Merge master into staging-next

2020-09-03 10:47:14 +02:00 · 2020-09-03 10:47:14 +02:00 · 5f7aecdf91
commit 5f7aecdf91
parent d95a022648 bf007a2c0a
113 changed files with 1385 additions and 920 deletions
--- a/lib/modules.nix
+++ b/lib/modules.nix
@ -613,7 +613,6 @@ rec {
        if tp.name == "option set" || tp.name == "submodule" then
          throw "The option ${showOption loc} uses submodules without a wrapping type, in ${showFiles opt.declarations}."
        else if optionSetIn "attrsOf" then types.attrsOf (types.submodule options)
-        else if optionSetIn "loaOf"   then types.loaOf   (types.submodule options)
        else if optionSetIn "listOf"  then types.listOf  (types.submodule options)
        else if optionSetIn "nullOr"  then types.nullOr  (types.submodule options)
        else tp;
--- a/lib/types.nix
+++ b/lib/types.nix
@ -252,8 +252,8 @@ rec {
      merge = mergeEqualOption;
    };

-    # drop this in the future:
-    list = builtins.trace "`types.list` is deprecated; use `types.listOf` instead" types.listOf;
+    # TODO: drop this in the future:
+    list = builtins.trace "`types.list` has been removed; please use `types.listOf` instead" types.listOf;

    listOf = elemType: mkOptionType rec {
      name = "listOf";
@ -326,110 +326,15 @@ rec {
      functor = (defaultFunctor name) // { wrapped = elemType; };
    };

-    # List or attribute set of ...
-    loaOf = elemType:
-      let
-        convertAllLists = loc: defs:
-          let
-            padWidth = stringLength (toString (length defs));
-            unnamedPrefix = i: "unnamed-" + fixedWidthNumber padWidth i + ".";
-          in
-            imap1 (i: convertIfList loc (unnamedPrefix i)) defs;
-        convertIfList = loc: unnamedPrefix: def:
-          if isList def.value then
-            let
-              padWidth = stringLength (toString (length def.value));
-              unnamed = i: unnamedPrefix + fixedWidthNumber padWidth i;
-              anyString = placeholder "name";
-              nameAttrs = [
-                { path = [ "environment" "etc" ];
-                  name = "target";
-                }
-                { path = [ "containers" anyString "bindMounts" ];
-                  name = "mountPoint";
-                }
-                { path = [ "programs" "ssh" "knownHosts" ];
-                  # hostNames is actually a list so we would need to handle it only when singleton
-                  name = "hostNames";
-                }
-                { path = [ "fileSystems" ];
-                  name = "mountPoint";
-                }
-                { path = [ "boot" "specialFileSystems" ];
-                  name = "mountPoint";
-                }
-                { path = [ "services" "znapzend" "zetup" ];
-                  name = "dataset";
-                }
-                { path = [ "services" "znapzend" "zetup" anyString "destinations" ];
-                  name = "label";
-                }
-                { path = [ "services" "geoclue2" "appConfig" ];
-                  name = "desktopID";
-                }
-              ];
-              matched = let
-                equals = a: b: b == anyString || a == b;
-                fallback = { name = "name"; };
-              in findFirst ({ path, ... }: all (v: v == true) (zipListsWith equals loc path)) fallback nameAttrs;
-              nameAttr = matched.name;
-              nameValueOld = value:
-                if isList value then
-                  if length value > 0 then
-                    "[ " + concatMapStringsSep " " escapeNixString value + " ]"
-                  else
-                    "[ ]"
-                else
-                  escapeNixString value;
-              nameValueNew = value: unnamed:
-                if isList value then
-                  if length value > 0 then
-                    head value
-                  else
-                    unnamed
-                else
-                  value;
-              res =
-                { inherit (def) file;
-                  value = listToAttrs (
-                    imap1 (elemIdx: elem:
-                      { name  = nameValueNew (elem.${nameAttr} or (unnamed elemIdx)) (unnamed elemIdx);
-                        value = elem;
-                      }) def.value);
-                };
-              option = concatStringsSep "." loc;
-              sample = take 3 def.value;
-              more = lib.optionalString (length def.value > 3) "... ";
-              list = concatMapStrings (x: ''{ ${nameAttr} = ${nameValueOld (x.${nameAttr} or "unnamed")}; ...} '') sample;
-              set = concatMapStrings (x: ''${nameValueNew (x.${nameAttr} or "unnamed") "unnamed"} = {...}; '') sample;
-              msg = ''
-                In file ${def.file}
-                a list is being assigned to the option config.${option}.
-                This will soon be an error as type loaOf is deprecated.
-                See https://github.com/NixOS/nixpkgs/pull/63103 for more information.
-                Do
-                  ${option} =
-                    { ${set}${more}}
-                instead of
-                  ${option} =
-                    [ ${list}${more}]
-              '';
-            in
-              lib.warn msg res
-          else
-            def;
-        attrOnly = attrsOf elemType;
-      in mkOptionType rec {
-        name = "loaOf";
-        description = "list or attribute set of ${elemType.description}s";
-        check = x: isList x || isAttrs x;
-        merge = loc: defs: attrOnly.merge loc (convertAllLists loc defs);
-        emptyValue = { value = {}; };
-        getSubOptions = prefix: elemType.getSubOptions (prefix ++ ["<name?>"]);
-        getSubModules = elemType.getSubModules;
-        substSubModules = m: loaOf (elemType.substSubModules m);
-        functor = (defaultFunctor name) // { wrapped = elemType; };
-      };
+    # TODO: drop this in the future:
+    loaOf =
+      let msg =
+        ''
+          `types.loaOf` has been removed and mixing lists with attribute values
+          is no longer possible; please use `types.attrsOf` instead.
+          See https://github.com/NixOS/nixpkgs/issues/1800 for the motivation.
+        '';
+      in builtins.trace msg types.attrsOf;

    # Value of given type but with no merging (i.e. `uniq list`s are not concatenated).
    uniq = elemType: mkOptionType rec {
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -7181,6 +7181,16 @@
    githubId = 3621083;
    name = "Roosembert (Roosemberth) Palacios";
  };
+  rople380 = {
+    name = "rople380";
+    email = "55679162+rople380@users.noreply.github.com";
+    github = "rople380";
+    githubId = 55679162;
+    keys = [{
+      longkeyid = "rsa2048/0x8526B7574A536236";
+      fingerprint = "1401 1B63 393D 16C1 AA9C  C521 8526 B757 4A53 6236";
+    }];
+  };
  royneary = {
    email = "christian@ulrich.earth";
    github = "royneary";
--- a/nixos/doc/manual/administration/boot-problems.xml
+++ b/nixos/doc/manual/administration/boot-problems.xml
@ -58,9 +58,9 @@
      Like <literal>boot.debug1</literal> or
      <literal>boot.debug1devices</literal>, but runs stage1 until all
      filesystems that are mounted during initrd are mounted (see
-      <option><link linkend="opt-fileSystems._name__.neededForBoot">neededForBoot</link></option>
+      <option><link linkend="opt-fileSystems._name_.neededForBoot">neededForBoot</link></option>
      ). As a motivating example, this could be useful if you've forgotten to set
-      <option><link linkend="opt-fileSystems._name__.neededForBoot">neededForBoot</link></option>
+      <option><link linkend="opt-fileSystems._name_.neededForBoot">neededForBoot</link></option>
      on a file system.
     </para>
    </listitem>
--- a/nixos/doc/manual/administration/imperative-containers.xml
+++ b/nixos/doc/manual/administration/imperative-containers.xml
@ -27,7 +27,7 @@
 <screen>
 # nixos-container create foo --config '
  <xref linkend="opt-services.openssh.enable"/> = true;
-  <link linkend="opt-users.users._name__.openssh.authorizedKeys.keys">users.users.root.openssh.authorizedKeys.keys</link> = ["ssh-dss AAAAB3N…"];
+  <link linkend="opt-users.users._name_.openssh.authorizedKeys.keys">users.users.root.openssh.authorizedKeys.keys</link> = ["ssh-dss AAAAB3N…"];
 '
 </screen>
  By default the next free address in the <literal>10.233.0.0/16</literal> subnet will be chosen
--- a/nixos/doc/manual/configuration/file-systems.xml
+++ b/nixos/doc/manual/configuration/file-systems.xml
@ -23,12 +23,12 @@
  <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd-fstab-generator.html">systemd-fstab-generator</link>.
  The filesystem will be mounted automatically unless
  <literal>"noauto"</literal> is present in <link
-  linkend="opt-fileSystems._name__.options">options</link>.
+  linkend="opt-fileSystems._name_.options">options</link>.
  <literal>"noauto"</literal> filesystems can be mounted explicitly using
  <command>systemctl</command> e.g. <command>systemctl start
  data.mount</command>.
  Mount points are created automatically if they don’t already exist. For
-  <option><link linkend="opt-fileSystems._name__.device">device</link></option>,
+  <option><link linkend="opt-fileSystems._name_.device">device</link></option>,
  it’s best to use the topology-independent device aliases in
  <filename>/dev/disk/by-label</filename> and
  <filename>/dev/disk/by-uuid</filename>, as these don’t change if the
@ -36,7 +36,7 @@
 </para>
 <para>
  You can usually omit the file system type
-  (<option><link linkend="opt-fileSystems._name__.fsType">fsType</link></option>),
+  (<option><link linkend="opt-fileSystems._name_.fsType">fsType</link></option>),
  since <command>mount</command> can usually detect the type and load the
  necessary kernel module automatically. However, if the file system is needed
  at early boot (in the initial ramdisk) and is not <literal>ext2</literal>,
@ -49,7 +49,7 @@
   System startup will fail if any of the filesystems fails to mount, dropping
   you to the emergency shell. You can make a mount asynchronous and
   non-critical by adding
-   <literal><link linkend="opt-fileSystems._name__.options">options</link> = [
+   <literal><link linkend="opt-fileSystems._name_.options">options</link> = [
   "nofail" ];</literal>.
  </para>
 </note>
--- a/nixos/doc/manual/configuration/ipv4-config.xml
+++ b/nixos/doc/manual/configuration/ipv4-config.xml
@ -10,7 +10,7 @@
  automatically configure network interfaces. However, you can configure an
  interface manually as follows:
 <programlisting>
-<link linkend="opt-networking.interfaces._name__.ipv4.addresses">networking.interfaces.eth0.ipv4.addresses</link> = [ {
+<link linkend="opt-networking.interfaces._name_.ipv4.addresses">networking.interfaces.eth0.ipv4.addresses</link> = [ {
  address = "192.168.1.2";
  prefixLength = 24;
 } ];
--- a/nixos/doc/manual/configuration/ipv6-config.xml
+++ b/nixos/doc/manual/configuration/ipv6-config.xml
@ -26,7 +26,7 @@
  As with IPv4 networking interfaces are automatically configured via DHCPv6.
  You can configure an interface manually:
 <programlisting>
-<link linkend="opt-networking.interfaces._name__.ipv6.addresses">networking.interfaces.eth0.ipv6.addresses</link> = [ {
+<link linkend="opt-networking.interfaces._name_.ipv6.addresses">networking.interfaces.eth0.ipv6.addresses</link> = [ {
  address = "fe00:aa:bb:cc::2";
  prefixLength = 64;
 } ];
--- a/nixos/doc/manual/configuration/luks-file-systems.xml
+++ b/nixos/doc/manual/configuration/luks-file-systems.xml
@ -30,7 +30,7 @@ Enter passphrase for /dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d: ***
  <filename>/</filename>, add the following to
  <filename>configuration.nix</filename>:
 <programlisting>
-<link linkend="opt-boot.initrd.luks.devices._name__.device">boot.initrd.luks.devices.crypted.device</link> = "/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d";
+<link linkend="opt-boot.initrd.luks.devices._name_.device">boot.initrd.luks.devices.crypted.device</link> = "/dev/disk/by-uuid/3f6b0024-3a44-4fde-a43a-767b872abe5d";
 <xref linkend="opt-fileSystems"/>."/".device = "/dev/mapper/crypted";
 </programlisting>
  Should grub be used as bootloader, and <filename>/boot</filename> is located
@ -60,13 +60,13 @@ Added to key to device /dev/sda2, slot: 2
  To ensure that this file system is decrypted using the FIDO2 compatible key, add the following to <filename>configuration.nix</filename>:
 <programlisting>
 <link linkend="opt-boot.initrd.luks.fido2Support">boot.initrd.luks.fido2Support</link> = true;
-<link linkend="opt-boot.initrd.luks.devices._name__.fido2.credential">boot.initrd.luks.devices."/dev/sda2".fido2.credential</link> = "f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7";
+<link linkend="opt-boot.initrd.luks.devices._name_.fido2.credential">boot.initrd.luks.devices."/dev/sda2".fido2.credential</link> = "f1d00200108b9d6e849a8b388da457688e3dd653b4e53770012d8f28e5d3b269865038c346802f36f3da7278b13ad6a3bb6a1452e24ebeeaa24ba40eef559b1b287d2a2f80b7";
 </programlisting>

  You can also use the FIDO2 passwordless setup, but for security reasons, you might want to enable it only when your device is PIN protected, such as <link xlink:href="https://trezor.io/">Trezor</link>.

 <programlisting>
-<link linkend="opt-boot.initrd.luks.devices._name__.fido2.passwordLess">boot.initrd.luks.devices."/dev/sda2".fido2.passwordLess</link> = true;
+<link linkend="opt-boot.initrd.luks.devices._name_.fido2.passwordLess">boot.initrd.luks.devices."/dev/sda2".fido2.passwordLess</link> = true;
 </programlisting>
  </para>
 </section>
--- a/nixos/doc/manual/configuration/network-manager.xml
+++ b/nixos/doc/manual/configuration/network-manager.xml
@ -19,7 +19,7 @@
  All users that should have permission to change network settings must belong
  to the <code>networkmanager</code> group:
 <programlisting>
-<link linkend="opt-users.users._name__.extraGroups">users.users.alice.extraGroups</link> = [ "networkmanager" ];
+<link linkend="opt-users.users._name_.extraGroups">users.users.alice.extraGroups</link> = [ "networkmanager" ];
 </programlisting>
 </para>

--- a/nixos/doc/manual/configuration/ssh.xml
+++ b/nixos/doc/manual/configuration/ssh.xml
@ -20,7 +20,7 @@
  follows:
 <!-- FIXME: this might not work if the user is unmanaged. -->
 <programlisting>
-<link linkend="opt-users.users._name__.openssh.authorizedKeys.keys">users.users.alice.openssh.authorizedKeys.keys</link> =
+<link linkend="opt-users.users._name_.openssh.authorizedKeys.keys">users.users.alice.openssh.authorizedKeys.keys</link> =
  [ "ssh-dss AAAAB3NzaC1kc3MAAACBAPIkGWVEt4..." ];
 </programlisting>
 </para>
--- a/nixos/doc/manual/configuration/user-mgmt.xml
+++ b/nixos/doc/manual/configuration/user-mgmt.xml
@ -11,11 +11,11 @@
  that a user account named <literal>alice</literal> shall exist:
 <programlisting>
 <xref linkend="opt-users.users"/>.alice = {
-  <link linkend="opt-users.users._name__.isNormalUser">isNormalUser</link> = true;
-  <link linkend="opt-users.users._name__.home">home</link> = "/home/alice";
-  <link linkend="opt-users.users._name__.description">description</link> = "Alice Foobar";
-  <link linkend="opt-users.users._name__.extraGroups">extraGroups</link> = [ "wheel" "networkmanager" ];
-  <link linkend="opt-users.users._name__.openssh.authorizedKeys.keys">openssh.authorizedKeys.keys</link> = [ "ssh-dss AAAAB3Nza... alice@foobar" ];
+  <link linkend="opt-users.users._name_.isNormalUser">isNormalUser</link> = true;
+  <link linkend="opt-users.users._name_.home">home</link> = "/home/alice";
+  <link linkend="opt-users.users._name_.description">description</link> = "Alice Foobar";
+  <link linkend="opt-users.users._name_.extraGroups">extraGroups</link> = [ "wheel" "networkmanager" ];
+  <link linkend="opt-users.users._name_.openssh.authorizedKeys.keys">openssh.authorizedKeys.keys</link> = [ "ssh-dss AAAAB3Nza... alice@foobar" ];
 };
 </programlisting>
  Note that <literal>alice</literal> is a member of the
@ -36,7 +36,7 @@
  account will cease to exist. Also, imperative commands for managing users and
  groups, such as useradd, are no longer available. Passwords may still be
  assigned by setting the user's
-  <link linkend="opt-users.users._name__.hashedPassword">hashedPassword</link>
+  <link linkend="opt-users.users._name_.hashedPassword">hashedPassword</link>
  option. A hashed password can be generated using <command>mkpasswd -m
  sha-512</command> after installing the <literal>mkpasswd</literal> package.
 </para>
--- a/nixos/doc/manual/development/option-types.xml
+++ b/nixos/doc/manual/development/option-types.xml
@ -385,17 +385,6 @@
     </para>
    </listitem>
   </varlistentry>
-   <varlistentry>
-    <term>
-     <varname>types.loaOf</varname> <replaceable>t</replaceable>
-    </term>
-    <listitem>
-     <para>
-      An attribute set or a list of <replaceable>t</replaceable> type. Multiple
-      definitions are merged according to the value.
-     </para>
-    </listitem>
-   </varlistentry>
   <varlistentry>
    <term>
     <varname>types.nullOr</varname> <replaceable>t</replaceable>
--- a/nixos/doc/manual/installation/changing-config.xml
+++ b/nixos/doc/manual/installation/changing-config.xml
@ -78,7 +78,7 @@
  <literal>mutableUsers = false</literal>. Another way is to temporarily add
  the following to your configuration:
 <screen>
-<link linkend="opt-users.users._name__.initialHashedPassword">users.users.your-user.initialHashedPassword</link> = "test";
+<link linkend="opt-users.users._name_.initialHashedPassword">users.users.your-user.initialHashedPassword</link> = "test";
 </screen>
  <emphasis>Important:</emphasis> delete the $hostname.qcow2 file if you have
  started the virtual machine at least once without the right users, otherwise
--- a/nixos/doc/manual/installation/installing-from-other-distro.xml
+++ b/nixos/doc/manual/installation/installing-from-other-distro.xml
@ -211,7 +211,7 @@ nixpkgs https://nixos.org/channels/nixpkgs-unstable</screen>
    use <literal>sudo</literal>)
   </para>
 <programlisting>
-<link linkend="opt-users.users._name__.initialHashedPassword">users.users.root.initialHashedPassword</link> = "";
+<link linkend="opt-users.users._name_.initialHashedPassword">users.users.root.initialHashedPassword</link> = "";
 </programlisting>
  </listitem>
  <listitem>
--- a/nixos/doc/manual/installation/installing.xml
+++ b/nixos/doc/manual/installation/installing.xml
@ -550,7 +550,7 @@ Retype new UNIX password: ***</screen>
  # Note: setting fileSystems is generally not
  # necessary, since nixos-generate-config figures them out
  # automatically in hardware-configuration.nix.
-  #<link linkend="opt-fileSystems._name__.device">fileSystems."/".device</link> = "/dev/disk/by-label/nixos";
+  #<link linkend="opt-fileSystems._name_.device">fileSystems."/".device</link> = "/dev/disk/by-label/nixos";

  # Enable the OpenSSH server.
  services.sshd.enable = true;
--- a/nixos/doc/manual/release-notes/rl-2003.xml
+++ b/nixos/doc/manual/release-notes/rl-2003.xml
@ -796,7 +796,7 @@ users.users.me =
     or any other display manager in NixOS as they all support auto-login. If you used this module specifically
     because it permitted root auto-login you can override the lightdm-autologin pam module like:
 <programlisting>
-<link xlink:href="#opt-security.pam.services._name__.text">security.pam.services.lightdm-autologin.text</link> = lib.mkForce ''
+<link xlink:href="#opt-security.pam.services._name_.text">security.pam.services.lightdm-autologin.text</link> = lib.mkForce ''
    auth     requisite pam_nologin.so
    auth     required  pam_succeed_if.so quiet
    auth     required  pam_permit.so
--- a/nixos/doc/manual/release-notes/rl-2009.xml
+++ b/nixos/doc/manual/release-notes/rl-2009.xml
@ -767,6 +767,16 @@ CREATE ROLE postgres LOGIN SUPERUSER;
     See <link xlink:href="https://github.com/NixOS/nixpkgs/pull/82743#issuecomment-674520472">the PR that changed this</link> for more info.
    </para>
   </listitem>
+   <listitem>
+    <para>
+     For NixOS configuration options, the type <literal>loaOf</literal>, after
+     its initial deprecation in release 20.03, has been removed. In NixOS and
+     Nixpkgs options using this type have been converted to <literal>attrsOf</literal>.
+     For more information on this change have look at these links:
+     <link xlink:href="https://github.com/NixOS/nixpkgs/issues/1800">issue #1800</link>,
+     <link xlink:href="https://github.com/NixOS/nixpkgs/pull/63103">PR #63103</link>.
+    </para>
+   </listitem>
  </itemizedlist>
 </section>

--- a/nixos/lib/make-options-doc/options-to-docbook.xsl
+++ b/nixos/lib/make-options-doc/options-to-docbook.xsl
@ -20,7 +20,7 @@
      <title>Configuration Options</title>
      <variablelist xml:id="configuration-variable-list">
        <xsl:for-each select="attrs">
-          <xsl:variable name="id" select="concat('opt-', str:replace(str:replace(str:replace(str:replace(attr[@name = 'name']/string/@value, '*', '_'), '&lt;', '_'), '>', '_'), '?', '_'))" />
+          <xsl:variable name="id" select="concat('opt-', str:replace(str:replace(str:replace(attr[@name = 'name']/string/@value, '*', '_'), '&lt;', '_'), '>', '_'))" />
          <varlistentry>
            <term xlink:href="#{$id}">
              <xsl:attribute name="xml:id"><xsl:value-of select="$id"/></xsl:attribute>
--- a/nixos/modules/config/krb5/default.nix
+++ b/nixos/modules/config/krb5/default.nix
@ -41,31 +41,30 @@ let
        value)
    else value;

-  mkIndent = depth: concatStrings (builtins.genList (_:  " ") (2 * depth));
+  indent = "  ";

-  mkRelation = name: value: "${name} = ${mkVal { inherit value; }}";
+  mkRelation = name: value:
+    if (isList value) then
+      concatMapStringsSep "\n" (mkRelation name) value
+    else "${name} = ${mkVal value}";

-  mkVal = { value, depth ? 0 }:
+  mkVal = value:
    if (value == true) then "true"
    else if (value == false) then "false"
    else if (isInt value) then (toString value)
-    else if (isList value) then
-      concatMapStringsSep " " mkVal { inherit value depth; }
    else if (isAttrs value) then
-      (concatStringsSep "\n${mkIndent (depth + 1)}"
-        ([ "{" ] ++ (mapAttrsToList
-          (attrName: attrValue: let
-            mappedAttrValue = mkVal {
-              value = attrValue;
-              depth = depth + 1;
-            };
-          in "${attrName} = ${mappedAttrValue}")
-        value))) + "\n${mkIndent depth}}"
+      let configLines = concatLists
+        (map (splitString "\n")
+          (mapAttrsToList mkRelation value));
+      in
+      (concatStringsSep "\n${indent}"
+        ([ "{" ] ++ configLines))
+      + "\n}"
    else value;

  mkMappedAttrsOrString = value: concatMapStringsSep "\n"
    (line: if builtins.stringLength line > 0
-      then "${mkIndent 1}${line}"
+      then "${indent}${line}"
      else line)
    (splitString "\n"
      (if isAttrs value then
@ -114,7 +113,10 @@ in {
          {
            "ATHENA.MIT.EDU" = {
              admin_server = "athena.mit.edu";
-              kdc = "athena.mit.edu";
+              kdc = [
+                "athena01.mit.edu"
+                "athena02.mit.edu"
+              ];
            };
          };
        '';
--- a/nixos/modules/config/users-groups.nix
+++ b/nixos/modules/config/users-groups.nix
@ -463,7 +463,7 @@ in {

    users.users = mkOption {
      default = {};
-      type = with types; loaOf (submodule userOpts);
+      type = with types; attrsOf (submodule userOpts);
      example = {
        alice = {
          uid = 1234;
@ -487,7 +487,7 @@ in {
        { students.gid = 1001;
          hackers = { };
        };
-      type = with types; loaOf (submodule groupOpts);
+      type = with types; attrsOf (submodule groupOpts);
      description = ''
        Additional groups to be created automatically by the system.
      '';
--- a/nixos/modules/installer/cd-dvd/sd-image-raspberrypi4.nix
+++ b/nixos/modules/installer/cd-dvd/sd-image-raspberrypi4.nix
@ -27,7 +27,7 @@
  };

  fileSystems."/boot/firmware" = {
-    # This effectively "renames" the loaOf entry set in sd-image.nix
+    # This effectively "renames" the attrsOf entry set in sd-image.nix
    mountPoint = "/boot";
    neededForBoot = true;
  };
--- a/nixos/modules/installer/tools/nixos-option/nixos-option.cc
+++ b/nixos/modules/installer/tools/nixos-option/nixos-option.cc
@ -224,7 +224,7 @@ bool optionTypeIs(Context & ctx, Value & v, const std::string & soughtType)

 bool isAggregateOptionType(Context & ctx, Value & v)
 {
-    return optionTypeIs(ctx, v, "attrsOf") || optionTypeIs(ctx, v, "listOf") || optionTypeIs(ctx, v, "loaOf");
+    return optionTypeIs(ctx, v, "attrsOf") || optionTypeIs(ctx, v, "listOf");
 }

 MakeError(OptionPathError, EvalError);
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -587,6 +587,7 @@
  ./services/networking/atftpd.nix
  ./services/networking/avahi-daemon.nix
  ./services/networking/babeld.nix
+  ./services/networking/biboumi.nix
  ./services/networking/bind.nix
  ./services/networking/bitcoind.nix
  ./services/networking/autossh.nix
--- a/nixos/modules/programs/environment.nix
+++ b/nixos/modules/programs/environment.nix
@ -33,7 +33,6 @@ in
      { PATH = [ "/bin" ];
        INFOPATH = [ "/info" "/share/info" ];
        KDEDIRS = [ "" ];
-        STRIGI_PLUGIN_PATH = [ "/lib/strigi/" ];
        QT_PLUGIN_PATH = [ "/lib/qt4/plugins" "/lib/kde4/plugins" ];
        QTWEBKIT_PLUGIN_PATH = [ "/lib/mozilla/plugins/" ];
        GTK_PATH = [ "/lib/gtk-2.0" "/lib/gtk-3.0" ];
--- a/nixos/modules/programs/gpaste.nix
+++ b/nixos/modules/programs/gpaste.nix
@ -30,5 +30,7 @@ with lib;
    environment.systemPackages = [ pkgs.gnome3.gpaste ];
    services.dbus.packages = [ pkgs.gnome3.gpaste ];
    systemd.packages = [ pkgs.gnome3.gpaste ];
+    # gnome-control-center crashes in Keyboard Shortcuts pane without the GSettings schemas.
+    services.xserver.desktopManager.gnome3.sessionPath = [ pkgs.gnome3.gpaste ];
  };
 }
--- a/nixos/modules/programs/ssh.nix
+++ b/nixos/modules/programs/ssh.nix
@ -131,7 +131,7 @@ in

      knownHosts = mkOption {
        default = {};
-        type = types.loaOf (types.submodule ({ name, ... }: {
+        type = types.attrsOf (types.submodule ({ name, ... }: {
          options = {
            certAuthority = mkOption {
              type = types.bool;
--- a/nixos/modules/programs/tsm-client.nix
+++ b/nixos/modules/programs/tsm-client.nix
@ -7,7 +7,7 @@ let
  inherit (lib.modules) mkDefault mkIf;
  inherit (lib.options) literalExample mkEnableOption mkOption;
  inherit (lib.strings) concatStringsSep optionalString toLower;
-  inherit (lib.types) addCheck attrsOf lines loaOf nullOr package path port str strMatching submodule;
+  inherit (lib.types) addCheck attrsOf lines nullOr package path port str strMatching submodule;

  # Checks if given list of strings contains unique
  # elements when compared without considering case.
@ -178,7 +178,7 @@ let
      client system-options file "dsm.sys"
    '';
    servers = mkOption {
-      type = loaOf (submodule [ serverOptions ]);
+      type = attrsOf (submodule [ serverOptions ]);
      default = {};
      example.mainTsmServer = {
        server = "tsmserver.company.com";
--- a/nixos/modules/programs/zsh/oh-my-zsh.xml
+++ b/nixos/modules/programs/zsh/oh-my-zsh.xml
@ -73,7 +73,7 @@
 <programlisting>
 { pkgs, ... }:
 {
-  programs.zsh.ohMyZsh.customPkgs = with pkgs; [
+  programs.zsh.ohMyZsh.customPkgs = [
    pkgs.nix-zsh-completions
    # and even more...
  ];
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@ -544,7 +544,7 @@ in

    security.pam.services = mkOption {
      default = [];
-      type = with types; loaOf (submodule pamOpts);
+      type = with types; attrsOf (submodule pamOpts);
      description =
        ''
          This option defines the PAM services.  A service typically
--- a/nixos/modules/services/backup/znapzend.nix
+++ b/nixos/modules/services/backup/znapzend.nix
@ -220,7 +220,7 @@ let
      };

      destinations = mkOption {
-        type = loaOf (destType config);
+        type = attrsOf (destType config);
        description = "Additional destinations.";
        default = {};
        example = literalExample ''
@ -328,7 +328,7 @@ in
      };

      zetup = mkOption {
-        type = loaOf srcType;
+        type = attrsOf srcType;
        description = "Znapzend configuration.";
        default = {};
        example = literalExample ''
--- a/nixos/modules/services/desktops/geoclue2.nix
+++ b/nixos/modules/services/desktops/geoclue2.nix
@ -160,7 +160,7 @@ in
      };

      appConfig = mkOption {
-        type = types.loaOf appConfigModule;
+        type = types.attrsOf appConfigModule;
        default = {};
        example = literalExample ''
          "com.github.app" = {
--- a/nixos/modules/services/hardware/sane_extra_backends/brscan4.nix
+++ b/nixos/modules/services/hardware/sane_extra_backends/brscan4.nix
@ -81,7 +81,7 @@ in
        { office1 = { model = "MFC-7860DW"; ip = "192.168.1.2"; };
          office2 = { model = "MFC-7860DW"; nodename = "BRW0080927AFBCE"; };
        };
-      type = with types; loaOf (submodule netDeviceOpts);
+      type = with types; attrsOf (submodule netDeviceOpts);
      description = ''
        The list of network devices that will be registered against the brscan4
        sane backend.
--- a/nixos/modules/services/networking/biboumi.nix
+++ b/nixos/modules/services/networking/biboumi.nix
@ -0,0 +1,269 @@
+{ config, lib, pkgs, options, ... }:
+with lib;
+let
+  cfg = config.services.biboumi;
+  inherit (config.environment) etc;
+  rootDir = "/run/biboumi/mnt-root";
+  stateDir = "/var/lib/biboumi";
+  settingsFile = pkgs.writeText "biboumi.cfg" (
+    generators.toKeyValue {
+      mkKeyValue = k: v:
+        if v == null then ""
+        else generators.mkKeyValueDefault {} "=" k v;
+    } cfg.settings);
+  need_CAP_NET_BIND_SERVICE = cfg.settings.identd_port != 0 && cfg.settings.identd_port < 1024;
+in
+{
+  options = {
+    services.biboumi = {
+      enable = mkEnableOption "the Biboumi XMPP gateway to IRC";
+
+      settings = mkOption {
+        description = ''
+          See <link xlink:href="https://lab.louiz.org/louiz/biboumi/blob/8.5/doc/biboumi.1.rst">biboumi 8.5</link>
+          for documentation.
+        '';
+        default = {};
+        type = types.submodule {
+          freeformType = with types;
+            (attrsOf (nullOr (oneOf [str int bool]))) // {
+              description = "settings option";
+            };
+          options.admin = mkOption {
+            type = with types; listOf str;
+            default = [];
+            example = ["admin@example.org"];
+            apply = concatStringsSep ":";
+            description = ''
+              The bare JID of the gateway administrator. This JID will have more
+              privileges than other standard users, for example some administration
+              ad-hoc commands will only be available to that JID.
+            '';
+          };
+          options.ca_file = mkOption {
+            type = types.path;
+            default = "/etc/ssl/certs/ca-certificates.crt";
+            description = ''
+              Specifies which file should be used as the list of trusted CA
+              when negociating a TLS session.
+            '';
+          };
+          options.db_name = mkOption {
+            type = with types; either path str;
+            default = "${stateDir}/biboumi.sqlite";
+            description = ''
+              The name of the database to use.
+            '';
+            example = "postgresql://user:secret@localhost";
+          };
+          options.hostname = mkOption {
+            type = types.str;
+            example = "biboumi.example.org";
+            description = ''
+              The hostname served by the XMPP gateway.
+              This domain must be configured in the XMPP server
+              as an external component.
+            '';
+          };
+          options.identd_port = mkOption {
+            type = types.port;
+            default = 113;
+            example = 0;
+            description = ''
+              The TCP port on which to listen for identd queries.
+            '';
+          };
+          options.log_level = mkOption {
+            type = types.ints.between 0 3;
+            default = 1;
+            description = ''
+              Indicate what type of log messages to write in the logs.
+              0 is debug, 1 is info, 2 is warning, 3 is error.
+            '';
+          };
+          options.password = mkOption {
+            type = with types; nullOr str;
+            description = ''
+              The password used to authenticate the XMPP component to your XMPP server.
+              This password must be configured in the XMPP server,
+              associated with the external component on
+              <link linkend="opt-services.biboumi.settings.hostname">hostname</link>.
+
+              Set it to null and use <link linkend="opt-services.biboumi.credentialsFile">credentialsFile</link>
+              if you do not want this password to go into the Nix store.
+            '';
+          };
+          options.persistent_by_default = mkOption {
+            type = types.bool;
+            default = false;
+            description = ''
+              Whether all rooms will be persistent by default:
+              the value of the “persistent” option in the global configuration of each
+              user will be “true”, but the value of each individual room will still
+              default to false. This means that a user just needs to change the global
+              “persistent” configuration option to false in order to override this.
+            '';
+          };
+          options.policy_directory = mkOption {
+            type = types.path;
+            default = "${pkgs.biboumi}/etc/biboumi";
+            description = ''
+              A directory that should contain the policy files,
+              used to customize Botan’s behaviour
+              when negociating the TLS connections with the IRC servers.
+            '';
+          };
+          options.port = mkOption {
+            type = types.port;
+            default = 5347;
+            description = ''
+              The TCP port to use to connect to the local XMPP component.
+            '';
+          };
+          options.realname_customization = mkOption {
+            type = types.bool;
+            default = true;
+            description = ''
+              Whether the users will be able to use
+              the ad-hoc commands that lets them configure
+              their realname and username.
+            '';
+          };
+          options.realname_from_jid = mkOption {
+            type = types.bool;
+            default = false;
+            description = ''
+              Whether the realname and username of each biboumi
+              user will be extracted from their JID.
+              Otherwise they will be set to the nick
+              they used to connect to the IRC server.
+            '';
+          };
+          options.xmpp_server_ip = mkOption {
+            type = types.str;
+            default = "127.0.0.1";
+            description = ''
+              The IP address to connect to the XMPP server on.
+              The connection to the XMPP server is unencrypted,
+              so the biboumi instance and the server should
+              normally be on the same host.
+            '';
+          };
+        };
+      };
+
+      credentialsFile = mkOption {
+        type = types.path;
+        description = ''
+          Path to a configuration file to be merged with the settings.
+          Beware not to surround "=" with spaces when setting biboumi's options in this file.
+          Useful to merge a file which is better kept out of the Nix store
+          because it contains sensible data like
+          <link linkend="opt-services.biboumi.settings.password">password</link>.
+        '';
+        default = "/dev/null";
+        example = "/run/keys/biboumi.cfg";
+      };
+
+      openFirewall = mkEnableOption "opening of the identd port in the firewall";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.firewall = mkIf (cfg.openFirewall && cfg.settings.identd_port != 0)
+      { allowedTCPPorts = [ cfg.settings.identd_port ]; };
+
+    systemd.services.biboumi = {
+      description = "Biboumi, XMPP to IRC gateway";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Type = "notify";
+        # Biboumi supports systemd's watchdog.
+        WatchdogSec = 20;
+        Restart = "always";
+        # Use "+" because credentialsFile may not be accessible to User= or Group=.
+        ExecStartPre = [("+" + pkgs.writeShellScript "biboumi-prestart" ''
+          set -eux
+          cat ${settingsFile} '${cfg.credentialsFile}' |
+          install -m 644 /dev/stdin /run/biboumi/biboumi.cfg
+        '')];
+        ExecStart = "${pkgs.biboumi}/bin/biboumi /run/biboumi/biboumi.cfg";
+        ExecReload = "${pkgs.coreutils}/bin/kill -USR1 $MAINPID";
+        # Firewalls needing opening for output connections can still do that
+        # selectively for biboumi with:
+        # users.users.biboumi.isSystemUser = true;
+        # and, for example:
+        # networking.nftables.ruleset = ''
+        #   add rule inet filter output meta skuid biboumi tcp accept
+        # '';
+        DynamicUser = true;
+        RootDirectory = rootDir;
+        RootDirectoryStartOnly = true;
+        InaccessiblePaths = [ "-+${rootDir}" ];
+        RuntimeDirectory = [ "biboumi" (removePrefix "/run/" rootDir) ];
+        RuntimeDirectoryMode = "700";
+        StateDirectory = "biboumi";
+        StateDirectoryMode = "700";
+        MountAPIVFS = true;
+        UMask = "0066";
+        BindPaths = [
+          stateDir
+          # This is for Type="notify"
+          # See https://github.com/systemd/systemd/issues/3544
+          "/run/systemd/notify"
+          "/run/systemd/journal/socket"
+        ];
+        BindReadOnlyPaths = [
+          builtins.storeDir
+          "/etc"
+        ];
+        # The following options are only for optimizing:
+        # systemd-analyze security biboumi
+        AmbientCapabilities = [ (optionalString need_CAP_NET_BIND_SERVICE "CAP_NET_BIND_SERVICE") ];
+        CapabilityBoundingSet = [ (optionalString need_CAP_NET_BIND_SERVICE "CAP_NET_BIND_SERVICE") ];
+        # ProtectClock= adds DeviceAllow=char-rtc r
+        DeviceAllow = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateNetwork = mkDefault false;
+        PrivateTmp = true;
+        # PrivateUsers=true breaks AmbientCapabilities=CAP_NET_BIND_SERVICE
+        # See https://bugs.archlinux.org/task/65921
+        PrivateUsers = !need_CAP_NET_BIND_SERVICE;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        # AF_UNIX is for /run/systemd/notify
+        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallFilter = [
+          "@system-service"
+          # Groups in @system-service which do not contain a syscall
+          # listed by perf stat -e 'syscalls:sys_enter_*' biboumi biboumi.cfg
+          # in tests, and seem likely not necessary for biboumi.
+          # To run such a perf in ExecStart=, you have to:
+          # - AmbientCapabilities="CAP_SYS_ADMIN"
+          # - mount -o remount,mode=755 /sys/kernel/debug/{,tracing}
+          "~@aio" "~@chown" "~@ipc" "~@keyring" "~@resources" "~@setuid" "~@timer"
+        ];
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+      };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ julm ];
+}
--- a/nixos/modules/services/networking/hylafax/options.nix
+++ b/nixos/modules/services/networking/hylafax/options.nix
@ -3,7 +3,7 @@
 let

  inherit (lib.options) literalExample mkEnableOption mkOption;
-  inherit (lib.types) bool enum int lines loaOf nullOr path str submodule;
+  inherit (lib.types) bool enum int lines attrsOf nullOr path str submodule;
  inherit (lib.modules) mkDefault mkIf mkMerge;

  commonDescr = ''
@ -248,7 +248,7 @@ in
    };

    modems = mkOption {
-      type = loaOf (submodule [ modemConfigOptions ]);
+      type = attrsOf (submodule [ modemConfigOptions ]);
      default = {};
      example.ttyS1 = {
        type = "cirrus";
--- a/nixos/modules/services/networking/nylon.nix
+++ b/nixos/modules/services/networking/nylon.nix
@ -140,7 +140,7 @@ in
    services.nylon = mkOption {
      default = {};
      description = "Collection of named nylon instances";
-      type = with types; loaOf (submodule nylonOpts);
+      type = with types; attrsOf (submodule nylonOpts);
      internal = true;
    };

--- a/nixos/modules/services/networking/prosody.nix
+++ b/nixos/modules/services/networking/prosody.nix
@ -655,7 +655,7 @@ in

        description = "Define the virtual hosts";

-        type = with types; loaOf (submodule vHostOpts);
+        type = with types; attrsOf (submodule vHostOpts);

        example = {
          myhost = {
--- a/nixos/modules/services/networking/prosody.xml
+++ b/nixos/modules/services/networking/prosody.xml
@ -43,10 +43,10 @@ services.prosody = {
  <link linkend="opt-services.prosody.ssl.cert">ssl.cert</link> = "/var/lib/acme/example.org/fullchain.pem";
  <link linkend="opt-services.prosody.ssl.key">ssl.key</link> = "/var/lib/acme/example.org/key.pem";
  <link linkend="opt-services.prosody.virtualHosts">virtualHosts</link>."example.org" = {
-      <link linkend="opt-services.prosody.virtualHosts._name__.enabled">enabled</link> = true;
-      <link linkend="opt-services.prosody.virtualHosts._name__.domain">domain</link> = "example.org";
-      <link linkend="opt-services.prosody.virtualHosts._name__.ssl.cert">ssl.cert</link> = "/var/lib/acme/example.org/fullchain.pem";
-      <link linkend="opt-services.prosody.virtualHosts._name__.ssl.key">ssl.key</link> = "/var/lib/acme/example.org/key.pem";
+      <link linkend="opt-services.prosody.virtualHosts._name_.enabled">enabled</link> = true;
+      <link linkend="opt-services.prosody.virtualHosts._name_.domain">domain</link> = "example.org";
+      <link linkend="opt-services.prosody.virtualHosts._name_.ssl.cert">ssl.cert</link> = "/var/lib/acme/example.org/fullchain.pem";
+      <link linkend="opt-services.prosody.virtualHosts._name_.ssl.key">ssl.key</link> = "/var/lib/acme/example.org/key.pem";
  };
  <link linkend="opt-services.prosody.muc">muc</link> = [ {
      <link linkend="opt-services.prosody.muc">domain</link> = "conference.example.org";
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@ -361,7 +361,7 @@ in
    };

    users.users = mkOption {
-      type = with types; loaOf (submodule userOptions);
+      type = with types; attrsOf (submodule userOptions);
    };

  };
--- a/nixos/modules/services/security/tor.nix
+++ b/nixos/modules/services/security/tor.nix
@ -607,7 +607,7 @@ in
            ];
          }
        '';
-        type = types.loaOf (types.submodule ({name, ...}: {
+        type = types.attrsOf (types.submodule ({name, ...}: {
          options = {

             name = mkOption {
--- a/nixos/modules/system/boot/luksroot.nix
+++ b/nixos/modules/system/boot/luksroot.nix
@ -516,7 +516,7 @@ in
        <filename>/dev/mapper/<replaceable>name</replaceable></filename>.
      '';

-      type = with types; loaOf (submodule (
+      type = with types; attrsOf (submodule (
        { name, ... }: { options = {

          name = mkOption {
--- a/nixos/modules/system/boot/stage-1.nix
+++ b/nixos/modules/system/boot/stage-1.nix
@ -558,7 +558,7 @@ in
      };

    fileSystems = mkOption {
-      type = with lib.types; loaOf (submodule {
+      type = with lib.types; attrsOf (submodule {
        options.neededForBoot = mkOption {
          default = false;
          type = types.bool;
--- a/nixos/modules/system/etc/etc.nix
+++ b/nixos/modules/system/etc/etc.nix
@ -46,7 +46,7 @@ in
        Set of files that have to be linked in <filename>/etc</filename>.
      '';

-      type = with types; loaOf (submodule (
+      type = with types; attrsOf (submodule (
        { name, config, ... }:
        { options = {

--- a/nixos/modules/tasks/encrypted-devices.nix
+++ b/nixos/modules/tasks/encrypted-devices.nix
@ -54,7 +54,7 @@ in

  options = {
    fileSystems = mkOption {
-      type = with lib.types; loaOf (submodule encryptedFSOptions);
+      type = with lib.types; attrsOf (submodule encryptedFSOptions);
    };
    swapDevices = mkOption {
      type = with lib.types; listOf (submodule encryptedFSOptions);
--- a/nixos/modules/tasks/filesystems.nix
+++ b/nixos/modules/tasks/filesystems.nix
@ -159,7 +159,7 @@ in
          "/bigdisk".label = "bigdisk";
        }
      '';
-      type = types.loaOf (types.submodule [coreFileSystemOpts fileSystemOpts]);
+      type = types.attrsOf (types.submodule [coreFileSystemOpts fileSystemOpts]);
      description = ''
        The file systems to be mounted.  It must include an entry for
        the root directory (<literal>mountPoint = "/"</literal>).  Each
@ -193,7 +193,7 @@ in

    boot.specialFileSystems = mkOption {
      default = {};
-      type = types.loaOf (types.submodule coreFileSystemOpts);
+      type = types.attrsOf (types.submodule coreFileSystemOpts);
      internal = true;
      description = ''
        Special filesystems that are mounted very early during boot.
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@ -519,7 +519,7 @@ in
        <option>networking.useDHCP</option> is true, then every
        interface not listed here will be configured using DHCP.
      '';
-      type = with types; loaOf (submodule interfaceOpts);
+      type = with types; attrsOf (submodule interfaceOpts);
    };

    networking.vswitches = mkOption {
@ -544,7 +544,7 @@ in
          interfaces = mkOption {
            example = [ "eth0" "eth1" ];
            description = "The physical network interfaces connected by the vSwitch.";
-            type = with types; loaOf (submodule vswitchInterfaceOpts);
+            type = with types; attrsOf (submodule vswitchInterfaceOpts);
          };

          controllers = mkOption {
--- a/nixos/modules/virtualisation/containers.nix
+++ b/nixos/modules/virtualisation/containers.nix
@ -43,6 +43,12 @@ in
        '';
      };

+    ociSeccompBpfHook.enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable the OCI seccomp BPF hook";
+    };
+
    containersConf = mkOption {
      default = {};
      description = "containers.conf configuration";
@ -116,6 +122,12 @@ in
      [network]
      cni_plugin_dirs = ["${pkgs.cni-plugins}/bin/"]

+      ${lib.optionalString (cfg.ociSeccompBpfHook.enable == true) ''
+      [engine]
+      hooks_dir = [
+        "${config.boot.kernelPackages.oci-seccomp-bpf-hook}",
+      ]
+      ''}
    '' + cfg.containersConf.extraConfig;

    environment.etc."containers/registries.conf".source = toTOML "registries.conf" {
--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@ -627,7 +627,7 @@ in
 		    };

            bindMounts = mkOption {
-              type = with types; loaOf (submodule bindMountOpts);
+              type = with types; attrsOf (submodule bindMountOpts);
              default = {};
              example = literalExample ''
                { "/home" = { hostPath = "/home/alice";
--- a/nixos/modules/virtualisation/railcar.nix
+++ b/nixos/modules/virtualisation/railcar.nix
@ -41,7 +41,7 @@ let
        description = "Source for the in-container mount";
      };
      options = mkOption {
-        type = loaOf (str);
+        type = attrsOf (str);
        default = [ "bind" ];
        description = ''
          Mount options of the filesystem to be used.
@ -61,7 +61,7 @@ in
    containers = mkOption {
      default = {};
      description = "Declarative container configuration";
-      type = with types; loaOf (submodule ({ name, config, ... }: {
+      type = with types; attrsOf (submodule ({ name, config, ... }: {
        options = {
          cmd = mkOption {
            type = types.lines;
--- a/nixos/tests/krb5/example-config.nix
+++ b/nixos/tests/krb5/example-config.nix
@ -18,7 +18,10 @@ import ../make-test-python.nix ({ pkgs, ...} : {
        realms = {
          "ATHENA.MIT.EDU" = {
            admin_server = "athena.mit.edu";
-            kdc = "athena.mit.edu";
+            kdc = [
+              "athena01.mit.edu"
+              "athena02.mit.edu"
+            ];
          };
        };
        domain_realm = {
@ -65,7 +68,8 @@ import ../make-test-python.nix ({ pkgs, ...} : {
      [realms]
        ATHENA.MIT.EDU = {
          admin_server = athena.mit.edu
-          kdc = athena.mit.edu
+          kdc = athena01.mit.edu
+          kdc = athena02.mit.edu
        }

      [domain_realm]
--- a/pkgs/applications/misc/dbeaver/default.nix
+++ b/pkgs/applications/misc/dbeaver/default.nix
@ -7,7 +7,7 @@

 stdenv.mkDerivation rec {
  pname = "dbeaver-ce";
-  version = "7.1.5";
+  version = "7.2.0";

  desktopItem = makeDesktopItem {
    name = "dbeaver";
@ -30,7 +30,7 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://dbeaver.io/files/${version}/dbeaver-ce-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "14pdkg9xxnldr7qwpb61hp2dgsd5h9scjn59ajqsqn4f4sgcpba0";
+    sha256 = "0zpxsdzhn5fsrlq04v5kvkrgf4dsj5zmpypj9awsd2mjcbp6yxd7";
  };

  installPhase = ''
--- a/pkgs/applications/misc/etesync-dav/default.nix
+++ b/pkgs/applications/misc/etesync-dav/default.nix
@ -9,6 +9,10 @@ python3Packages.buildPythonApplication rec {
    sha256 = "1q8h89hqi4kxphn1g5nbcia0haz5k57is9rycwaabm55mj9s9fah";
  };

+  postPatch = ''
+    substituteInPlace setup.py --replace "Radicale==" "Radicale>="
+  '';
+
  propagatedBuildInputs = with python3Packages; [
    etesync
    flask
--- a/pkgs/applications/misc/qcad/application-dir.patch
+++ b/pkgs/applications/misc/qcad/application-dir.patch
@ -33,3 +33,16 @@ index c6c31cbf5..c51b59ce6 100644
 }
 
 int RSettings::getSnapRange() {
+diff --git a/qcad.desktop b/qcad.desktop
+index 93c5e9720..2d0e6bf32 100644
+--- a/qcad.desktop
+++ b/qcad.desktop
+@@ -48,7 +48,7 @@ Comment[sv]=2D CAD-system
+ Comment[sl]=Sistem 2D CAD
+ Comment[uk]=2D САПР
+ Comment[tr]=2D CAD Sistemi
+-Exec=qcad %F
+Exec=qcad-bin %F
+ X-MultipleArgs=true
+ Icon=qcad_icon
+ Terminal=false
--- a/pkgs/applications/misc/qcad/default.nix
+++ b/pkgs/applications/misc/qcad/default.nix
@ -11,13 +11,13 @@

 mkDerivationWith stdenv.mkDerivation rec {
  pname = "qcad";
-  version = "3.24.3.10";
+  version = "3.25.0.0";

  src = fetchFromGitHub {
    owner = "qcad";
    repo = "qcad";
    rev = "v${version}";
-    sha256 = "0izyn4y1ffq1mgxs5dymkrqih6n6v9ifrcpyk1z2vyhbm5xx4qsa";
+    sha256 = "07qph2645m1wi9yi04ixdvx8dli03q1vimj3laqdmnpipi54lljc";
  };

  patches = [
@ -25,11 +25,13 @@ mkDerivationWith stdenv.mkDerivation rec {
  ];

  postPatch = ''
-    mkdir src/3rdparty/qt-labs-qtscriptgenerator-${qt5.qtbase.version}
-    cp \
-      src/3rdparty/qt-labs-qtscriptgenerator-5.12.3/qt-labs-qtscriptgenerator-5.12.3.pro \
-      src/3rdparty/qt-labs-qtscriptgenerator-${qt5.qtbase.version}/qt-labs-qtscriptgenerator-${qt5.qtbase.version}.pro
-  '';
+    if ! [ -d src/3rdparty/qt-labs-qtscriptgenerator-${qt5.qtbase.version} ]; then
+      mkdir src/3rdparty/qt-labs-qtscriptgenerator-${qt5.qtbase.version}
+      cp \
+        src/3rdparty/qt-labs-qtscriptgenerator-5.14.0/qt-labs-qtscriptgenerator-5.14.0.pro \
+        src/3rdparty/qt-labs-qtscriptgenerator-${qt5.qtbase.version}/qt-labs-qtscriptgenerator-${qt5.qtbase.version}.pro
+    fi
+ '';

  qmakeFlags = [
    "MUPARSER_DIR=${muparser}"
--- a/pkgs/applications/misc/zettlr/default.nix
+++ b/pkgs/applications/misc/zettlr/default.nix
@ -0,0 +1,38 @@
+{ appimageTools, lib, fetchurl, gtk3, gsettings-desktop-schemas}:
+
+# Based on https://gist.github.com/msteen/96cb7df66a359b827497c5269ccbbf94 and joplin-desktop nixpkgs.
+let
+  pname = "zettlr";
+  version = "1.7.5";
+  name = "${pname}-${version}";
+  src = fetchurl {
+    url = "https://github.com/Zettlr/Zettlr/releases/download/v${version}/Zettlr-${version}-x86_64.appimage";
+    sha256 = "040lx01ywdpla34d4abkmh51kchr11s17la6fk6yq77y8zb87xzi";
+  };
+  appimageContents = appimageTools.extractType2 {
+    inherit name src;
+  };
+in appimageTools.wrapType2 rec {
+  inherit name src;
+
+  profile = ''
+    export XDG_DATA_DIRS=${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}:${gtk3}/share/gsettings-schemas/${gtk3.name}:$XDG_DATA_DIRS
+  '';
+
+  multiPkgs = null; # no 32bit needed
+  extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
+  extraInstallCommands = ''
+    mv $out/bin/{${name},${pname}}
+    install -m 444 -D ${appimageContents}/zettlr.desktop $out/share/applications/zettlr.desktop
+    install -m 444 -D ${appimageContents}/zettlr.png $out/share/icons/hicolor/512x512/apps/zettlr.png
+    substituteInPlace $out/share/applications/zettlr.desktop --replace 'Exec=AppRun' 'Exec=${pname}'
+  '';
+
+  meta = with lib; {
+    description = "A markdown editor for writing academic texts and taking notes";
+    homepage = "https://www.zettlr.com";
+    platforms = [ "x86_64-linux" ];
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ tfmoraes ];
+  };
+}
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -132,8 +132,8 @@ in rec {
  });

  terraform_0_13 = pluggable (generic {
-    version = "0.13.1";
-    sha256 = "0a2sjjb79ziv42ifhplpkvqgsg8gxvr1wdgkhdj59dwahqv64pm2";
+    version = "0.13.2";
+    sha256 = "04pm57l29j3ai6dvh2343q4yhskkxqj8ayr2hdw2qqjch52p8mrw";
    patches = [ ./provider-path.patch ];
    passthru = { inherit plugins; };
  });
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop-package.json
@ -2,7 +2,7 @@
  "name": "element-desktop",
  "productName": "Element",
  "main": "src/electron-main.js",
-  "version": "1.7.4",
+  "version": "1.7.5",
  "description": "A feature-rich client for Matrix.org",
  "author": "Element",
  "repository": {
--- a/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-desktop.nix
@ -8,12 +8,12 @@

 let
  executableName = "element-desktop";
-  version = "1.7.4";
+  version = "1.7.5";
  src = fetchFromGitHub {
    owner = "vector-im";
    repo = "riot-desktop";
    rev = "v${version}";
-    sha256 = "16ilkf5b8mz74x1r9fym5xjb4plxzhg3g5njj1sl4qvsbrkk6r9a";
+    sha256 = "0781yg15bzkw5bpfzbdkqix239djgsc7kjdvbilv1d1xxqz3462y";
  };
  electron = electron_9;

--- a/pkgs/applications/networking/instant-messengers/element/element-web.nix
+++ b/pkgs/applications/networking/instant-messengers/element/element-web.nix
@ -12,11 +12,11 @@ let

 in stdenv.mkDerivation rec {
  pname = "element-web";
-  version = "1.7.4";
+  version = "1.7.5";

  src = fetchurl {
    url = "https://github.com/vector-im/riot-web/releases/download/v${version}/riot-v${version}.tar.gz";
-    sha256 = "0ssyd5b9yrxidivr3rcjsd8ixkmppsmmr7a8k0sv16yk7hjnvz5b";
+    sha256 = "07qc4hymdp1r2zn9gsgkpwxf6knk6xr88dc3iihlhipmlk46m58b";
  };

  installPhase = ''
--- a/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pantalaimon/default.nix
@ -10,7 +10,7 @@

 buildPythonApplication rec {
  pname = "pantalaimon";
-  version = "0.6.5";
+  version = "0.7.0";

  disabled = pythonOlder "3.6";

@ -19,7 +19,7 @@ buildPythonApplication rec {
    owner = "matrix-org";
    repo = pname;
    rev = version;
-    sha256 = "1pjrq71fkpvsc79nwhxhwjkqvqhj5wsnnwvsgslghaajdaw3n6wd";
+    sha256 = "0cx8sqajf5lh8w61yy1l6ry67rv1b45xp264zkw3s7ip80i4ylb2";
  };

  propagatedBuildInputs = [
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@ -25,7 +25,7 @@ let
      else "");
 in stdenv.mkDerivation rec {
  pname = "signal-desktop";
-  version = "1.34.5"; # Please backport all updates to the stable channel.
+  version = "1.35.1"; # Please backport all updates to the stable channel.
  # All releases have a limited lifetime and "expire" 90 days after the release.
  # When releases "expire" the application becomes unusable until an update is
  # applied. The expiration date for the current release can be extracted with:
@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "1s8nksrkfivsf9r460ifxsf8l7bnc1zix5yj39kvnx0mbync8lg1";
+    sha256 = "1nxj7h8yrp2sbxxd49q9xdh1zsqixcd01i83lr492f4322cg1yjf";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/office/libreoffice/default.nix
+++ b/pkgs/applications/office/libreoffice/default.nix
@ -61,15 +61,12 @@ in (mkDrv rec {
  # of rasqal/rasqal.h
  NIX_CFLAGS_COMPILE = [
    "-I${librdf_rasqal}/include/rasqal"
-  ] ++ lib.optional stdenv.isx86_64 "-mno-fma";
+  ] ++ lib.optionals stdenv.isx86_64 [ "-mno-fma" "-mno-avx" ]
+  # https://bugs.documentfoundation.org/show_bug.cgi?id=78174#c10
+  ++ [ "-fno-visibility-inlines-hidden" ];

  patches = [
    ./xdg-open-brief.patch
-    (fetchpatch {
-      url = "https://git.pld-linux.org/gitweb.cgi?p=packages/libreoffice.git;a=blob_plain;f=poppler-0.86.patch;h=76b8356d5f22ef537a83b0f9b0debab591f152fe;hb=a2737a61353e305a9ee69640fb20d4582c218008";
-      name = "poppler-0.86.patch";
-      sha256 = "0q6k4l8imgp8ailcv0qx5l83afyw44hah24fi7gjrm9xgv5sbb8j";
-    })
  ];

  tarballPath = "external/tarballs";
--- a/pkgs/applications/office/libreoffice/src-fresh/download.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/download.nix
@ -28,11 +28,11 @@
    md5name = "976a12a59bc286d634a21d7be0841cc74289ea9077aa1af46be19d1a6e844c19-apr-util-1.5.4.tar.gz";
  }
  {
-    name = "boost_1_69_0.tar.bz2";
-    url = "http://dev-www.libreoffice.org/src/boost_1_69_0.tar.bz2";
-    sha256 = "8f32d4617390d1c2d16f26a27ab60d97807b35440d45891fa340fc2648b04406";
+    name = "boost_1_71_0.tar.xz";
+    url = "http://dev-www.libreoffice.org/src/boost_1_71_0.tar.xz";
+    sha256 = "35e06a3bd7cd8f66be822c7d64e80c2b6051a181e9e897006917cb8e7988a543";
    md5 = "";
-    md5name = "8f32d4617390d1c2d16f26a27ab60d97807b35440d45891fa340fc2648b04406-boost_1_69_0.tar.bz2";
+    md5name = "35e06a3bd7cd8f66be822c7d64e80c2b6051a181e9e897006917cb8e7988a543-boost_1_71_0.tar.xz";
  }
  {
    name = "breakpad.zip";
@ -63,11 +63,11 @@
    md5name = "5e7b29b3f113ef870d1e3ecf8adf21f923396401604bda16d44be45e66052331-cairo-1.16.0.tar.xz";
  }
  {
-    name = "libcdr-0.1.5.tar.xz";
-    url = "http://dev-www.libreoffice.org/src/libcdr-0.1.5.tar.xz";
-    sha256 = "6ace5c499a8be34ad871e825442ce388614ae2d8675c4381756a7319429e3a48";
+    name = "libcdr-0.1.6.tar.xz";
+    url = "http://dev-www.libreoffice.org/src/libcdr-0.1.6.tar.xz";
+    sha256 = "01cd00b04a030977e544433c2d127c997205332cd9b8e35ec0ee17110da7f861";
    md5 = "";
-    md5name = "6ace5c499a8be34ad871e825442ce388614ae2d8675c4381756a7319429e3a48-libcdr-0.1.5.tar.xz";
+    md5name = "01cd00b04a030977e544433c2d127c997205332cd9b8e35ec0ee17110da7f861-libcdr-0.1.6.tar.xz";
  }
  {
    name = "clucene-core-2.3.3.4.tar.gz";
@ -76,6 +76,13 @@
    md5 = "48d647fbd8ef8889e5a7f422c1bfda94";
    md5name = "48d647fbd8ef8889e5a7f422c1bfda94-clucene-core-2.3.3.4.tar.gz";
  }
+  {
+    name = "dtoa-20180411.tgz";
+    url = "http://dev-www.libreoffice.org/src/dtoa-20180411.tgz";
+    sha256 = "0082d0684f7db6f62361b76c4b7faba19e0c7ce5cb8e36c4b65fea8281e711b4";
+    md5 = "";
+    md5name = "0082d0684f7db6f62361b76c4b7faba19e0c7ce5cb8e36c4b65fea8281e711b4-dtoa-20180411.tgz";
+  }
  {
    name = "libcmis-0.5.2.tar.xz";
    url = "http://dev-www.libreoffice.org/src/libcmis-0.5.2.tar.xz";
@ -91,11 +98,11 @@
    md5name = "86c798780b9e1f5921fe4efe651a93cb420623b45aa1fdff57af8c37f116113f-CoinMP-1.7.6.tgz";
  }
  {
-    name = "cppunit-1.14.0.tar.gz";
-    url = "http://dev-www.libreoffice.org/src/cppunit-1.14.0.tar.gz";
-    sha256 = "3d569869d27b48860210c758c4f313082103a5e58219a7669b52bfd29d674780";
+    name = "cppunit-1.15.1.tar.gz";
+    url = "http://dev-www.libreoffice.org/src/cppunit-1.15.1.tar.gz";
+    sha256 = "89c5c6665337f56fd2db36bc3805a5619709d51fb136e51937072f63fcc717a7";
    md5 = "";
-    md5name = "3d569869d27b48860210c758c4f313082103a5e58219a7669b52bfd29d674780-cppunit-1.14.0.tar.gz";
+    md5name = "89c5c6665337f56fd2db36bc3805a5619709d51fb136e51937072f63fcc717a7-cppunit-1.15.1.tar.gz";
  }
  {
    name = "converttexttonumber-1-5-0.oxt";
@ -105,11 +112,11 @@
    md5name = "1f467e5bb703f12cbbb09d5cf67ecf4a-converttexttonumber-1-5-0.oxt";
  }
  {
-    name = "curl-7.65.0.tar.xz";
-    url = "http://dev-www.libreoffice.org/src/curl-7.65.0.tar.xz";
-    sha256 = "7766d263929404f693905b5e5222aa0f2bdf8c66ab4b8758f0c0820a42b966cd";
+    name = "curl-7.71.0.tar.xz";
+    url = "http://dev-www.libreoffice.org/src/curl-7.71.0.tar.xz";
+    sha256 = "cdf18794393d8bead915312708a9e5d819c6e9919de14b20d5c8e7987abd9772";
    md5 = "";
-    md5name = "7766d263929404f693905b5e5222aa0f2bdf8c66ab4b8758f0c0820a42b966cd-curl-7.65.0.tar.xz";
+    md5name = "cdf18794393d8bead915312708a9e5d819c6e9919de14b20d5c8e7987abd9772-curl-7.71.0.tar.xz";
  }
  {
    name = "libe-book-0.1.3.tar.xz";
@ -161,11 +168,11 @@
    md5name = "6994be3555e23226630c587444be19d309b25b0fcf1f87df3b4e3f88943e5860-Firebird-3.0.0.32483-0.tar.bz2";
  }
  {
-    name = "fontconfig-2.12.6.tar.bz2";
-    url = "http://dev-www.libreoffice.org/src/fontconfig-2.12.6.tar.bz2";
-    sha256 = "cf0c30807d08f6a28ab46c61b8dbd55c97d2f292cf88f3a07d3384687f31f017";
+    name = "fontconfig-2.13.91.tar.gz";
+    url = "http://dev-www.libreoffice.org/src/fontconfig-2.13.91.tar.gz";
+    sha256 = "19e5b1bc9d013a52063a44e1307629711f0bfef35b9aca16f9c793971e2eb1e5";
    md5 = "";
-    md5name = "cf0c30807d08f6a28ab46c61b8dbd55c97d2f292cf88f3a07d3384687f31f017-fontconfig-2.12.6.tar.bz2";
+    md5name = "19e5b1bc9d013a52063a44e1307629711f0bfef35b9aca16f9c793971e2eb1e5-fontconfig-2.13.91.tar.gz";
  }
  {
    name = "crosextrafonts-20130214.tar.gz";
@ -315,11 +322,11 @@
    md5name = "db8d87ea720ea9d5edc5388fc7a0497bb11ba9fe972245e0f7f4c7e8b1e1e84d-freetype-2.9.1.tar.bz2";
  }
  {
-    name = "glm-0.9.4.6-libreoffice.zip";
-    url = "http://dev-www.libreoffice.org/src/bae83fa5dc7f081768daace6e199adc3-glm-0.9.4.6-libreoffice.zip";
-    sha256 = "d0312c360efe04dd048b3311fe375ff36f1993b4c2e3cb58c81062990532904a";
-    md5 = "bae83fa5dc7f081768daace6e199adc3";
-    md5name = "bae83fa5dc7f081768daace6e199adc3-glm-0.9.4.6-libreoffice.zip";
+    name = "glm-0.9.9.7.zip";
+    url = "http://dev-www.libreoffice.org/src/glm-0.9.9.7.zip";
+    sha256 = "c5e167c042afd2d7ad642ace6b643863baeb33880781983563e1ab68a30d3e95";
+    md5 = "";
+    md5name = "c5e167c042afd2d7ad642ace6b643863baeb33880781983563e1ab68a30d3e95-glm-0.9.9.7.zip";
  }
  {
    name = "gpgme-1.9.0.tar.bz2";
@ -329,11 +336,11 @@
    md5name = "1b29fedb8bfad775e70eafac5b0590621683b2d9869db994568e6401f4034ceb-gpgme-1.9.0.tar.bz2";
  }
  {
-    name = "graphite2-minimal-1.3.13.tgz";
-    url = "http://dev-www.libreoffice.org/src/graphite2-minimal-1.3.13.tgz";
-    sha256 = "d47d387161db7f7ebade1920aa7cbdc797e79772597d8b55e80b58d1071bcc36";
+    name = "graphite2-minimal-1.3.14.tgz";
+    url = "http://dev-www.libreoffice.org/src/graphite2-minimal-1.3.14.tgz";
+    sha256 = "b8e892d8627c41888ff121e921455b9e2d26836978f2359173d19825da62b8fc";
    md5 = "";
-    md5name = "d47d387161db7f7ebade1920aa7cbdc797e79772597d8b55e80b58d1071bcc36-graphite2-minimal-1.3.13.tgz";
+    md5name = "b8e892d8627c41888ff121e921455b9e2d26836978f2359173d19825da62b8fc-graphite2-minimal-1.3.14.tgz";
  }
  {
    name = "harfbuzz-2.6.0.tar.xz";
@ -364,18 +371,18 @@
    md5name = "5ade6ae2a99bc1e9e57031ca88d36dad-hyphen-2.8.8.tar.gz";
  }
  {
-    name = "icu4c-65_1-src.tgz";
-    url = "http://dev-www.libreoffice.org/src/icu4c-65_1-src.tgz";
-    sha256 = "53e37466b3d6d6d01ead029e3567d873a43a5d1c668ed2278e253b683136d948";
+    name = "icu4c-67_1-src.tgz";
+    url = "http://dev-www.libreoffice.org/src/icu4c-67_1-src.tgz";
+    sha256 = "94a80cd6f251a53bd2a997f6f1b5ac6653fe791dfab66e1eb0227740fb86d5dc";
    md5 = "";
-    md5name = "53e37466b3d6d6d01ead029e3567d873a43a5d1c668ed2278e253b683136d948-icu4c-65_1-src.tgz";
+    md5name = "94a80cd6f251a53bd2a997f6f1b5ac6653fe791dfab66e1eb0227740fb86d5dc-icu4c-67_1-src.tgz";
  }
  {
-    name = "icu4c-65_1-data.zip";
-    url = "http://dev-www.libreoffice.org/src/icu4c-65_1-data.zip";
-    sha256 = "06359a7c4ad125ba11d3ac30617cd4b932f1214f611db96573032726574896b6";
+    name = "icu4c-67_1-data.zip";
+    url = "http://dev-www.libreoffice.org/src/icu4c-67_1-data.zip";
+    sha256 = "7c16a59cc8c06128b7ecc1dc4fc056b36b17349312829b17408b9e67b05c4a7e";
    md5 = "";
-    md5name = "06359a7c4ad125ba11d3ac30617cd4b932f1214f611db96573032726574896b6-icu4c-65_1-data.zip";
+    md5name = "7c16a59cc8c06128b7ecc1dc4fc056b36b17349312829b17408b9e67b05c4a7e-icu4c-67_1-data.zip";
  }
  {
    name = "flow-engine-0.9.4.zip";
@ -462,11 +469,11 @@
    md5name = "b24890e2bb46e12e72a79f7e965f409f4e16466d00e1dd15d93d73ee6b592523-libjpeg-turbo-1.5.3.tar.gz";
  }
  {
-    name = "language-subtag-registry-2019-09-16.tar.bz2";
-    url = "http://dev-www.libreoffice.org/src/language-subtag-registry-2019-09-16.tar.bz2";
-    sha256 = "07b66bc0f2786fde55f6bbcbcb4a455a846eb8e2351c8ce3d0a219a73693736a";
+    name = "language-subtag-registry-2020-04-01.tar.bz2";
+    url = "http://dev-www.libreoffice.org/src/language-subtag-registry-2020-04-01.tar.bz2";
+    sha256 = "fb1ee0dabfd956a445fbe9f351e86a52767808558f20f4256e67fbbb3768e9da";
    md5 = "";
-    md5name = "07b66bc0f2786fde55f6bbcbcb4a455a846eb8e2351c8ce3d0a219a73693736a-language-subtag-registry-2019-09-16.tar.bz2";
+    md5name = "fb1ee0dabfd956a445fbe9f351e86a52767808558f20f4256e67fbbb3768e9da-language-subtag-registry-2020-04-01.tar.bz2";
  }
  {
    name = "JLanguageTool-1.7.0.tar.bz2";
@ -532,11 +539,11 @@
    md5name = "d6242790324f1432fb0a6fae71b6851f520b2c5a87675497cf8ea14c2924d52e-liblangtag-0.6.2.tar.bz2";
  }
  {
-    name = "libnumbertext-1.0.5.tar.xz";
-    url = "http://dev-www.libreoffice.org/src/libnumbertext-1.0.5.tar.xz";
-    sha256 = "e1c9086b4cecb6b25f180316f30740dfabe6a4dbaf70dddc34276fc839e4f4f7";
+    name = "libnumbertext-1.0.6.tar.xz";
+    url = "http://dev-www.libreoffice.org/src/libnumbertext-1.0.6.tar.xz";
+    sha256 = "739f220b34bf7cb731c09de2921771d644d37dfd276c45564401e5759f10ae57";
    md5 = "";
-    md5name = "e1c9086b4cecb6b25f180316f30740dfabe6a4dbaf70dddc34276fc839e4f4f7-libnumbertext-1.0.5.tar.xz";
+    md5name = "739f220b34bf7cb731c09de2921771d644d37dfd276c45564401e5759f10ae57-libnumbertext-1.0.6.tar.xz";
  }
  {
    name = "ltm-1.0.zip";
@ -546,11 +553,11 @@
    md5name = "083daa92d8ee6f4af96a6143b12d7fc8fe1a547e14f862304f7281f8f7347483-ltm-1.0.zip";
  }
  {
-    name = "xmlsec1-1.2.28.tar.gz";
-    url = "http://dev-www.libreoffice.org/src/xmlsec1-1.2.28.tar.gz";
-    sha256 = "13eec4811ea30e3f0e16a734d1dbf7f9d246a71d540b48d143a07b489f6222d4";
+    name = "xmlsec1-1.2.30.tar.gz";
+    url = "http://dev-www.libreoffice.org/src/xmlsec1-1.2.30.tar.gz";
+    sha256 = "2d84360b03042178def1d9ff538acacaed2b3a27411db7b2874f1612ed71abc8";
    md5 = "";
-    md5name = "13eec4811ea30e3f0e16a734d1dbf7f9d246a71d540b48d143a07b489f6222d4-xmlsec1-1.2.28.tar.gz";
+    md5name = "2d84360b03042178def1d9ff538acacaed2b3a27411db7b2874f1612ed71abc8-xmlsec1-1.2.30.tar.gz";
  }
  {
    name = "libxml2-2.9.10.tar.gz";
@ -581,18 +588,18 @@
    md5name = "940caef1ec7c78e0c34b0f6b94fe42d0f2022915ffc78643d28538a5cfd0f40e-lxml-4.1.1.tgz";
  }
  {
-    name = "mariadb_client-2.0.0-src.tar.gz";
-    url = "http://dev-www.libreoffice.org/src/a233181e03d3c307668b4c722d881661-mariadb_client-2.0.0-src.tar.gz";
-    sha256 = "fd2f751dea049c1907735eb236aeace1d811d6a8218118b00bbaa9b84dc5cd60";
-    md5 = "a233181e03d3c307668b4c722d881661";
-    md5name = "a233181e03d3c307668b4c722d881661-mariadb_client-2.0.0-src.tar.gz";
+    name = "mariadb-connector-c-3.1.8-src.tar.gz";
+    url = "http://dev-www.libreoffice.org/src/mariadb-connector-c-3.1.8-src.tar.gz";
+    sha256 = "431434d3926f4bcce2e5c97240609983f60d7ff50df5a72083934759bb863f7b";
+    md5 = "";
+    md5name = "431434d3926f4bcce2e5c97240609983f60d7ff50df5a72083934759bb863f7b-mariadb-connector-c-3.1.8-src.tar.gz";
  }
  {
-    name = "mdds-1.5.0.tar.bz2";
-    url = "http://dev-www.libreoffice.org/src/mdds-1.5.0.tar.bz2";
-    sha256 = "144d6debd7be32726f332eac14ef9f17e2d3cf89cb3250eb31a7127e0789680d";
+    name = "mdds-1.6.0.tar.bz2";
+    url = "http://dev-www.libreoffice.org/src/mdds-1.6.0.tar.bz2";
+    sha256 = "f1585c9cbd12f83a6d43d395ac1ab6a9d9d5d77f062c7b5f704e24ed72dae07d";
    md5 = "";
-    md5name = "144d6debd7be32726f332eac14ef9f17e2d3cf89cb3250eb31a7127e0789680d-mdds-1.5.0.tar.bz2";
+    md5name = "f1585c9cbd12f83a6d43d395ac1ab6a9d9d5d77f062c7b5f704e24ed72dae07d-mdds-1.6.0.tar.bz2";
  }
  {
    name = "mDNSResponder-878.200.35.tar.gz";
@ -609,11 +616,11 @@
    md5name = "ef36c1a1aabb2ba3b0bedaaafe717bf4480be2ba8de6f3894be5fd3702b013ba-libmspub-0.1.4.tar.xz";
  }
  {
-    name = "libmwaw-0.3.15.tar.xz";
-    url = "http://dev-www.libreoffice.org/src/libmwaw-0.3.15.tar.xz";
-    sha256 = "0440bb09f05e3419423d8dfa36ee847056ebfd837f9cbc091fdb5b057daab0b1";
+    name = "libmwaw-0.3.16.tar.xz";
+    url = "http://dev-www.libreoffice.org/src/libmwaw-0.3.16.tar.xz";
+    sha256 = "0c639edba5297bde5575193bf5b5f2f469956beaff5c0206d91ce9df6bde1868";
    md5 = "";
-    md5name = "0440bb09f05e3419423d8dfa36ee847056ebfd837f9cbc091fdb5b057daab0b1-libmwaw-0.3.15.tar.xz";
+    md5name = "0c639edba5297bde5575193bf5b5f2f469956beaff5c0206d91ce9df6bde1868-libmwaw-0.3.16.tar.xz";
  }
  {
    name = "mythes-1.2.4.tar.gz";
@ -644,11 +651,11 @@
    md5name = "2c7b21892f84a4c67546f84611eccdad6259875c971e98ddb027da66ea0ac9c2-libodfgen-0.1.6.tar.bz2";
  }
  {
-    name = "odfvalidator-1.2.0-incubating-SNAPSHOT-jar-with-dependencies-971c54fd38a968f5860014b44301872706f9e540.jar";
-    url = "http://dev-www.libreoffice.org/src/../extern/odfvalidator-1.2.0-incubating-SNAPSHOT-jar-with-dependencies-971c54fd38a968f5860014b44301872706f9e540.jar";
-    sha256 = "984f2a479df79e27e7b01a5815ac53ae64e07746b882262d8a64566494515504";
+    name = "odfvalidator-0.9.0-RC2-SNAPSHOT-jar-with-dependencies-2726ab578664434a545f8379a01a9faffac0ae73.jar";
+    url = "http://dev-www.libreoffice.org/src/../extern/odfvalidator-0.9.0-RC2-SNAPSHOT-jar-with-dependencies-2726ab578664434a545f8379a01a9faffac0ae73.jar";
+    sha256 = "d55495ab3a86544650587de2a72180ddf8bfc6376d14ddfa923992dbc86a06e0";
    md5 = "";
-    md5name = "984f2a479df79e27e7b01a5815ac53ae64e07746b882262d8a64566494515504-odfvalidator-1.2.0-incubating-SNAPSHOT-jar-with-dependencies-971c54fd38a968f5860014b44301872706f9e540.jar";
+    md5name = "d55495ab3a86544650587de2a72180ddf8bfc6376d14ddfa923992dbc86a06e0-odfvalidator-0.9.0-RC2-SNAPSHOT-jar-with-dependencies-2726ab578664434a545f8379a01a9faffac0ae73.jar";
  }
  {
    name = "officeotron-0.7.4-master.jar";
@ -672,11 +679,11 @@
    md5name = "14cb464efe7ac6b54799b34456bd69558a749a4931ecfd9cf9f71d7881cac7bc-openssl-1.0.2t.tar.gz";
  }
  {
-    name = "liborcus-0.15.3.tar.gz";
-    url = "http://dev-www.libreoffice.org/src/liborcus-0.15.3.tar.gz";
-    sha256 = "0dd26f3f2e611c51df9ee02d6dbf08887989eaa417b73f6877cd0d94df795fc2";
+    name = "liborcus-0.15.4.tar.bz2";
+    url = "http://dev-www.libreoffice.org/src/liborcus-0.15.4.tar.bz2";
+    sha256 = "cfb2aa60825f2a78589ed030c07f46a1ee16ef8a2d1bf2279192fbc1ae5a5f61";
    md5 = "";
-    md5name = "0dd26f3f2e611c51df9ee02d6dbf08887989eaa417b73f6877cd0d94df795fc2-liborcus-0.15.3.tar.gz";
+    md5name = "cfb2aa60825f2a78589ed030c07f46a1ee16ef8a2d1bf2279192fbc1ae5a5f61-liborcus-0.15.4.tar.bz2";
  }
  {
    name = "owncloud-android-library-0.9.4-no-binary-deps.tar.gz";
@ -693,11 +700,11 @@
    md5name = "66adacd705a7d19895e08eac46d1e851332adf2e736c566bef1164e7a442519d-libpagemaker-0.0.4.tar.xz";
  }
  {
-    name = "pdfium-3963.tar.bz2";
-    url = "http://dev-www.libreoffice.org/src/pdfium-3963.tar.bz2";
-    sha256 = "80d4d6bd8faec226936fcde5521c6e92c0c645126ac3ae72dd2c160ca1749895";
+    name = "pdfium-4137.tar.bz2";
+    url = "http://dev-www.libreoffice.org/src/pdfium-4137.tar.bz2";
+    sha256 = "9a2f9bddca935a263f06c81003483473a525ccd0f4e517bc75fceb914d4c54b6";
    md5 = "";
-    md5name = "80d4d6bd8faec226936fcde5521c6e92c0c645126ac3ae72dd2c160ca1749895-pdfium-3963.tar.bz2";
+    md5name = "9a2f9bddca935a263f06c81003483473a525ccd0f4e517bc75fceb914d4c54b6-pdfium-4137.tar.bz2";
  }
  {
    name = "pixman-0.34.0.tar.gz";
@ -791,11 +798,18 @@
    md5name = "6988d394b62c3494635b6f0760bc3079f9a0cd380baf0f6b075af1eb9fa5e700-serf-1.2.1.tar.bz2";
  }
  {
-    name = "libstaroffice-0.0.6.tar.xz";
-    url = "http://dev-www.libreoffice.org/src/libstaroffice-0.0.6.tar.xz";
-    sha256 = "6b00e1ed8194e6072be4441025d1b888e39365727ed5b23e0e8c92c4009d1ec4";
+    name = "skia-m84-c1baf6e1c2a5454148adb516f0f833483b5a0353.tar.xz";
+    url = "http://dev-www.libreoffice.org/src/skia-m84-c1baf6e1c2a5454148adb516f0f833483b5a0353.tar.xz";
+    sha256 = "f88dc1a500d29c87ef5251c5a6c3ea66aa4c7daf0cf5d349ece64b36f7623be0";
    md5 = "";
-    md5name = "6b00e1ed8194e6072be4441025d1b888e39365727ed5b23e0e8c92c4009d1ec4-libstaroffice-0.0.6.tar.xz";
+    md5name = "f88dc1a500d29c87ef5251c5a6c3ea66aa4c7daf0cf5d349ece64b36f7623be0-skia-m84-c1baf6e1c2a5454148adb516f0f833483b5a0353.tar.xz";
+  }
+  {
+    name = "libstaroffice-0.0.7.tar.xz";
+    url = "http://dev-www.libreoffice.org/src/libstaroffice-0.0.7.tar.xz";
+    sha256 = "f94fb0ad8216f97127bedef163a45886b43c62deac5e5b0f5e628e234220c8db";
+    md5 = "";
+    md5name = "f94fb0ad8216f97127bedef163a45886b43c62deac5e5b0f5e628e234220c8db-libstaroffice-0.0.7.tar.xz";
  }
  {
    name = "swingExSrc.zip";
@ -840,11 +854,11 @@
    md5name = "99b3f7f8832385748582ab8130fbb9e5607bd5179bebf9751ac1d51a53099d1c-libwpg-0.3.3.tar.xz";
  }
  {
-    name = "libwps-0.4.10.tar.xz";
-    url = "http://dev-www.libreoffice.org/src/libwps-0.4.10.tar.xz";
-    sha256 = "1421e034286a9f96d3168a1c54ea570ee7aa008ca07b89de005ad5ce49fb29ca";
+    name = "libwps-0.4.11.tar.xz";
+    url = "http://dev-www.libreoffice.org/src/libwps-0.4.11.tar.xz";
+    sha256 = "a8fdaabc28654a975fa78c81873ac503ba18f0d1cdbb942f470a21d29284b4d1";
    md5 = "";
-    md5name = "1421e034286a9f96d3168a1c54ea570ee7aa008ca07b89de005ad5ce49fb29ca-libwps-0.4.10.tar.xz";
+    md5name = "a8fdaabc28654a975fa78c81873ac503ba18f0d1cdbb942f470a21d29284b4d1-libwps-0.4.11.tar.xz";
  }
  {
    name = "xsltml_2.1.2.zip";
--- a/pkgs/applications/office/libreoffice/src-fresh/primary.nix
+++ b/pkgs/applications/office/libreoffice/src-fresh/primary.nix
@ -6,10 +6,10 @@ rec {
    inherit sha256;
  };

-  major = "6";
-  minor = "4";
-  patch = "3";
-  tweak = "2";
+  major = "7";
+  minor = "0";
+  patch = "0";
+  tweak = "3";

  subdir = "${major}.${minor}.${patch}";

@ -17,13 +17,13 @@ rec {

  src = fetchurl {
    url = "https://download.documentfoundation.org/libreoffice/src/${subdir}/libreoffice-${version}.tar.xz";
-    sha256 = "1cmbrhha7mlflnlbpla8fix07cxcgkdb7krnrgs1bylf31y5855w";
+    sha256 = "sha256-sl+vgnLGIWtyw8Y/ovVsxThdOMg2Gby4SRaiaqvZVB0=";
  };

  # FIXME rename
  translations = fetchSrc {
    name = "translations";
-    sha256 = "06z9hz4m3kdcljjc6y5s18001axjibj9xiyakdndkl9pmnnhn9h3";
+    sha256 = "sha256-i3yfD5cmM6D9BctjablIFRqfibjrwLAaxxPIsQdk0sY=";
  };

  # the "dictionaries" archive is not used for LO build because we already build hunspellDicts packages from
@ -31,6 +31,6 @@ rec {

  help = fetchSrc {
    name = "help";
-    sha256 = "0mpgrwg8z1q38j03l6m1sdpcplyjd5nz1nqaa13vfkryj2lflw45";
+    sha256 = "sha256-hYBEEPRmh16zgGZBUN20xfTY6qL07aKMC1lC/0ij9/0=";
  };
 }
--- a/pkgs/applications/office/portfolio/default.nix
+++ b/pkgs/applications/office/portfolio/default.nix
@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "PortfolioPerformance";
-  version = "0.48.0";
+  version = "0.48.1";

  src = fetchurl {
    url = "https://github.com/buchen/portfolio/releases/download/${version}/PortfolioPerformance-${version}-linux.gtk.x86_64.tar.gz";
-    sha256 = "12skl08isz2f1a6ksmcw7sm82xk909y636ch8jp80lglb21i0q1j";
+    sha256 = "0xhxp4iglggv6rqwsg0xjn8z46v910rj372abkaviwa3cqzf7gdb";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/office/wpsoffice/default.nix
+++ b/pkgs/applications/office/wpsoffice/default.nix
@ -12,7 +12,7 @@
 , cups
 , dbus
 , expat
-, ffmpeg_3
+, ffmpeg
 , fontconfig
 , freetype
 , gdk-pixbuf
@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
    cairo
    dbus.lib
    expat
-    ffmpeg_3
+    ffmpeg
    fontconfig
    freetype
    gdk-pixbuf
--- a/pkgs/applications/version-management/git-and-tools/gita/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/gita/default.nix
@ -9,11 +9,11 @@
 }:

 buildPythonApplication rec {
-  version = "0.10.9";
+  version = "0.10.10";
  pname = "gita";

  src = fetchFromGitHub {
-    sha256 = "0wilyf4nnn2jyxrfqs8krya3zvhj6x36szsp9xhb6h08g1ihzp5i";
+    sha256 = "0k7hicncbrqvhmpq1w3v1309bqij6izw31xs8xcb8is85dvi754h";
    rev = "v${version}";
    repo = "gita";
    owner = "nosarthur";
@ -45,6 +45,7 @@ buildPythonApplication rec {

  postInstall = ''
    installShellCompletion --bash --name gita ${src}/.gita-completion.bash
+    installShellCompletion --zsh --name gita ${src}/.gita-completion.zsh
  '';

  meta = with lib; {
--- a/pkgs/applications/video/pitivi/default.nix
+++ b/pkgs/applications/video/pitivi/default.nix
@ -1,15 +1,28 @@
-{ stdenv, fetchFromGitHub, fetchurl, pkgconfig, intltool, itstool, python3, wrapGAppsHook
-, python3Packages, gst_all_1, gtk3
-, gobject-introspection, librsvg, gnome3, libnotify, gsound
-, meson, ninja, gsettings-desktop-schemas
+{ stdenv
+, fetchFromGitHub
+, fetchurl
+, fetchpatch
+, pkg-config
+, gettext
+, itstool
+, python3
+, wrapGAppsHook
+, python3Packages
+, gst_all_1
+, gtk3
+, gobject-introspection
+, librsvg
+, gnome3
+, libnotify
+, gsound
+, meson
+, ninja
+, gsettings-desktop-schemas
 }:

 let
-  version = "0.999";
-
-  # gst-transcoder will eventually be merged with gstreamer (according to
-  # gst-transcoder 1.8.0 release notes). For now the only user is pitivi so we
-  # don't bother exposing the package to all of nixpkgs.
+  # gst-transcoder was merged with gst-plugins-bad 1.18.
+  # TODO: switch to that once available.
  gst-transcoder = stdenv.mkDerivation rec {
    version = "1.14.1";
    pname = "gst-transcoder";
@ -19,46 +32,121 @@ let
      rev = version;
      sha256 = "16skiz9akavssii529v9nr8zd54w43livc14khdyzv164djg9q8f";
    };
-    nativeBuildInputs = [ pkgconfig meson ninja gobject-introspection python3 ];
-    buildInputs = with gst_all_1; [ gstreamer gst-plugins-base ];
+    nativeBuildInputs = [
+      pkg-config
+      meson
+      ninja
+      gobject-introspection
+      python3
+    ];
+    buildInputs = with gst_all_1; [
+      gstreamer
+      gst-plugins-base
+    ];
  };

 in python3Packages.buildPythonApplication rec {
-  name = "pitivi-${version}";
-
-  src = fetchurl {
-    url = "mirror://gnome/sources/pitivi/${stdenv.lib.versions.majorMinor version}/${name}.tar.xz";
-    sha256 = "0mxp2p4gg976fp1vj3rb5rmpl5mqfzncm9vw2719irl32f1qlvyb";
-  };
+  pname = "pitivi";
+  version = "0.999";

  format = "other";

+  src = fetchurl {
+    url = "mirror://gnome/sources/pitivi/${stdenv.lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "0mxp2p4gg976fp1vj3rb5rmpl5mqfzncm9vw2719irl32f1qlvyb";
+  };
+
  patches = [
    # By default, the build picks up environment variables like PYTHONPATH
    # and saves them to the generated binary. This would make the build-time
    # dependencies part of the closure so we remove it.
    ./prevent-closure-contamination.patch
+
+    # Port from intltool to gettext.
+    # Needed for the following patches to apply.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/pitivi/commit/89b1053f2516c594f414c5c67c835471bce44b67.patch";
+      sha256 = "8yhArzAtZC+WjHftcSDrstBlT8j6WlGHffU9Nj+ny+c=";
+      excludes = [ "po/POTFILES.in" ];
+    })
+
+    # Complete switching to gst-transcoder in gst-plugins-bad.
+    # Otherwise there will likely be conflics.
+    # TODO: Apply this patch once we are using gst-transcoder from gst-plugins-bad.
+    # (fetchpatch {
+    #   url = "https://gitlab.gnome.org/GNOME/pitivi/commit/51ae6533ee26ffd47e453eb5f5ad8cd46f57d15e.patch";
+    #   sha256 = "zxJm+E5o+oZ3lW6wYNY/ERo2g4NmCjoY8oV+uScq8j8=";
+    # })
+
+    # Generate renderer.so on macOS instead of dylib.
+    # Needed for the following patch to apply.
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/pitivi/commit/bcacadcafabf8911efb0fddc8d57329237d08cd1.patch";
+      sha256 = "2BM5acIwOgdr1L9vhtMMN4trrLuqCg/K6v6ZYtD1Fjw=";
+      postFetch = ''
+        sed -i -e "s/1.90.0.1/0.999/g" "$out"
+      '';
+    })
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/pitivi/commit/0a3cc054a2c20b59f5aaaaa307de3c9af3c0d270.patch";
+      sha256 = "6DhqRlxFWFFdLwGoFem+vPt8x7v732KMVjMF9fypMK4=";
+      postFetch = ''
+        sed "$out" -i \
+          -e "s/1.90.0.1/0.999/g" \
+          -e "s/\(-python_dep.*\)/\1\n /" \
+          -e "s/-1,9 +1,16/-1,10 +1,17/"
+      '';
+    })
+  ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    gettext
+    itstool
+    python3
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gobject-introspection
+    gtk3
+    librsvg
+    gnome3.gnome-desktop
+    gsound
+    gnome3.adwaita-icon-theme
+    gsettings-desktop-schemas
+    libnotify
+    gst-transcoder
+  ] ++ (with gst_all_1; [
+    gstreamer
+    gst-editing-services
+    gst-plugins-base
+    (gst-plugins-good.override { gtkSupport = true; })
+    gst-plugins-bad
+    gst-plugins-ugly
+    gst-libav
+    gst-validate
+  ]);
+
+  pythonPath = with python3Packages; [
+    pygobject3
+    gst-python
+    pyxdg
+    numpy
+    pycairo
+    matplotlib
+    dbus-python
  ];

  postPatch = ''
    patchShebangs ./getenvvar.py
+
+    # fetchpatch does not support renamings
+    mv data/org.pitivi.Pitivi-mime.xml data/org.pitivi.Pitivi-mime.xml.in
  '';

-  nativeBuildInputs = [ meson ninja pkgconfig intltool itstool python3 wrapGAppsHook ];
-
-  buildInputs = [
-    gobject-introspection gtk3 librsvg gnome3.gnome-desktop gsound
-    gnome3.adwaita-icon-theme
-    gsettings-desktop-schemas libnotify
-    gst-transcoder
-  ] ++ (with gst_all_1; [
-    gstreamer gst-editing-services
-    gst-plugins-base (gst-plugins-good.override { gtkSupport = true; })
-    gst-plugins-bad gst-plugins-ugly gst-libav gst-validate
-  ]);
-
-  pythonPath = with python3Packages; [ pygobject3 gst-python pyxdg numpy pycairo matplotlib dbus-python ];
-
  passthru = {
    updateScript = gnome3.updateScript {
      packageName = "pitivi";
--- a/pkgs/build-support/build-bazel-package/default.nix
+++ b/pkgs/build-support/build-bazel-package/default.nix
@ -37,6 +37,12 @@ args@{
 # Debian-specific /usr/share/java paths, but doesn't in the configured build).
 , fetchConfigured ? false

+# Don’t add Bazel --copt and --linkopt from NIX_CFLAGS_COMPILE /
+# NIX_LDFLAGS. This is necessary when using a custom toolchain which
+# Bazel wants all headers / libraries to come from, like when using
+# CROSSTOOL. Weirdly, we can still get the flags through the wrapped
+# compiler.
+, dontAddBazelOpts ? false
 , ...
 }:

@ -170,6 +176,8 @@ in stdenv.mkDerivation (fBuildAttrs // {
    done
  '' + fBuildAttrs.preConfigure or "";

+  inherit dontAddBazelOpts;
+
  buildPhase = fBuildAttrs.buildPhase or ''
    runHook preBuild

@ -181,20 +189,22 @@ in stdenv.mkDerivation (fBuildAttrs // {
    #
    copts=()
    host_copts=()
-    for flag in $NIX_CFLAGS_COMPILE; do
-      copts+=( "--copt=$flag" )
-      host_copts+=( "--host_copt=$flag" )
-    done
-    for flag in $NIX_CXXSTDLIB_COMPILE; do
-      copts+=( "--copt=$flag" )
-      host_copts+=( "--host_copt=$flag" )
-    done
    linkopts=()
    host_linkopts=()
-    for flag in $NIX_LDFLAGS; do
-      linkopts+=( "--linkopt=-Wl,$flag" )
-      host_linkopts+=( "--host_linkopt=-Wl,$flag" )
-    done
+    if [ -z "''${dontAddBazelOpts:-}" ]; then
+      for flag in $NIX_CFLAGS_COMPILE; do
+        copts+=( "--copt=$flag" )
+        host_copts+=( "--host_copt=$flag" )
+      done
+      for flag in $NIX_CXXSTDLIB_COMPILE; do
+        copts+=( "--copt=$flag" )
+        host_copts+=( "--host_copt=$flag" )
+      done
+      for flag in $NIX_LDFLAGS; do
+        linkopts+=( "--linkopt=-Wl,$flag" )
+        host_linkopts+=( "--host_linkopt=-Wl,$flag" )
+      done
+    fi

    BAZEL_USE_CPP_ONLY_TOOLCHAIN=1 \
    USER=homeless-shelter \
--- a/pkgs/data/fonts/ibm-plex/default.nix
+++ b/pkgs/data/fonts/ibm-plex/default.nix
@ -1,7 +1,7 @@
 { lib, fetchzip }:

 let
-  version = "5.1.0";
+  version = "5.1.3";

 in fetchzip {
  name = "ibm-plex-${version}";
@ -13,7 +13,7 @@ in fetchzip {
    unzip -j $downloadedFile "OpenType/*/*.otf" -d $out/share/fonts/opentype
  '';

-  sha256 = "1lcbj6zkpnsq38s2xkx3z4d7bd43k630lmzmgdcv1w05gjij0pw5";
+  sha256 = "0w07fkhav2lqdyki7ipnkpji5ngwarlhsyliy0ip7cd29x24ys5h";

  meta = with lib; {
    description = "IBM Plex Typeface";
--- a/pkgs/desktops/plasma-5/powerdevil.nix
+++ b/pkgs/desktops/plasma-5/powerdevil.nix
@ -30,7 +30,7 @@ mkDerivation {
    # Reduce log message spam by setting the default log level to Warning.
    (fetchpatch {
      url = "https://invent.kde.org/plasma/powerdevil/-/commit/c7590f9065ec9547b7fabad77a548bbc0c693113.patch";
-      sha256 = "0vj70mhx6qhvbh4vn9qk9ir5w4s2m76hw2lsxmh3ibgsydz4yilz";
+      sha256 = "077whhi0jrb3bajx357k7n66hv7nchis8jix0nfc1zjvi9fm6pi2";
    })
  ];
 }
--- a/pkgs/development/compilers/go/1.14.nix
+++ b/pkgs/development/compilers/go/1.14.nix
@ -31,11 +31,11 @@ in

 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.14.7";
+  version = "1.14.8";

  src = fetchurl {
    url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "1qrhdjdzi1knchk1wmlaqgkqhxkq2niw14b931rhqrk36m1r4hq6";
+    sha256 = "0sp3ss9mqcysc3h7ynwxhdjq4g0id9y6liakwy2cy27mapxi79nr";
  };

  # perl is used for testing go vet
--- a/pkgs/development/interpreters/j/default.nix
+++ b/pkgs/development/interpreters/j/default.nix
@ -5,12 +5,12 @@
 stdenv.mkDerivation rec {
  pname = "j";
  version = "901";
-  jtype = "release-e";
+  jtype = "release-f";
  src = fetchFromGitHub {
    owner = "jsoftware";
    repo = "jsource";
    rev = "j${version}-${jtype}";
-    sha256 = "13ky37rrl6mc66fckrdnrw64gmvq1qlv6skzd513lab4d0wigshw";
+    sha256 = "1776021m0j1aanzwg60by83n53pw7i6afd5wplfzczwk8bywax4p";
    name = "jsource";
  };

--- a/pkgs/development/libraries/science/math/cudnn/generic.nix
+++ b/pkgs/development/libraries/science/math/cudnn/generic.nix
@ -32,19 +32,20 @@ stdenv.mkDerivation {
    mkdir -p $out
    cp -a include $out/include
    cp -a lib64 $out/lib64
-
-    ${lib.optionalString (lib.versionAtLeast version "8") ''
-      # patchelf fails on libcudnn_cnn_infer due to it being too big.
-      # I'm hoping it's not needed for most programs.
-      # (https://github.com/NixOS/patchelf/issues/222)
-      rm -f $out/lib64/libcudnn_cnn_infer*
-    ''}
  '';

  # Set RUNPATH so that libcuda in /run/opengl-driver(-32)/lib can be found.
  # See the explanation in addOpenGLRunpath.
  postFixup = ''
-    addOpenGLRunpath $out/lib/lib*.so
+    for lib in $out/lib/lib*.so; do
+      # patchelf fails on libcudnn_cnn_infer due to it being too big.
+      # Most programs will still get the RPATH since they link to
+      # other things.
+      # (https://github.com/NixOS/patchelf/issues/222)
+      if [ "$(basename $lib)" != libcudnn_cnn_infer.so ]; then
+        addOpenGLRunpath $lib
+      fi
+    done
  '';

  propagatedBuildInputs = [
--- a/pkgs/development/libraries/strigi/default.nix
+++ b/pkgs/development/libraries/strigi/default.nix
@ -1,43 +0,0 @@
-{ stdenv, fetchurl, cmake, qt4, perl, bzip2, libxml2, exiv2
-, clucene_core, fam, zlib, dbus, pkgconfig
-}:
-
-stdenv.mkDerivation rec {
-  pname = "strigi";
-  version = "0.7.8";
-
-  src = fetchurl {
-    url = "https://www.vandenoever.info/software/strigi/${pname}-${version}.tar.bz2";
-    sha256 = "12grxzqwnvbyqw7q1gnz42lypadxmq89vk2qpxczmpmc4nk63r23";
-  };
-
-  includeAllQtDirs = true;
-
-  CLUCENE_HOME = clucene_core;
-
-  buildInputs =
-    [ zlib bzip2 libxml2 qt4 exiv2 clucene_core fam dbus.out ];
-
-  nativeBuildInputs = [ cmake pkgconfig perl ];
-
-  patches = [ ./export_bufferedstream.patch ./gcc6.patch ];
-
-  enableParallelBuilding = true;
-
-  # Strigi installs some libraries in an incorrect place
-  # ($out/$out/lib instead of $out/lib), so move them to the right
-  # place.
-  postInstall =
-    ''
-      mv $out/$out/lib/* $out/lib
-      rm -rf $out/nix
-    '';
-
-  meta = {
-    homepage = "http://strigi.sourceforge.net";
-    description = "A very fast and efficient crawler to index data on your harddrive";
-    license = "LGPL";
-    maintainers = with stdenv.lib.maintainers; [ sander ];
-    inherit (qt4.meta) platforms;
-  };
-}
--- a/pkgs/development/libraries/strigi/export_bufferedstream.patch
+++ b/pkgs/development/libraries/strigi/export_bufferedstream.patch
@ -1,12 +0,0 @@
-diff -u -r strigi-0.7.8/libstreams/include/strigi/bufferedstream.h strigi-0.7.8_new/libstreams/include/strigi/bufferedstream.h
--- strigi-0.7.8/libstreams/include/strigi/bufferedstream.h	2013-02-05 13:34:57.000000000 -0800
-+++ strigi-0.7.8_new/libstreams/include/strigi/bufferedstream.h	2013-07-14 17:01:54.000000000 -0700
-@@ -34,7 +34,7 @@
-  * BufferedStream will do the rest.
-  */
- template <class T>
-class BufferedStream : public StreamBase<T> {
-+class STRIGI_EXPORT BufferedStream : public StreamBase<T> {
- private:
-     StreamBuffer<T> buffer;
-     bool finishedWritingToBuffer;
--- a/pkgs/development/libraries/strigi/gcc6.patch
+++ b/pkgs/development/libraries/strigi/gcc6.patch
@ -1,45 +0,0 @@
-https://sourceforge.net/p/strigi/patches/4/
-
-and a fix for
-
-/tmp/nix-build-strigi-0.7.8.drv-0/strigi-0.7.8/libstreamanalyzer/plugins/indexers/clucenengindexer/cluceneindexreader.cpp:325:37: error: no matching function for call to 'make_pair(std::__cxx11::string, std::__cxx11::string&)'
-             wchartoutf8(name), value));
-
-diff -Naur strigi-0.7.8.old/libstreamanalyzer/cmake/MacroCheckGccVisibility.cmake strigi-0.7.8/libstreamanalyzer/cmake/MacroCheckGccVisibility.cmake
--- strigi-0.7.8.old/libstreamanalyzer/cmake/MacroCheckGccVisibility.cmake	2013-02-05 16:34:52.000000000 -0500
-+++ strigi-0.7.8/libstreamanalyzer/cmake/MacroCheckGccVisibility.cmake	2016-05-14 11:39:54.586260564 -0400
-@@ -15,7 +15,7 @@
-    # get the gcc version
-    exec_program(${CMAKE_C_COMPILER} ARGS ${CMAKE_C_COMPILER_ARG1} --version OUTPUT_VARIABLE _gcc_version_info)
- 
-   string (REGEX MATCH "[345]\\.[0-9]\\.[0-9]" _gcc_version "${_gcc_version_info}")
-+   string (REGEX MATCH "[3456789]\\.[0-9]\\.[0-9]" _gcc_version "${_gcc_version_info}")
-    # gcc on mac just reports: "gcc (GCC) 3.3 20030304 ..." without the patch level, handle this here:
-    if (NOT _gcc_version)
-       string (REGEX REPLACE ".*\\(GCC\\).* ([34]\\.[0-9]) .*" "\\1.0" _gcc_version "${_gcc_version_info}")
-diff -Naur strigi-0.7.8.old/libstreams/cmake/MacroCheckGccVisibility.cmake strigi-0.7.8/libstreams/cmake/MacroCheckGccVisibility.cmake
--- strigi-0.7.8.old/libstreams/cmake/MacroCheckGccVisibility.cmake	2013-02-05 16:34:57.000000000 -0500
-+++ strigi-0.7.8/libstreams/cmake/MacroCheckGccVisibility.cmake	2016-05-14 11:40:11.340134414 -0400
-@@ -15,7 +15,7 @@
-    # get the gcc version
-    exec_program(${CMAKE_C_COMPILER} ARGS ${CMAKE_C_COMPILER_ARG1} --version OUTPUT_VARIABLE _gcc_version_info)
- 
-   string (REGEX MATCH "[345]\\.[0-9]\\.[0-9]" _gcc_version "${_gcc_version_info}")
-+   string (REGEX MATCH "[3456789]\\.[0-9]\\.[0-9]" _gcc_version "${_gcc_version_info}")
-    # gcc on mac just reports: "gcc (GCC) 3.3 20030304 ..." without the patch level, handle this here:
-    if (NOT _gcc_version)
-       string (REGEX REPLACE ".*\\(GCC\\).* ([34]\\.[0-9]) .*" "\\1.0" _gcc_version "${_gcc_version_info}")
-
-diff -ru strigi-0.7.8-orig/libstreamanalyzer/plugins/indexers/clucenengindexer/cluceneindexreader.cpp strigi-0.7.8/libstreamanalyzer/plugins/indexers/clucenengindexer/cluceneindexreader.cpp
--- strigi-0.7.8-orig/libstreamanalyzer/plugins/indexers/clucenengindexer/cluceneindexreader.cpp	2013-02-05 22:34:52.000000000 +0100
-+++ strigi-0.7.8/libstreamanalyzer/plugins/indexers/clucenengindexer/cluceneindexreader.cpp	2017-07-31 10:56:27.067902643 +0200
-@@ -321,8 +321,7 @@
-         string size = value;
-         doc.size = atoi(size.c_str());
-     } else {
-        doc.properties.insert(make_pair<const string, string>(
-            wchartoutf8(name), value));
-+        doc.properties.emplace(wchartoutf8(name), value);
-     }
- }
- Variant
--- a/pkgs/development/ocaml-modules/re/default.nix
+++ b/pkgs/development/ocaml-modules/re/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchzip, buildDunePackage, ounit, seq }:
+{ lib, fetchzip, buildDunePackage, ocaml, ounit, seq }:

 buildDunePackage rec {
  pname = "re";
@ -11,14 +11,14 @@ buildDunePackage rec {
    sha256 = "07ycb103mr4mrkxfd63cwlsn023xvcjp0ra0k7n2gwrg0mwxmfss";
  };

-  buildInputs = [ ounit ];
+  buildInputs = lib.optional doCheck ounit;
  propagatedBuildInputs = [ seq ];
-  doCheck = true;
+  doCheck = lib.versionAtLeast ocaml.version "4.04";

  meta = {
    homepage = "https://github.com/ocaml/ocaml-re";
    description = "Pure OCaml regular expressions, with support for Perl and POSIX-style strings";
-    license = stdenv.lib.licenses.lgpl2;
-    maintainers = with stdenv.lib.maintainers; [ vbgl ];
+    license = lib.licenses.lgpl2;
+    maintainers = with lib.maintainers; [ vbgl ];
  };
 }
--- a/pkgs/development/python-modules/asgi-csrf/default.nix
+++ b/pkgs/development/python-modules/asgi-csrf/default.nix
@ -0,0 +1,31 @@
+{ stdenv, buildPythonPackage, isPy27, fetchFromGitHub, itsdangerous, python-multipart
+, pytest, starlette, httpx, pytest-asyncio }:
+
+buildPythonPackage rec {
+  version = "0.7";
+  pname = "asgi-csrf";
+  disabled = isPy27;
+
+  # PyPI tarball doesn't include tests directory
+  src = fetchFromGitHub {
+    owner = "simonw";
+    repo = pname;
+    rev = version;
+    sha256 = "1vf4lh007790836cp3hd6wf8wsgj045dcg0w1cm335p08zz6j4k7";
+  };
+
+  propagatedBuildInputs = [ itsdangerous python-multipart ];
+
+  checkInputs = [ pytest starlette httpx pytest-asyncio ];
+  checkPhase = ''
+    pytest test_asgi_csrf.py
+  '';
+  pythonImportsCheck = [ "asgi_csrf" ];
+
+  meta = with stdenv.lib; {
+    description = "ASGI middleware for protecting against CSRF attacks";
+    license = licenses.asl20;
+    homepage = "https://github.com/simonw/asgi-csrf";
+    maintainers = [ maintainers.ris ];
+  };
+}
--- a/pkgs/development/python-modules/cirq/default.nix
+++ b/pkgs/development/python-modules/cirq/default.nix
@ -48,6 +48,15 @@ buildPythonPackage rec {
    })
  ];

+  postPatch = ''
+    substituteInPlace requirements.txt \
+      --replace "freezegun~=0.3.15" "freezegun" \
+      --replace "matplotlib~=3.0" "matplotlib" \
+      --replace "networkx~=2.4" "networkx" \
+      --replace "numpy~=1.16, < 1.19" "numpy" \
+      --replace "protobuf~=3.12.0" "protobuf"
+  '';
+
  propagatedBuildInputs = [
    freezegun
    google_api_core
@ -64,7 +73,7 @@ buildPythonPackage rec {
  ];

  doCheck = true;
-  # pythonImportsCheck = [ "cirq" "cirq.Ciruit" ];  # cirq's importlib hook doesn't work here
+  # pythonImportsCheck = [ "cirq" "cirq.Circuit" ];  # cirq's importlib hook doesn't work here
  dontUseSetuptoolsCheck = true;
  checkInputs = [
    pytestCheckHook
@ -78,16 +87,10 @@ buildPythonPackage rec {

  pytestFlagsArray = [
    "--ignore=dev_tools"  # Only needed when developing new code, which is out-of-scope
+    "--benchmark-disable" # Don't need to run benchmarks when packaging.
  ];
  disabledTests = [
-    "test_serialize_sympy_constants"  # fails due to small error in pi (~10e-7)
-    "test_convert_to_ion_gates" # fails due to rounding error, 0.75 != 0.750...2
-
-    # Newly disabled tests on cirq 0.8
-    # TODO: test & figure out why failing
-    "engine_job_test"
-    "test_health"
-    "test_run_delegation"
+    "test_convert_to_ion_gates" # fails on some systems due to rounding error, 0.75 != 0.750...2
  ] ++ lib.optionals stdenv.isAarch64 [
    # Seem to fail due to math issues on aarch64?
    "expectation_from_wavefunction"
@ -97,6 +100,7 @@ buildPythonPackage rec {
  meta = with lib; {
    description = "A framework for creating, editing, and invoking Noisy Intermediate Scale Quantum (NISQ) circuits.";
    homepage = "https://github.com/quantumlib/cirq";
+    changelog = "https://github.com/quantumlib/Cirq/releases/tag/v${version}";
    license = licenses.asl20;
    maintainers = with maintainers; [ drewrisinger ];
  };
--- a/pkgs/development/python-modules/datasette/default.nix
+++ b/pkgs/development/python-modules/datasette/default.nix
@ -2,19 +2,22 @@
 , buildPythonPackage
 , fetchFromGitHub
 , aiofiles
+, asgi-csrf
 , click
 , click-default-group
 , janus
 , jinja2
 , hupper
+, mergedeep
 , pint
 , pluggy
+, python-baseconv
+, pyyaml
 , uvicorn
 # Check Inputs
 , pytestCheckHook
 , pytestrunner
 , pytest-asyncio
-, black
 , aiohttp
 , beautifulsoup4
 , asgiref
@ -23,26 +26,30 @@

 buildPythonPackage rec {
  pname = "datasette";
-  version = "0.39";
+  version = "0.46";

  src = fetchFromGitHub {
    owner = "simonw";
    repo = "datasette";
    rev = version;
-    sha256 = "07d46512bc9sdan9lv39sf1bwlf7vf1bfhcsm825vk7sv7g9kczd";
+    sha256 = "0g4dfq5ykifa9628cb4i7gvx98p8hvb99gzfxk3bkvq1v9p4kcqq";
  };

  nativeBuildInputs = [ pytestrunner ];

  propagatedBuildInputs = [
    aiofiles
+    asgi-csrf
    click
    click-default-group
    janus
    jinja2
    hupper
+    mergedeep
    pint
    pluggy
+    python-baseconv
+    pyyaml
    uvicorn
    setuptools
  ];
@ -52,7 +59,6 @@ buildPythonPackage rec {
    pytest-asyncio
    aiohttp
    beautifulsoup4
-    black
    asgiref
  ];

@ -60,22 +66,17 @@ buildPythonPackage rec {
    substituteInPlace setup.py \
      --replace "click~=7.1.1" "click" \
      --replace "click-default-group~=1.2.2" "click-default-group" \
-      --replace "Jinja2~=2.10.3" "Jinja2" \
      --replace "hupper~=1.9" "hupper" \
      --replace "pint~=0.9" "pint" \
-      --replace "pluggy~=0.13.0" "pint" \
+      --replace "pluggy~=0.13.0" "pluggy" \
      --replace "uvicorn~=0.11" "uvicorn" \
-      --replace "aiofiles~=0.4.0" "aiofiles" \
-      --replace "janus~=0.4.0" "janus" \
      --replace "PyYAML~=5.3" "PyYAML"
  '';

-  # many tests require network access
+  # test_html is very slow
  # test_black fails on darwin
  dontUseSetuptoolsCheck = true;
  pytestFlagsArray = [
-    "--ignore=tests/test_api.py"
-    "--ignore=tests/test_csv.py"
    "--ignore=tests/test_html.py"
    "--ignore=tests/test_docs.py"
    "--ignore=tests/test_black.py"
@ -84,6 +85,7 @@ buildPythonPackage rec {
    "facet"
    "_invalid_database" # checks error message when connecting to invalid database
  ];
+  pythonImportsCheck = [ "datasette" ];

  meta = with lib; {
    description = "An instant JSON API for your SQLite databases";
--- a/pkgs/development/python-modules/elasticsearch/default.nix
+++ b/pkgs/development/python-modules/elasticsearch/default.nix
@ -7,11 +7,11 @@

 buildPythonPackage (rec {
  pname = "elasticsearch";
-  version = "7.8.1";
+  version = "7.9.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "92b534931865a186906873f75ae0b91808ff5036b0f2b9269eb5f6dc09644b55";
+    sha256 = "5e08776fbb30c6e92408c7fa8c37d939210d291475ae2f364f0497975918b6fe";
  };

  # Check is disabled because running them destroy the content of the local cluster!
--- a/pkgs/development/python-modules/httpcore/default.nix
+++ b/pkgs/development/python-modules/httpcore/default.nix
@ -0,0 +1,34 @@
+{ stdenv
+, buildPythonPackage
+, fetchFromGitHub
+, isPy27
+, h11
+, sniffio
+}:
+
+buildPythonPackage rec {
+  pname = "httpcore";
+  version = "0.10.2";
+  disabled = isPy27;
+
+  src = fetchFromGitHub {
+    owner = "encode";
+    repo = pname;
+    rev = version;
+    sha256 = "00gn8nfv814rg6fj7xv97mrra3fvx6fzjcgx9y051ihm6hxljdsi";
+  };
+
+  propagatedBuildInputs = [ h11 sniffio ];
+
+  # tests require pythonic access to mitmproxy, which isn't (yet?) packaged as
+  # a pythonPackage.
+  doCheck = false;
+  pythonImportsCheck = [ "httpcore" ];
+
+  meta = with stdenv.lib; {
+    description = "A minimal HTTP client";
+    homepage = "https://github.com/encode/httpcore";
+    license = licenses.bsd3;
+    maintainers = [ maintainers.ris ];
+  };
+}
--- a/pkgs/development/python-modules/httpx/default.nix
+++ b/pkgs/development/python-modules/httpx/default.nix
@ -2,64 +2,60 @@
 , buildPythonPackage
 , fetchFromGitHub
 , certifi
-, hstspreload
 , chardet
 , h11
 , h2
+, httpcore
 , idna
 , rfc3986
 , sniffio
 , isPy27
 , pytest
+, pytest-asyncio
+, pytest-trio
 , pytestcov
 , trustme
 , uvicorn
-, trio
 , brotli
-, urllib3
 }:

 buildPythonPackage rec {
  pname = "httpx";
-  version = "0.12.1";
+  version = "0.14.2";
  disabled = isPy27;

  src = fetchFromGitHub {
    owner = "encode";
    repo = pname;
    rev = version;
-    sha256 = "1nrp4h1ppb5vll81fzxmks82p0hxcil9f3mja3dgya511kc703h6";
+    sha256 = "08b6k5g8car3bic90aw4ysb2zvsa5nm8qk3hk4dgamllnnxzl5br";
  };

  propagatedBuildInputs = [
    certifi
-    hstspreload
    chardet
    h11
    h2
+    httpcore
    idna
    rfc3986
    sniffio
-    urllib3
  ];

  checkInputs = [
    pytest
+    pytest-asyncio
+    pytest-trio
    pytestcov
    trustme
    uvicorn
-    trio
    brotli
  ];

-  postPatch = ''
-    substituteInPlace setup.py \
-          --replace "h11==0.8.*" "h11"
-  '';
-
  checkPhase = ''
-    PYTHONPATH=.:$PYTHONPATH pytest
+    PYTHONPATH=.:$PYTHONPATH pytest -k 'not (test_connect_timeout or test_elapsed_timer)'
  '';
+  pythonImportsCheck = [ "httpx" ];

  meta = with lib; {
    description = "The next generation HTTP client";
--- a/pkgs/development/python-modules/jupyterhub-ldapauthenticator/default.nix
+++ b/pkgs/development/python-modules/jupyterhub-ldapauthenticator/default.nix
@ -7,11 +7,11 @@

 buildPythonPackage rec {
  pname = "jupyterhub-ldapauthenticator";
-  version = "1.3.1";
+  version = "1.3.2";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "913cc67a1e8c50e7e301a16f25a4125ffd020a7c5dd22ccfb3f7707af2ee9157";
+    sha256 = "12xby5j7wmi6qsbb2fjd5qbckkcg5fmdij8qpc9n7ci8vfxq303m";
  };

  # No tests implemented
--- a/pkgs/development/python-modules/matrix-nio/default.nix
+++ b/pkgs/development/python-modules/matrix-nio/default.nix
@ -20,13 +20,13 @@

 buildPythonPackage rec {
  pname = "matrix-nio";
-  version = "0.14.1";
+  version = "0.15.1";

  src = fetchFromGitHub {
    owner = "poljar";
    repo = "matrix-nio";
    rev = version;
-    sha256 = "0mgb9m3298jvw3wa051zn7vp1m8qriys3ps0qn3sq54fndljgg5k";
+    sha256 = "127n4sqdcip1ld42w9wz49pxkpvi765qzvivvwl26720n11zq5cd";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/mergedeep/default.nix
+++ b/pkgs/development/python-modules/mergedeep/default.nix
@ -0,0 +1,26 @@
+{ stdenv, buildPythonPackage, isPy27, fetchFromGitHub, pytest }:
+
+buildPythonPackage rec {
+  pname = "mergedeep";
+  version = "1.3.0";
+  disabled = isPy27;
+
+  # PyPI tarball doesn't include tests directory
+  src = fetchFromGitHub {
+    owner = "clarketm";
+    repo = "mergedeep";
+    rev = "v${version}";
+    sha256 = "1a0y26a04limiggjwqyyqpryxiylbqya74nq1bij75zhz42sa02b";
+  };
+
+  checkInputs = [ pytest ];
+  checkPhase = "pytest";
+  pythonImportsCheck = [ "mergedeep" ];
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/clarketm/mergedeep";
+    description = "A deep merge function for python";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ris ];
+  };
+}
--- a/pkgs/development/python-modules/phonopy/default.nix
+++ b/pkgs/development/python-modules/phonopy/default.nix
@ -1,4 +1,4 @@
-{ stdenv, buildPythonPackage, python, fetchPypi, numpy, pyyaml, matplotlib, h5py }:
+{ stdenv, buildPythonPackage, python, fetchPypi, numpy, pyyaml, matplotlib, h5py, spglib, pytestCheckHook }:

 buildPythonPackage rec {
  pname = "phonopy";
@ -9,15 +9,15 @@ buildPythonPackage rec {
    sha256 = "482c6ff29c058d091ac885e561e28ba3e516ea9e91c44a951cad11f3ae19856c";
  };

-  propagatedBuildInputs = [ numpy pyyaml matplotlib h5py ];
+  propagatedBuildInputs = [ numpy pyyaml matplotlib h5py spglib ];

-  checkPhase = ''
-    cd test
-    # dynamic structure factor test ocassionally fails do to roundoff
-    # see issue https://github.com/atztogo/phonopy/issues/79
-    rm spectrum/test_dynamic_structure_factor.py
-    ${python.interpreter} -m unittest discover -b
-    cd ../..
+  checkInputs = [ pytestCheckHook ];
+  # flakey due to floating point inaccuracy
+  disabledTests = [ "test_NaCl" ];
+
+  # prevent pytest from importing local directory
+  preCheck = ''
+    rm -r phonopy
  '';

  meta = with stdenv.lib; {
--- a/pkgs/development/python-modules/starlette/default.nix
+++ b/pkgs/development/python-modules/starlette/default.nix
@ -21,19 +21,14 @@
 buildPythonPackage rec {
  pname = "starlette";

-  # This is not the latest version of Starlette, however, later
-  # versions of Starlette break FastAPI due to
-  # https://github.com/tiangolo/fastapi/issues/683. Please update when
-  # possible. FastAPI is currently Starlette's only dependent.
-
-  version = "0.13.6";
+  version = "0.13.8";
  disabled = isPy27;

  src = fetchFromGitHub {
    owner = "encode";
    repo = pname;
    rev = version;
-    sha256 = "08d1d4qdwhi1xxag4am5ijingdyn0mbyqajs9ql5shxnybyjv321";
+    sha256 = "11i0yd8cqwscixajl734g11vf8pghki11c81chzfh8ifmj6mf9jk";
  };

  propagatedBuildInputs = [
@ -57,6 +52,7 @@ buildPythonPackage rec {
  checkPhase = ''
    pytest --ignore=tests/test_graphql.py
  '';
+  pythonImportsCheck = [ "starlette" ];

  meta = with lib; {
    homepage = "https://www.starlette.io/";
--- a/pkgs/development/tools/build-managers/bazel/bazel_0_26/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_0_26/default.nix
@ -236,6 +236,8 @@ stdenv.mkDerivation rec {
      fetch --experimental_distdir=${distDir}
      build --copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt="/g')"
      build --host_copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt="/g')"
+      build --linkopt="$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt="/g')"
+      build --host_linkopt="$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt="/g')"
      build --linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt="-Wl,/g')"
      build --host_linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt="-Wl,/g')"
      build --host_javabase='@local_jdk//:jdk'
@ -245,6 +247,8 @@ stdenv.mkDerivation rec {
      # add the same environment vars to compile.sh
      sed -e "/\$command \\\\$/a --copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt=\"/g')\" \\\\" \
          -e "/\$command \\\\$/a --host_copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --host_linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt=\"/g')\" \\\\" \
          -e "/\$command \\\\$/a --linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt=\"-Wl,/g')\" \\\\" \
          -e "/\$command \\\\$/a --host_linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt=\"-Wl,/g')\" \\\\" \
          -e "/\$command \\\\$/a --host_javabase='@local_jdk//:jdk' \\\\" \
--- a/pkgs/development/tools/build-managers/bazel/bazel_0_29/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_0_29/default.nix
@ -417,6 +417,8 @@ stdenv.mkDerivation rec {
      fetch --distdir=${distDir}
      build --copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt="/g')"
      build --host_copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt="/g')"
+      build --linkopt="$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt="/g')"
+      build --host_linkopt="$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt="/g')"
      build --linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt="-Wl,/g')"
      build --host_linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt="-Wl,/g')"
      build --host_javabase='@local_jdk//:jdk'
@ -426,6 +428,8 @@ stdenv.mkDerivation rec {
      # add the same environment vars to compile.sh
      sed -e "/\$command \\\\$/a --copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt=\"/g')\" \\\\" \
          -e "/\$command \\\\$/a --host_copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --host_linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt=\"/g')\" \\\\" \
          -e "/\$command \\\\$/a --linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt=\"-Wl,/g')\" \\\\" \
          -e "/\$command \\\\$/a --host_linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt=\"-Wl,/g')\" \\\\" \
          -e "/\$command \\\\$/a --host_javabase='@local_jdk//:jdk' \\\\" \
--- a/pkgs/development/tools/build-managers/bazel/bazel_1/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_1/default.nix
@ -417,6 +417,8 @@ stdenv.mkDerivation rec {
      fetch --distdir=${distDir}
      build --copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt="/g')"
      build --host_copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt="/g')"
+      build --linkopt="$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt="/g')"
+      build --host_linkopt="$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt="/g')"
      build --linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt="-Wl,/g')"
      build --host_linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt="-Wl,/g')"
      build --host_javabase='@local_jdk//:jdk'
@ -426,6 +428,8 @@ stdenv.mkDerivation rec {
      # add the same environment vars to compile.sh
      sed -e "/\$command \\\\$/a --copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt=\"/g')\" \\\\" \
          -e "/\$command \\\\$/a --host_copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --host_linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt=\"/g')\" \\\\" \
          -e "/\$command \\\\$/a --linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt=\"-Wl,/g')\" \\\\" \
          -e "/\$command \\\\$/a --host_linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt=\"-Wl,/g')\" \\\\" \
          -e "/\$command \\\\$/a --host_javabase='@local_jdk//:jdk' \\\\" \
--- a/pkgs/development/tools/build-managers/bazel/bazel_3/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_3/default.nix
@ -429,6 +429,8 @@ stdenv.mkDerivation rec {
      fetch --distdir=${distDir}
      build --copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt="/g')"
      build --host_copt="$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt="/g')"
+      build --linkopt="$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt="/g')"
+      build --host_linkopt="$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt="/g')"
      build --linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt="-Wl,/g')"
      build --host_linkopt="-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt="-Wl,/g')"
      build --host_javabase='@local_jdk//:jdk'
@ -438,6 +440,8 @@ stdenv.mkDerivation rec {
      # add the same environment vars to compile.sh
      sed -e "/\$command \\\\$/a --copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --copt=\"/g')\" \\\\" \
          -e "/\$command \\\\$/a --host_copt=\"$(echo $NIX_CFLAGS_COMPILE | sed -e 's/ /" --host_copt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --linkopt=\"/g')\" \\\\" \
+          -e "/\$command \\\\$/a --host_linkopt=\"$(echo $(< ${stdenv.cc}/nix-support/libcxx-ldflags) | sed -e 's/ /" --host_linkopt=\"/g')\" \\\\" \
          -e "/\$command \\\\$/a --linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --linkopt=\"-Wl,/g')\" \\\\" \
          -e "/\$command \\\\$/a --host_linkopt=\"-Wl,$(echo $NIX_LDFLAGS | sed -e 's/ /" --host_linkopt=\"-Wl,/g')\" \\\\" \
          -e "/\$command \\\\$/a --host_javabase='@local_jdk//:jdk' \\\\" \
--- a/pkgs/development/tools/dep2nix/deps.nix
+++ b/pkgs/development/tools/dep2nix/deps.nix
@ -1,145 +1,129 @@
-
-  # file automatically generated from Gopkg.lock with https://github.com/nixcloud/dep2nix (golang dep)
-  [
-  
-    {
-      goPackagePath  = "github.com/Masterminds/semver";
-      fetch = {
-        type = "git";
-        url = "https://github.com/Masterminds/semver";
-        rev =  "a93e51b5a57ef416dac8bb02d11407b6f55d8929";
-        sha256 = "1rd3p135r7iw0lvaa6vk7afxna87chq61a7a0wqnxd3xgpnpa9ik";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/Masterminds/vcs";
-      fetch = {
-        type = "git";
-        url = "https://github.com/Masterminds/vcs";
-        rev =  "6f1c6d150500e452704e9863f68c2559f58616bf";
-        sha256 = "02bpyzccazw9lwqchcz349al4vlxnz4m5gzwigk02zg2qpa1j53j";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/armon/go-radix";
-      fetch = {
-        type = "git";
-        url = "https://github.com/armon/go-radix";
-        rev =  "1fca145dffbcaa8fe914309b1ec0cfc67500fe61";
-        sha256 = "19jws9ngncpbhghzcy7biyb4r8jh14mzknyk67cvq6ln7kh1qyic";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/boltdb/bolt";
-      fetch = {
-        type = "git";
-        url = "https://github.com/boltdb/bolt";
-        rev =  "2f1ce7a837dcb8da3ec595b1dac9d0632f0f99e8";
-        sha256 = "0z7j06lijfi4y30ggf2znak2zf2srv2m6c68ar712wd2ys44qb3r";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/golang/dep";
-      fetch = {
-        type = "git";
-        url = "https://github.com/CrushedPixel/dep";
-        rev =  "fa9f32339c8855ebe7e7bc66e549036a7e06d37a";
-        sha256 = "1knaxs1ji1b0b68393f24r8qzvahxz9x7rqwc8jsjlshvpz0hlm6";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/golang/protobuf";
-      fetch = {
-        type = "git";
-        url = "https://github.com/golang/protobuf";
-        rev =  "bbd03ef6da3a115852eaf24c8a1c46aeb39aa175";
-        sha256 = "1pyli3dcagi7jzpiazph4fhkz7a3z4bhd25nwbb7g0iy69b8z1g4";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/jmank88/nuts";
-      fetch = {
-        type = "git";
-        url = "https://github.com/jmank88/nuts";
-        rev =  "8b28145dffc87104e66d074f62ea8080edfad7c8";
-        sha256 = "1d0xj1dj1lfalq3pg15h0c645n84lf122xx3zkm7hawq9zri6n5k";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/nightlyone/lockfile";
-      fetch = {
-        type = "git";
-        url = "https://github.com/nightlyone/lockfile";
-        rev =  "6a197d5ea61168f2ac821de2b7f011b250904900";
-        sha256 = "03znnf6rzyyi4h4qj81py1xpfs3pnfm39j4bfc9qzakz5j9y1gdl";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/pelletier/go-toml";
-      fetch = {
-        type = "git";
-        url = "https://github.com/pelletier/go-toml";
-        rev =  "acdc4509485b587f5e675510c4f2c63e90ff68a8";
-        sha256 = "1y5m9pngxhsfzcnxh8ma5nsllx74wn0jr47p2n6i3inrjqxr12xh";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/pkg/errors";
-      fetch = {
-        type = "git";
-        url = "https://github.com/pkg/errors";
-        rev =  "645ef00459ed84a119197bfb8d8205042c6df63d";
-        sha256 = "001i6n71ghp2l6kdl3qq1v2vmghcz3kicv9a5wgcihrzigm75pp5";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/sdboyer/constext";
-      fetch = {
-        type = "git";
-        url = "https://github.com/sdboyer/constext";
-        rev =  "836a144573533ea4da4e6929c235fd348aed1c80";
-        sha256 = "0055yw73di4spa1wwpa2pyb708wmh9r3xd8dcv8pn81dba94if1w";
-      };
-    }
-    
-    {
-      goPackagePath  = "golang.org/x/net";
-      fetch = {
-        type = "git";
-        url = "https://go.googlesource.com/net";
-        rev =  "dc948dff8834a7fe1ca525f8d04e261c2b56e70d";
-        sha256 = "0gkw1am63agb1rgpxr2qhns9npr99mzwrxg7px88qq8h93zzd4kg";
-      };
-    }
-    
-    {
-      goPackagePath  = "golang.org/x/sync";
-      fetch = {
-        type = "git";
-        url = "https://go.googlesource.com/sync";
-        rev =  "fd80eb99c8f653c847d294a001bdf2a3a6f768f5";
-        sha256 = "12lzldlj1cqc1babp1hkkn76fglzn5abkqvmbpr4f2j95mf9x836";
-      };
-    }
-    
-    {
-      goPackagePath  = "golang.org/x/sys";
-      fetch = {
-        type = "git";
-        url = "https://go.googlesource.com/sys";
-        rev =  "37707fdb30a5b38865cfb95e5aab41707daec7fd";
-        sha256 = "1abrr2507a737hdqv4q7pw7hv6ls9pdiq9crhdi52r3gcz6hvizg";
-      };
-    }
-    
+# file generated from Gopkg.lock using dep2nix (https://github.com/nixcloud/dep2nix)
+[
+  {
+    goPackagePath  = "github.com/Masterminds/semver";
+    fetch = {
+      type = "git";
+      url = "https://github.com/carolynvs/semver.git";
+      rev =  "a93e51b5a57ef416dac8bb02d11407b6f55d8929";
+      sha256 = "1rd3p135r7iw0lvaa6vk7afxna87chq61a7a0wqnxd3xgpnpa9ik";
+    };
+  }
+  {
+    goPackagePath  = "github.com/Masterminds/vcs";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Masterminds/vcs";
+      rev =  "6f1c6d150500e452704e9863f68c2559f58616bf";
+      sha256 = "02bpyzccazw9lwqchcz349al4vlxnz4m5gzwigk02zg2qpa1j53j";
+    };
+  }
+  {
+    goPackagePath  = "github.com/armon/go-radix";
+    fetch = {
+      type = "git";
+      url = "https://github.com/armon/go-radix";
+      rev =  "1fca145dffbcaa8fe914309b1ec0cfc67500fe61";
+      sha256 = "19jws9ngncpbhghzcy7biyb4r8jh14mzknyk67cvq6ln7kh1qyic";
+    };
+  }
+  {
+    goPackagePath  = "github.com/boltdb/bolt";
+    fetch = {
+      type = "git";
+      url = "https://github.com/boltdb/bolt";
+      rev =  "2f1ce7a837dcb8da3ec595b1dac9d0632f0f99e8";
+      sha256 = "0z7j06lijfi4y30ggf2znak2zf2srv2m6c68ar712wd2ys44qb3r";
+    };
+  }
+  {
+    goPackagePath  = "github.com/golang/dep";
+    fetch = {
+      type = "git";
+      url = "https://github.com/CrushedPixel/dep";
+      rev =  "fa9f32339c8855ebe7e7bc66e549036a7e06d37a";
+      sha256 = "1knaxs1ji1b0b68393f24r8qzvahxz9x7rqwc8jsjlshvpz0hlm6";
+    };
+  }
+  {
+    goPackagePath  = "github.com/golang/protobuf";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/protobuf";
+      rev =  "bbd03ef6da3a115852eaf24c8a1c46aeb39aa175";
+      sha256 = "1pyli3dcagi7jzpiazph4fhkz7a3z4bhd25nwbb7g0iy69b8z1g4";
+    };
+  }
+  {
+    goPackagePath  = "github.com/jmank88/nuts";
+    fetch = {
+      type = "git";
+      url = "https://github.com/jmank88/nuts";
+      rev =  "8b28145dffc87104e66d074f62ea8080edfad7c8";
+      sha256 = "1d0xj1dj1lfalq3pg15h0c645n84lf122xx3zkm7hawq9zri6n5k";
+    };
+  }
+  {
+    goPackagePath  = "github.com/nightlyone/lockfile";
+    fetch = {
+      type = "git";
+      url = "https://github.com/nightlyone/lockfile";
+      rev =  "6a197d5ea61168f2ac821de2b7f011b250904900";
+      sha256 = "03znnf6rzyyi4h4qj81py1xpfs3pnfm39j4bfc9qzakz5j9y1gdl";
+    };
+  }
+  {
+    goPackagePath  = "github.com/pelletier/go-toml";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pelletier/go-toml";
+      rev =  "acdc4509485b587f5e675510c4f2c63e90ff68a8";
+      sha256 = "1y5m9pngxhsfzcnxh8ma5nsllx74wn0jr47p2n6i3inrjqxr12xh";
+    };
+  }
+  {
+    goPackagePath  = "github.com/pkg/errors";
+    fetch = {
+      type = "git";
+      url = "https://github.com/pkg/errors";
+      rev =  "645ef00459ed84a119197bfb8d8205042c6df63d";
+      sha256 = "001i6n71ghp2l6kdl3qq1v2vmghcz3kicv9a5wgcihrzigm75pp5";
+    };
+  }
+  {
+    goPackagePath  = "github.com/sdboyer/constext";
+    fetch = {
+      type = "git";
+      url = "https://github.com/sdboyer/constext";
+      rev =  "836a144573533ea4da4e6929c235fd348aed1c80";
+      sha256 = "0055yw73di4spa1wwpa2pyb708wmh9r3xd8dcv8pn81dba94if1w";
+    };
+  }
+  {
+    goPackagePath  = "golang.org/x/net";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/net";
+      rev =  "dc948dff8834a7fe1ca525f8d04e261c2b56e70d";
+      sha256 = "0gkw1am63agb1rgpxr2qhns9npr99mzwrxg7px88qq8h93zzd4kg";
+    };
+  }
+  {
+    goPackagePath  = "golang.org/x/sync";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sync";
+      rev =  "fd80eb99c8f653c847d294a001bdf2a3a6f768f5";
+      sha256 = "12lzldlj1cqc1babp1hkkn76fglzn5abkqvmbpr4f2j95mf9x836";
+    };
+  }
+  {
+    goPackagePath  = "golang.org/x/sys";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/sys";
+      rev =  "37707fdb30a5b38865cfb95e5aab41707daec7fd";
+      sha256 = "1abrr2507a737hdqv4q7pw7hv6ls9pdiq9crhdi52r3gcz6hvizg";
+    };
+  }
 ]
--- a/pkgs/development/tools/leaps/deps.nix
+++ b/pkgs/development/tools/leaps/deps.nix
@ -1,185 +1,165 @@
-
-  # file automatically generated from Gopkg.lock with https://github.com/nixcloud/dep2nix (golang dep)
-  [
-  
-    {
-      goPackagePath  = "github.com/Azure/go-autorest";
-      fetch = {
-        type = "git";
-        url = "https://github.com/Azure/go-autorest";
-        rev =  "fc3b03a2d2d1f43fad3007038bd16f044f870722";
-        sha256 = "1j6aqbizlpiqcywdsj4dy4i76g8fbqc7d61c22ppc9knw0968h4r";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/Jeffail/gabs";
-      fetch = {
-        type = "git";
-        url = "https://github.com/Jeffail/gabs";
-        rev =  "2a3aa15961d5fee6047b8151b67ac2f08ba2c48c";
-        sha256 = "1fx6fyl5x037viwlj319f3gsq749an17q5l6n2zvf3ny5wq0iqxr";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/amir/raidman";
-      fetch = {
-        type = "git";
-        url = "https://github.com/amir/raidman";
-        rev =  "1ccc43bfb9c93cb401a4025e49c64ba71e5e668b";
-        sha256 = "074ckbyslrwn23q4x01hn3j7c3xngagn36lbli2g51n9j3x14jxr";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/azure/azure-sdk-for-go";
-      fetch = {
-        type = "git";
-        url = "https://github.com/azure/azure-sdk-for-go";
-        rev =  "21b68149ccf7c16b3f028bb4c7fd0ab458fe308f";
-        sha256 = "0zlhrh3n9mc5w7r0sdaqmpqfm2d290b50an0k1bvrr892m4cnxaq";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/cenkalti/backoff";
-      fetch = {
-        type = "git";
-        url = "https://github.com/cenkalti/backoff";
-        rev =  "61153c768f31ee5f130071d08fc82b85208528de";
-        sha256 = "08x77mgb9zsj047n74rx6c16jjx985lmy4s6fl58mdgxgxjv54y5";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/dgrijalva/jwt-go";
-      fetch = {
-        type = "git";
-        url = "https://github.com/dgrijalva/jwt-go";
-        rev =  "dbeaa9332f19a944acb5736b4456cfcc02140e29";
-        sha256 = "0zk6l6kzsjdijfn7c4h0aywdjx5j2hjwi67vy1k6wr46hc8ks2hs";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/elazarl/go-bindata-assetfs";
-      fetch = {
-        type = "git";
-        url = "https://github.com/elazarl/go-bindata-assetfs";
-        rev =  "30f82fa23fd844bd5bb1e5f216db87fd77b5eb43";
-        sha256 = "1swfb37g6sga3awvcmxf49ngbpvjv7ih5an9f8ixjqcfcwnb7nzp";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/garyburd/redigo";
-      fetch = {
-        type = "git";
-        url = "https://github.com/garyburd/redigo";
-        rev =  "d1ed5c67e5794de818ea85e6b522fda02623a484";
-        sha256 = "0gw18k9kg93hvdks93hckrdqppg1bav82sp2c98q6z36dkvaih24";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/go-sql-driver/mysql";
-      fetch = {
-        type = "git";
-        url = "https://github.com/go-sql-driver/mysql";
-        rev =  "a0583e0143b1624142adab07e0e97fe106d99561";
-        sha256 = "1rw1m91dpm23s6nn6jc4zi6rq2mgl7zx07gyadrdn0sh7cj8c89d";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/golang/protobuf";
-      fetch = {
-        type = "git";
-        url = "https://github.com/golang/protobuf";
-        rev =  "925541529c1fa6821df4e44ce2723319eb2be768";
-        sha256 = "1d3zjvhl115l23xakj0014qpjchivlg098h10v5nfirkk1i9f9sa";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/gorilla/websocket";
-      fetch = {
-        type = "git";
-        url = "https://github.com/gorilla/websocket";
-        rev =  "ea4d1f681babbce9545c9c5f3d5194a789c89f5b";
-        sha256 = "1bhgs2542qs49p1dafybqxfs2qc072xv41w5nswyrknwyjxxs2a1";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/kardianos/osext";
-      fetch = {
-        type = "git";
-        url = "https://github.com/kardianos/osext";
-        rev =  "ae77be60afb1dcacde03767a8c37337fad28ac14";
-        sha256 = "056dkgxrqjj5r18bnc3knlpgdz5p3yvp12y4y978hnsfhwaqvbjz";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/lib/pq";
-      fetch = {
-        type = "git";
-        url = "https://github.com/lib/pq";
-        rev =  "88edab0803230a3898347e77b474f8c1820a1f20";
-        sha256 = "02y7c8xy33x5q4167x2drzrys41nfi7wxxp9hy4vpazfws88al9p";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/marstr/guid";
-      fetch = {
-        type = "git";
-        url = "https://github.com/marstr/guid";
-        rev =  "8bdf7d1a087ccc975cf37dd6507da50698fd19ca";
-        sha256 = "1mxcigzfc1bbh5b616hm89bp06allhwcsas9v9lks235h0acgn4x";
-      };
-    }
-    
-    {
-      goPackagePath  = "github.com/satori/go.uuid";
-      fetch = {
-        type = "git";
-        url = "https://github.com/satori/go.uuid";
-        rev =  "f58768cc1a7a7e77a3bd49e98cdd21419399b6a3";
-        sha256 = "1j4s5pfg2ldm35y8ls8jah4dya2grfnx2drb4jcbjsyrp4cm5yfb";
-      };
-    }
-    
-    {
-      goPackagePath  = "golang.org/x/net";
-      fetch = {
-        type = "git";
-        url = "https://go.googlesource.com/net";
-        rev =  "cbe0f9307d0156177f9dd5dc85da1a31abc5f2fb";
-        sha256 = "1hmpqkxh97ayyy0xcdvf1bwirwja4wyin3sh0fzjlh93aqmqgylf";
-      };
-    }
-    
-    {
-      goPackagePath  = "gopkg.in/alexcesaro/statsd.v2";
-      fetch = {
-        type = "git";
-        url = "https://gopkg.in/alexcesaro/statsd.v2";
-        rev =  "7fea3f0d2fab1ad973e641e51dba45443a311a90";
-        sha256 = "02jdx68vicwsgabrnwgg1rvc45rinyh8ikinqgbqc56c5hkx3brj";
-      };
-    }
-    
-    {
-      goPackagePath  = "gopkg.in/yaml.v2";
-      fetch = {
-        type = "git";
-        url = "https://gopkg.in/yaml.v2";
-        rev =  "d670f9405373e636a5a2765eea47fac0c9bc91a4";
-        sha256 = "1w1xid51n8v1mydn2m3vgggw8qgpd5a5sr62snsc77d99fpjsrs0";
-      };
-    }
-    
-]
+# file generated from Gopkg.lock using dep2nix (https://github.com/nixcloud/dep2nix)
+[
+  {
+    goPackagePath  = "github.com/Azure/go-autorest";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Azure/go-autorest";
+      rev =  "fc3b03a2d2d1f43fad3007038bd16f044f870722";
+      sha256 = "1j6aqbizlpiqcywdsj4dy4i76g8fbqc7d61c22ppc9knw0968h4r";
+    };
+  }
+  {
+    goPackagePath  = "github.com/Jeffail/gabs";
+    fetch = {
+      type = "git";
+      url = "https://github.com/Jeffail/gabs";
+      rev =  "2a3aa15961d5fee6047b8151b67ac2f08ba2c48c";
+      sha256 = "1fx6fyl5x037viwlj319f3gsq749an17q5l6n2zvf3ny5wq0iqxr";
+    };
+  }
+  {
+    goPackagePath  = "github.com/amir/raidman";
+    fetch = {
+      type = "git";
+      url = "https://github.com/amir/raidman";
+      rev =  "1ccc43bfb9c93cb401a4025e49c64ba71e5e668b";
+      sha256 = "074ckbyslrwn23q4x01hn3j7c3xngagn36lbli2g51n9j3x14jxr";
+    };
+  }
+  {
+    goPackagePath  = "github.com/azure/azure-sdk-for-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/azure/azure-sdk-for-go";
+      rev =  "21b68149ccf7c16b3f028bb4c7fd0ab458fe308f";
+      sha256 = "0zlhrh3n9mc5w7r0sdaqmpqfm2d290b50an0k1bvrr892m4cnxaq";
+    };
+  }
+  {
+    goPackagePath  = "github.com/cenkalti/backoff";
+    fetch = {
+      type = "git";
+      url = "https://github.com/cenkalti/backoff";
+      rev =  "61153c768f31ee5f130071d08fc82b85208528de";
+      sha256 = "08x77mgb9zsj047n74rx6c16jjx985lmy4s6fl58mdgxgxjv54y5";
+    };
+  }
+  {
+    goPackagePath  = "github.com/dgrijalva/jwt-go";
+    fetch = {
+      type = "git";
+      url = "https://github.com/dgrijalva/jwt-go";
+      rev =  "dbeaa9332f19a944acb5736b4456cfcc02140e29";
+      sha256 = "0zk6l6kzsjdijfn7c4h0aywdjx5j2hjwi67vy1k6wr46hc8ks2hs";
+    };
+  }
+  {
+    goPackagePath  = "github.com/elazarl/go-bindata-assetfs";
+    fetch = {
+      type = "git";
+      url = "https://github.com/elazarl/go-bindata-assetfs";
+      rev =  "30f82fa23fd844bd5bb1e5f216db87fd77b5eb43";
+      sha256 = "1swfb37g6sga3awvcmxf49ngbpvjv7ih5an9f8ixjqcfcwnb7nzp";
+    };
+  }
+  {
+    goPackagePath  = "github.com/garyburd/redigo";
+    fetch = {
+      type = "git";
+      url = "https://github.com/garyburd/redigo";
+      rev =  "d1ed5c67e5794de818ea85e6b522fda02623a484";
+      sha256 = "0gw18k9kg93hvdks93hckrdqppg1bav82sp2c98q6z36dkvaih24";
+    };
+  }
+  {
+    goPackagePath  = "github.com/go-sql-driver/mysql";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-sql-driver/mysql";
+      rev =  "a0583e0143b1624142adab07e0e97fe106d99561";
+      sha256 = "1rw1m91dpm23s6nn6jc4zi6rq2mgl7zx07gyadrdn0sh7cj8c89d";
+    };
+  }
+  {
+    goPackagePath  = "github.com/golang/protobuf";
+    fetch = {
+      type = "git";
+      url = "https://github.com/golang/protobuf";
+      rev =  "925541529c1fa6821df4e44ce2723319eb2be768";
+      sha256 = "1d3zjvhl115l23xakj0014qpjchivlg098h10v5nfirkk1i9f9sa";
+    };
+  }
+  {
+    goPackagePath  = "github.com/gorilla/websocket";
+    fetch = {
+      type = "git";
+      url = "https://github.com/gorilla/websocket";
+      rev =  "ea4d1f681babbce9545c9c5f3d5194a789c89f5b";
+      sha256 = "1bhgs2542qs49p1dafybqxfs2qc072xv41w5nswyrknwyjxxs2a1";
+    };
+  }
+  {
+    goPackagePath  = "github.com/kardianos/osext";
+    fetch = {
+      type = "git";
+      url = "https://github.com/kardianos/osext";
+      rev =  "ae77be60afb1dcacde03767a8c37337fad28ac14";
+      sha256 = "056dkgxrqjj5r18bnc3knlpgdz5p3yvp12y4y978hnsfhwaqvbjz";
+    };
+  }
+  {
+    goPackagePath  = "github.com/lib/pq";
+    fetch = {
+      type = "git";
+      url = "https://github.com/lib/pq";
+      rev =  "88edab0803230a3898347e77b474f8c1820a1f20";
+      sha256 = "02y7c8xy33x5q4167x2drzrys41nfi7wxxp9hy4vpazfws88al9p";
+    };
+  }
+  {
+    goPackagePath  = "github.com/marstr/guid";
+    fetch = {
+      type = "git";
+      url = "https://github.com/marstr/guid";
+      rev =  "8bdf7d1a087ccc975cf37dd6507da50698fd19ca";
+      sha256 = "1mxcigzfc1bbh5b616hm89bp06allhwcsas9v9lks235h0acgn4x";
+    };
+  }
+  {
+    goPackagePath  = "github.com/satori/go.uuid";
+    fetch = {
+      type = "git";
+      url = "https://github.com/satori/go.uuid";
+      rev =  "f58768cc1a7a7e77a3bd49e98cdd21419399b6a3";
+      sha256 = "1j4s5pfg2ldm35y8ls8jah4dya2grfnx2drb4jcbjsyrp4cm5yfb";
+    };
+  }
+  {
+    goPackagePath  = "golang.org/x/net";
+    fetch = {
+      type = "git";
+      url = "https://go.googlesource.com/net";
+      rev =  "cbe0f9307d0156177f9dd5dc85da1a31abc5f2fb";
+      sha256 = "1hmpqkxh97ayyy0xcdvf1bwirwja4wyin3sh0fzjlh93aqmqgylf";
+    };
+  }
+  {
+    goPackagePath  = "gopkg.in/alexcesaro/statsd.v2";
+    fetch = {
+      type = "git";
+      url = "https://github.com/alexcesaro/statsd";
+      rev =  "7fea3f0d2fab1ad973e641e51dba45443a311a90";
+      sha256 = "02jdx68vicwsgabrnwgg1rvc45rinyh8ikinqgbqc56c5hkx3brj";
+    };
+  }
+  {
+    goPackagePath  = "gopkg.in/yaml.v2";
+    fetch = {
+      type = "git";
+      url = "https://github.com/go-yaml/yaml";
+      rev =  "d670f9405373e636a5a2765eea47fac0c9bc91a4";
+      sha256 = "1w1xid51n8v1mydn2m3vgggw8qgpd5a5sr62snsc77d99fpjsrs0";
+    };
+  }
+]
--- a/pkgs/development/tools/ocaml/ocp-index/default.nix
+++ b/pkgs/development/tools/ocaml/ocp-index/default.nix
@ -1,15 +1,15 @@
-{ lib, fetchurl, buildDunePackage, ocp-build, ocp-indent, cmdliner, re }:
+{ lib, fetchzip, buildDunePackage, cppo, ocp-indent, cmdliner, re }:

 buildDunePackage rec {
  pname = "ocp-index";
-  version = "1.2";
+  version = "1.2.1";

-  src = fetchurl {
-    url = "https://github.com/OCamlPro/ocp-index/releases/download/${version}/ocp-index-${version}.tbz";
-    sha256 = "1lchw02sakjjppmzr0rzlarwbg1lc2bl7pwcfpsiycnaz46x6gmr";
+  src = fetchzip {
+    url = "https://github.com/OCamlPro/ocp-index/archive/${version}.tar.gz";
+    sha256 = "08r7mxdnxmhff37fw4hmrpjgckgi5kaiiiirwp4rmdl594z0h9c8";
  };

-  buildInputs = [ ocp-build cmdliner re ];
+  buildInputs = [ cppo cmdliner re ];

  propagatedBuildInputs = [ ocp-indent ];

--- a/pkgs/development/tools/rust/rustup/default.nix
+++ b/pkgs/development/tools/rust/rustup/default.nix
@ -1,7 +1,13 @@
 { stdenv, lib, runCommand, patchelf
-, fetchFromGitHub, rustPlatform
+, fetchFromGitHub, rustPlatform, makeWrapper
 , pkgconfig, curl, zlib, Security, CoreServices }:

+let
+  libPath = lib.makeLibraryPath [
+    zlib # libz.so.1
+  ];
+in
+
 rustPlatform.buildRustPackage rec {
  pname = "rustup";
  version = "1.22.1";
@ -15,7 +21,7 @@ rustPlatform.buildRustPackage rec {

  cargoSha256 = "0ghjrx7y25s6rjp06h0iyv4195x7daj57bqza01i1j4hm5nkhqhi";

-  nativeBuildInputs = [ pkgconfig ];
+  nativeBuildInputs = [ makeWrapper pkgconfig ];

  buildInputs = [
    curl zlib
@ -24,19 +30,13 @@ rustPlatform.buildRustPackage rec {
  cargoBuildFlags = [ "--features no-self-update" ];

  patches = lib.optionals stdenv.isLinux [
-    (let
-      libPath = lib.makeLibraryPath [
-        zlib # libz.so.1
-      ];
-    in
-      (runCommand "0001-dynamically-patchelf-binaries.patch" { CC=stdenv.cc; patchelf = patchelf; libPath = "$ORIGIN/../lib:${libPath}"; } ''
-       export dynamicLinker=$(cat $CC/nix-support/dynamic-linker)
-       substitute ${./0001-dynamically-patchelf-binaries.patch} $out \
-         --subst-var patchelf \
-         --subst-var dynamicLinker \
-         --subst-var libPath
+    (runCommand "0001-dynamically-patchelf-binaries.patch" { CC=stdenv.cc; patchelf = patchelf; libPath = "$ORIGIN/../lib:${libPath}"; } ''
+     export dynamicLinker=$(cat $CC/nix-support/dynamic-linker)
+     substitute ${./0001-dynamically-patchelf-binaries.patch} $out \
+       --subst-var patchelf \
+       --subst-var dynamicLinker \
+       --subst-var libPath
    '')
-    )
  ];

  doCheck = !stdenv.isAarch64 && !stdenv.isDarwin;
@ -53,6 +53,8 @@ rustPlatform.buildRustPackage rec {
    done
    popd

+    wrapProgram $out/bin/rustup --prefix "LD_LIBRARY_PATH" : "${libPath}"
+
    # tries to create .rustup
    export HOME=$(mktemp -d)
    mkdir -p "$out/share/"{bash-completion/completions,fish/vendor_completions.d,zsh/site-functions}
--- a/pkgs/development/tools/selenium/chromedriver/default.nix
+++ b/pkgs/development/tools/selenium/chromedriver/default.nix
@ -1,17 +1,17 @@
 { stdenv, fetchurl, cairo, fontconfig, freetype, gdk-pixbuf, glib
 , glibc, gtk2, libX11, makeWrapper, nspr, nss, pango, unzip, gconf
-, libXi, libXrender, libXext
+, libxcb, libXi, libXrender, libXext
 }:
 let
  allSpecs = {
    x86_64-linux = {
      system = "linux64";
-      sha256 = "149p43zaz45malmff1274r2bwjcyjwsdickivk3pd0mvnjbfid2r";
+      sha256 = "0absr1fp2h87gpyw6jxj2f08sbhkkh3pf13145hfyzdvajj5rfjy";
    };

    x86_64-darwin = {
      system = "mac64";
-      sha256 = "1xpyqxpsz3r653ls67s6alv4g2vr4lxf29gyxc162ikywyrx80nr";
+      sha256 = "1p9k92fgyx0xis6r50vhcpx3iws2gaspq3dnpigglv3bj9yg8zvi";
    };
  };

@ -23,12 +23,12 @@ let
    cairo fontconfig freetype
    gdk-pixbuf glib gtk2 gconf
    libX11 nspr nss pango libXrender
-    gconf libXext libXi
+    gconf libxcb libXext libXi
  ];
 in
 stdenv.mkDerivation rec {
  pname = "chromedriver";
-  version = "83.0.4103.39";
+  version = "85.0.4183.87";

  src = fetchurl {
    url = "https://chromedriver.storage.googleapis.com/${version}/chromedriver_${spec.system}.zip";
--- a/pkgs/os-specific/linux/numworks-udev-rules/50-numworks-calculator.rules
+++ b/pkgs/os-specific/linux/numworks-udev-rules/50-numworks-calculator.rules
@ -0,0 +1,2 @@
+SUBSYSTEM=="usb", ATTR{idVendor}=="0483", ATTR{idProduct}=="a291", TAG+="uaccess"
+SUBSYSTEM=="usb", ATTR{idVendor}=="0483", ATTR{idProduct}=="df11", TAG+="uaccess"
--- a/pkgs/os-specific/linux/numworks-udev-rules/default.nix
+++ b/pkgs/os-specific/linux/numworks-udev-rules/default.nix
@ -0,0 +1,21 @@
+{ stdenv, fetchurl }:
+
+stdenv.mkDerivation rec {
+  pname = "numworks-udev-rules";
+  version = "unstable-2020-08-31";
+
+  udevRules = ./50-numworks-calculator.rules;
+  dontUnpack = true;
+
+  installPhase = ''
+    install -Dm 644 "${udevRules}" "$out/lib/udev/rules.d/50-numworks-calculator.rules"
+  '';
+
+  meta = with stdenv.lib; {
+    description = "Udev rules for Numworks calculators";
+    homepage = "https://numworks.com";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ shamilton ];
+    platforms = platforms.linux;
+  };
+}
--- a/Show More
+++ b/Show More