gem 'rack-proxy', '~> 0.6.0'

 gem 'sassc-rails', '~> 2.1.0'
-gem 'uglifier', '~> 2.7.2'
+gem 'terser', '1.0.2'

 gem 'addressable', '~> 2.7'
 gem 'font-awesome-rails', '~> 4.7'
@ -296,19 +303,22 @@ gem "gitlab-license", "~> 1.0"
 gem 'rack-attack', '~> 6.3.0'

 # Sentry integration
-gem 'sentry-raven', '~> 2.9'
+gem 'sentry-raven', '~> 3.0'
+
+# PostgreSQL query parsing
+gem 'gitlab-pg_query', '~> 1.3', require: 'pg_query'

 gem 'premailer-rails', '~> 1.10.3'

 # LabKit: Tracing and Correlation
-gem 'gitlab-labkit', '0.12.0'
+gem 'gitlab-labkit', '0.13.1'

 # I18n
-gem 'ruby_parser', '~> 3.8', require: false
+gem 'ruby_parser', '~> 3.15', require: false
 gem 'rails-i18n', '~> 6.0'
 gem 'gettext_i18n_rails', '~> 1.8.0'
 gem 'gettext_i18n_rails_js', '~> 1.3'
-gem 'gettext', '~> 3.2.2', require: false, group: :development
+gem 'gettext', '~> 3.3', require: false, group: :development

 gem 'batch-loader', '~> 1.4.0'

@ -320,31 +330,29 @@ gem 'snowplow-tracker', '~> 0.6.1'

 # Metrics
 group :metrics do
-  gem 'method_source', '~> 0.8', require: false
+  gem 'method_source', '~> 1.0', require: false

  # Prometheus
-  gem 'prometheus-client-mmap', '~> 0.10.0'
+  gem 'prometheus-client-mmap', '~> 0.12.0'
  gem 'raindrops', '~> 0.18'
 end

 group :development do
  gem 'brakeman', '~> 4.2', require: false
-  gem 'danger', '~> 6.0', require: false
+  gem 'danger', '~> 8.0.6', require: false

  gem 'letter_opener_web', '~> 1.3.4'
-  gem 'rblineprof', '~> 0.3.6', platform: :mri, require: false

  # Better errors handler
-  gem 'better_errors', '~> 2.5.0'
-  gem 'binding_of_caller', '~> 0.8.0'
+  gem 'better_errors', '~> 2.7.1'

  # thin instead webrick
  gem 'thin', '~> 1.7.0'
 end

 group :development, :test do
-  gem 'bullet', '~> 6.0.2', require: !!ENV['ENABLE_BULLET']
-  gem 'pry-byebug', '~> 3.5.1', platform: :mri
+  gem 'bullet', '~> 6.1.0'
+  gem 'pry-byebug', '~> 3.9.0', platform: :mri
  gem 'pry-rails', '~> 0.3.9'

  gem 'awesome_print', require: false
@ -359,23 +367,19 @@ group :development, :test do
  # Generate Fake data
  gem 'ffaker', '~> 2.10'

-  gem 'spring', '~> 2.0.0'
+  gem 'spring', '~> 2.1.0'
  gem 'spring-commands-rspec', '~> 1.0.4'

-  gem 'gitlab-styles', '~> 3.2.0', require: false
-  # Pin these dependencies, otherwise a new rule could break the CI pipelines
-  gem 'rubocop', '~> 0.74.0'
-  gem 'rubocop-performance', '~> 1.4.1'
-  gem 'rubocop-rspec', '~> 1.37.0'
+  gem 'gitlab-styles', '~> 5.1.0', require: false

-  gem 'scss_lint', '~> 0.56.0', require: false
-  gem 'haml_lint', '~> 0.34.0', require: false
-  gem 'simplecov', '~> 0.18.5', require: false
+  gem 'scss_lint', '~> 0.59.0', require: false
+  gem 'haml_lint', '~> 0.36.0', require: false
  gem 'bundler-audit', '~> 0.6.1', require: false

  gem 'benchmark-ips', '~> 2.3.0', require: false

  gem 'knapsack', '~> 1.17'
+  gem 'crystalball', '~> 0.7.0', require: false

  gem 'simple_po_parser', '~> 1.1.2', require: false

@ -384,30 +388,36 @@ group :development, :test do
  gem 'png_quantizator', '~> 0.2.1', require: false

  gem 'parallel', '~> 1.19', require: false
+
+  gem 'rblineprof', '~> 0.3.6', platform: :mri, require: false
+end
+
+group :development, :test, :coverage do
+  gem 'simplecov', '~> 0.18.5', require: false
+  gem 'simplecov-cobertura', '~> 1.3.1', require: false
 end

 # Gems required in omnibus-gitlab pipeline
 group :development, :test, :omnibus do
-  gem 'license_finder', '~> 5.4', require: false
+  gem 'license_finder', '~> 6.0', require: false
 end

 group :test do
  gem 'fuubar', '~> 2.2.0'
  gem 'rspec-retry', '~> 0.6.1'
-  gem 'rspec_profiling', '~> 0.0.5'
+  gem 'rspec_profiling', '~> 0.0.6'
  gem 'rspec-parameterized', require: false

-  gem 'capybara', '~> 3.22.0'
+  gem 'capybara', '~> 3.33.0'
  gem 'capybara-screenshot', '~> 1.0.22'
  gem 'selenium-webdriver', '~> 3.142'

  gem 'shoulda-matchers', '~> 4.0.1', require: false
  gem 'email_spec', '~> 2.2.0'
-  gem 'json-schema', '~> 2.8.0'
-  gem 'webmock', '~> 3.5.1'
+  gem 'webmock', '~> 3.9.1'
  gem 'rails-controller-testing'
  gem 'concurrent-ruby', '~> 1.1'
-  gem 'test-prof', '~> 0.10.0'
+  gem 'test-prof', '~> 0.12.0'
  gem 'rspec_junit_formatter'
  gem 'guard-rspec'

@ -418,7 +428,7 @@ end
 gem 'octokit', '~> 4.15'

 # https://gitlab.com/gitlab-org/gitlab/issues/207207
-gem 'gitlab-mail_room', '~> 0.0.4', require: 'mail_room'
+gem 'gitlab-mail_room', '~> 0.0.7', require: 'mail_room'

 gem 'email_reply_trimmer', '~> 0.1'
 gem 'html2text'
@ -434,7 +444,7 @@ gem 'activerecord-explain-analyze', '~> 0.1', require: false
 gem 'oauth2', '~> 1.4'

 # Health check
-gem 'health_check', '~> 2.6.0'
+gem 'health_check', '~> 3.0'

 # System information
 gem 'vmstat', '~> 2.3.0'
@ -454,11 +464,11 @@ group :ed25519 do
 end

 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 13.0.0.pre.rc1'
+gem 'gitaly', '~> 13.5.0-rc2'

-gem 'grpc', '~> 1.24.0'
+gem 'grpc', '~> 1.30.2'

-gem 'google-protobuf', '~> 3.8.0'
+gem 'google-protobuf', '~> 3.12'

 gem 'toml-rb', '~> 1.0.0'

@ -498,3 +508,13 @@ gem 'valid_email', '~> 0.1'

 # JSON
 gem 'json', '~> 2.3.0'
+gem 'json-schema', '~> 2.8.0'
+gem 'json_schemer', '~> 0.2.12'
+gem 'oj', '~> 3.10.6'
+gem 'multi_json', '~> 1.14.1'
+gem 'yajl-ruby', '~> 1.4.1', require: 'yajl'
+
+gem 'webauthn', '~> 2.3'
+
+# IPAddress utilities
+gem 'ipaddress', '~> 0.8.3'
--- a/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/Gemfile.lock
--- a/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/applications/version-management/gitlab/rubyEnv/gemset.nix
--- a/pkgs/applications/version-management/gitlab/update.py
+++ b/pkgs/applications/version-management/gitlab/update.py
@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -i python3 -p bundix bundler common-updater-scripts nix nix-prefetch-git python3 python3Packages.requests python3Packages.click python3Packages.click-log vgo2nix yarn2nix
+#! nix-shell -i python3 -p bundix bundler common-updater-scripts nix nix-universal-prefetch python3 python3Packages.requests python3Packages.click python3Packages.click-log vgo2nix yarn2nix

 import click
 import click_log
@ -40,9 +40,7 @@ class GitLabRepo:
        return versions

    def get_git_hash(self, rev: str):
-        out = subprocess.check_output(['nix-prefetch-git', self.url, rev])
-        j = json.loads(out)
-        return j['sha256']
+        return subprocess.check_output(['nix-universal-prefetch', 'fetchFromGitLab', '--owner', self.owner, '--repo', self.repo, '--rev', rev]).decode('utf-8').strip()

    @staticmethod
    def rev2version(tag: str) -> str:
@ -117,6 +115,7 @@ def update_data(rev: str):

    with open(data_file_path.as_posix(), 'w') as f:
        json.dump(data, f, indent=2)
+        f.write("\n")


@cli.command('update-rubyenv')
--- a/pkgs/applications/version-management/gitlab/yarnPkgs.nix
+++ b/pkgs/applications/version-management/gitlab/yarnPkgs.nix
--- a/pkgs/applications/version-management/pijul/default.nix
+++ b/pkgs/applications/version-management/pijul/default.nix
@ -15,14 +15,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "pijul";
-  version = "1.0.0-alpha.3";
+  version = "1.0.0-alpha.5";

  src = fetchCrate {
    inherit version pname;
-    sha256 = "0bz38vvzjrplb2mgcypg2p4kq33v6m58yivg15s2ghr7ly9k5ybx";
+    sha256 = "150hm3kim8cszmycbr4rdpy2g3bfhghsya8hnnfkglzi8sprb5d8";
  };

-  cargoSha256 = "0p9djvdjzyjzsn3fyw6f74fix39s3y92246cgzcqhc1qlwwz67rl";
+  cargoSha256 = "0398bwjc2ib32nhbg4gjzwq6zwxql7llq8igl51nyr229m917im6";

  cargoBuildFlags = stdenv.lib.optional gitImportSupport "--features=git";
  LIBCLANG_PATH = "${libclang}/lib";
--- a/pkgs/applications/version-management/sublime-merge/default.nix
+++ b/pkgs/applications/version-management/sublime-merge/default.nix
@ -4,13 +4,13 @@ let
  common = opts: callPackage (import ./common.nix opts);
 in {
  sublime-merge = common {
-    buildVersion = "2032";
-    sha256 = "b782c768383893ba7803c2cffd428b09bec46be8a65e61a5f17964bdcc2aaf7c";
+    buildVersion = "2039";
+    sha256 = "0l82408jli7g6nc267bnnnz0zz015lvpwva5fxj53mval32ii4i8";
  } {};

  sublime-merge-dev = common {
-    buildVersion = "2033";
-    sha256 = "ab937a393eb6ae776a81b30ec5a589ae37763885ba8a91680d5c43e19a01a8fa";
+    buildVersion = "2037";
+    sha256 = "1s0g18l2msmnn6w7f126andh2dygm9l94fxxhsi64v74mkawqg82";
    dev = true;
  } {};
 }
--- a/pkgs/applications/virtualization/containerd/default.nix
+++ b/pkgs/applications/virtualization/containerd/default.nix
@ -1,4 +1,4 @@
-{ lib, fetchFromGitHub, buildGoPackage, btrfs-progs, go-md2man, installShellFiles, utillinux }:
+{ lib, fetchFromGitHub, buildGoPackage, btrfs-progs, go-md2man, installShellFiles, utillinux, nixosTests }:

 with lib;

@ -42,6 +42,8 @@ buildGoPackage rec {
    installManPage man/*.[1-9]
  '';

+  passthru.tests = { inherit (nixosTests) docker; };
+
  meta = {
    homepage = "https://containerd.io/";
    description = "A daemon to control runC";
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@ -4,6 +4,7 @@
 , sqlite, iproute, lvm2, systemd
 , btrfs-progs, iptables, e2fsprogs, xz, utillinux, xfsprogs, git
 , procps, libseccomp
+, nixosTests
 }:

 with lib;
@ -184,6 +185,8 @@ rec {
      installManPage man/*/*.[1-9]
    '';

+    passthru.tests = { inherit (nixosTests) docker; };
+
    meta = {
      homepage = "https://www.docker.com/";
      description = "An open source project to pack, ship and run any application as a lightweight container";
--- a/pkgs/applications/virtualization/runc/default.nix
+++ b/pkgs/applications/virtualization/runc/default.nix
@ -45,7 +45,7 @@ buildGoPackage rec {
    installManPage man/*/*.[1-9]
  '';

-  passthru.tests = { inherit (nixosTests) cri-o podman; };
+  passthru.tests = { inherit (nixosTests) cri-o docker podman; };

  meta = with lib; {
    homepage = "https://github.com/opencontainers/runc";
--- a/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
+++ b/pkgs/build-support/build-fhs-userenv-bubblewrap/default.nix
@ -50,7 +50,7 @@ let
      "ssl/certs"
      "pki"
    ];
-  in concatStringsSep " \\\n  "
+  in concatStringsSep "\n  "
  (map (file: "--ro-bind-try /etc/${file} /etc/${file}") files);

  init = run: writeShellScriptBin "${name}-init" ''
@ -59,21 +59,21 @@ let
  '';

  bwrapCmd = { initArgs ? "" }: ''
-    blacklist="/nix /dev /proc /etc"
-    ro_mounts=""
+    blacklist=(/nix /dev /proc /etc)
+    ro_mounts=()
    for i in ${env}/*; do
      path="/''${i##*/}"
      if [[ $path == '/etc' ]]; then
        continue
      fi
-      ro_mounts="$ro_mounts --ro-bind $i $path"
-      blacklist="$blacklist $path"
+      ro_mounts+=(--ro-bind "$i" "$path")
+      blacklist+=("$path")
    done

    if [[ -d ${env}/etc ]]; then
      for i in ${env}/etc/*; do
        path="/''${i##*/}"
-        ro_mounts="$ro_mounts --ro-bind $i /etc$path"
+        ro_mounts+=(--ro-bind "$i" "/etc$path")
      done
    fi

@ -81,24 +81,27 @@ let
    # loop through all directories in the root
    for dir in /*; do
      # if it is a directory and it is not in the blacklist
-      if [[ -d "$dir" ]] && grep -v "$dir" <<< "$blacklist" >/dev/null; then
+      if [[ -d "$dir" ]] && [[ ! "''${blacklist[@]}" =~ "$dir" ]]; then
        # add it to the mount list
        auto_mounts+=(--bind "$dir" "$dir")
      fi
    done

-    exec ${bubblewrap}/bin/bwrap \
-      --dev-bind /dev /dev \
-      --proc /proc \
-      --chdir "$(pwd)" \
-      --unshare-all \
-      --share-net \
-      --die-with-parent \
-      --ro-bind /nix /nix \
-      ${etcBindFlags} \
-      $ro_mounts \
-      "''${auto_mounts[@]}" \
+    cmd=(
+      ${bubblewrap}/bin/bwrap
+      --dev-bind /dev /dev
+      --proc /proc
+      --chdir "$(pwd)"
+      --unshare-all
+      --share-net
+      --die-with-parent
+      --ro-bind /nix /nix
+      ${etcBindFlags}
+      "''${ro_mounts[@]}"
+      "''${auto_mounts[@]}"
      ${init runScript}/bin/${name}-init ${initArgs}
+    )
+    exec "''${cmd[@]}"
  '';

  bin = writeShellScriptBin name (bwrapCmd { initArgs = ''"$@"''; });
--- a/Show More
+++ b/Show More