Merge branch 'staging-next' into staging

2021-03-01 19:30:56 +01:00 · 2021-03-01 19:30:56 +01:00 · 913394a1d9
parent 58aa8e36e2 4b494c403e
commit 913394a1d9
138 changed files with 6595 additions and 4660 deletions
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@ -1554,9 +1554,9 @@ Following rules are desired to be respected:

 * Python libraries are called from `python-packages.nix` and packaged with
  `buildPythonPackage`. The expression of a library should be in
-  `pkgs/development/python-modules/<name>/default.nix`. Libraries in
-  `pkgs/top-level/python-packages.nix` are sorted quasi-alphabetically to avoid
-  merge conflicts.
+  `pkgs/development/python-modules/<name>/default.nix`.
+* Libraries in `pkgs/top-level/python-packages.nix` are sorted
+  alphanumerically to avoid merge conflicts and ease locating attributes.
 * Python applications live outside of `python-packages.nix` and are packaged
  with `buildPythonApplication`.
 * Make sure libraries build for all Python interpreters.
@ -1570,3 +1570,4 @@ Following rules are desired to be respected:
  [PEP 0503](https://www.python.org/dev/peps/pep-0503/#normalized-names). This
  means that characters should be converted to lowercase and `.` and `_` should
  be replaced by a single `-` (foo-bar-baz instead of Foo__Bar.baz )
+* Attribute names in `python-packages.nix` should be sorted alphanumerically.
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -2417,6 +2417,16 @@
    githubId = 6806011;
    name = "Robert Schütz";
  };
+  dottedmag = {
+    email = "dottedmag@dottedmag.net";
+    github = "dottedmag";
+    githubId = 16120;
+    name = "Misha Gusarov";
+    keys = [{
+      longkeyid = "rsa4096/0x9D20F6503E338888";
+      fingerprint = "A8DF 1326 9E5D 9A38 E57C  FAC2 9D20 F650 3E33 8888";
+    }];
+  };
  doublec = {
    email = "chris.double@double.co.nz";
    github = "doublec";
@ -6055,7 +6065,7 @@
    name = "Celine Mercier";
  };
  metadark = {
-    email = "kira.bruneau@gmail.com";
+    email = "kira.bruneau@pm.me";
    name = "Kira Bruneau";
    github = "metadark";
    githubId = 382041;
@ -8039,6 +8049,12 @@
    githubId = 3708689;
    name = "Roberto Di Remigio";
  };
+  robertoszek = {
+    email = "robertoszek@robertoszek.xyz";
+    github = "robertoszek";
+    githubId = 1080963;
+    name = "Roberto";
+  };
  robgssp = {
    email = "robgssp@gmail.com";
    github = "robgssp";
--- a/nixos/doc/manual/release-notes/rl-2105.xml
+++ b/nixos/doc/manual/release-notes/rl-2105.xml
@ -523,6 +523,13 @@ self: super:
      as an hardware RNG, as it will automatically run the krngd task to periodically collect random
      data from the device and mix it into the kernel's RNG.
    </para>
+    <para>
+      The default SMTP port for GitLab has been changed to
+      <literal>25</literal> from its previous default of
+      <literal>465</literal>. If you depended on this default, you
+      should now set the <xref linkend="opt-services.gitlab.smtp.port" />
+      option.
+    </para>
   </listitem>
   <listitem>
    <para>
--- a/nixos/lib/make-squashfs.nix
+++ b/nixos/lib/make-squashfs.nix
@ -23,6 +23,6 @@ stdenv.mkDerivation {

      # Generate the squashfs image.
      mksquashfs nix-path-registration $(cat $closureInfo/store-paths) $out \
-        -keep-as-directory -all-root -b 1048576 -comp ${comp}
+        -no-hardlinks -keep-as-directory -all-root -b 1048576 -comp ${comp}
    '';
 }
--- a/nixos/modules/services/misc/defaultUnicornConfig.rb
+++ b/nixos/modules/services/misc/defaultUnicornConfig.rb
@ -1,69 +0,0 @@
-worker_processes 3
-
-listen ENV["UNICORN_PATH"] + "/tmp/sockets/gitlab.socket", :backlog => 1024
-listen "/run/gitlab/gitlab.socket", :backlog => 1024
-
-working_directory ENV["GITLAB_PATH"]
-
-pid ENV["UNICORN_PATH"] + "/tmp/pids/unicorn.pid"
-
-timeout 60
-
-# combine Ruby 2.0.0dev or REE with "preload_app true" for memory savings
-# http://rubyenterpriseedition.com/faq.html#adapt_apps_for_cow
-preload_app true
-GC.respond_to?(:copy_on_write_friendly=) and
-  GC.copy_on_write_friendly = true
-
-check_client_connection false
-
-before_fork do |server, worker|
-  # the following is highly recommended for Rails + "preload_app true"
-  # as there's no need for the master process to hold a connection
-  defined?(ActiveRecord::Base) and
-    ActiveRecord::Base.connection.disconnect!
-
-  # The following is only recommended for memory/DB-constrained
-  # installations.  It is not needed if your system can house
-  # twice as many worker_processes as you have configured.
-  #
-  # This allows a new master process to incrementally
-  # phase out the old master process with SIGTTOU to avoid a
-  # thundering herd (especially in the "preload_app false" case)
-  # when doing a transparent upgrade.  The last worker spawned
-  # will then kill off the old master process with a SIGQUIT.
-  old_pid = "#{server.config[:pid]}.oldbin"
-  if old_pid != server.pid
-    begin
-      sig = (worker.nr + 1) >= server.worker_processes ? :QUIT : :TTOU
-      Process.kill(sig, File.read(old_pid).to_i)
-    rescue Errno::ENOENT, Errno::ESRCH
-    end
-  end
-
-  # Throttle the master from forking too quickly by sleeping.  Due
-  # to the implementation of standard Unix signal handlers, this
-  # helps (but does not completely) prevent identical, repeated signals
-  # from being lost when the receiving process is busy.
-  # sleep 1
-end
-
-after_fork do |server, worker|
-  # per-process listener ports for debugging/admin/migrations
-  # addr = "127.0.0.1:#{9293 + worker.nr}"
-  # server.listen(addr, :tries => -1, :delay => 5, :tcp_nopush => true)
-
-  # the following is *required* for Rails + "preload_app true",
-  defined?(ActiveRecord::Base) and
-    ActiveRecord::Base.establish_connection
-
-  # reset prometheus client, this will cause any opened metrics files to be closed
-  defined?(::Prometheus::Client.reinitialize_on_pid_change) &&
-    Prometheus::Client.reinitialize_on_pid_change
-
-  # if preload_app is true, then you may also want to check and
-  # restart any other shared sockets/descriptors such as Memcached,
-  # and Redis.  TokyoCabinet file handles are safe to reuse
-  # between any number of forked children (assuming your kernel
-  # correctly implements pread()/pwrite() system calls)
-end
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@ -142,7 +142,7 @@ let

  gitlabEnv = {
    HOME = "${cfg.statePath}/home";
-    UNICORN_PATH = "${cfg.statePath}/";
+    PUMA_PATH = "${cfg.statePath}/";
    GITLAB_PATH = "${cfg.packages.gitlab}/share/gitlab/";
    SCHEMA = "${cfg.statePath}/db/structure.sql";
    GITLAB_UPLOADS_PATH = "${cfg.statePath}/uploads";
@ -424,7 +424,7 @@ in {

        port = mkOption {
          type = types.int;
-          default = 465;
+          default = 25;
          description = "Port of the SMTP server for Gitlab.";
        };

@ -641,6 +641,11 @@ in {

    environment.systemPackages = [ pkgs.git gitlab-rake gitlab-rails cfg.packages.gitlab-shell ];

+    systemd.targets.gitlab = {
+      description = "Common target for all GitLab services.";
+      wantedBy = [ "multi-user.target" ];
+    };
+
    # Redis is required for the sidekiq queue runner.
    services.redis.enable = mkDefault true;

@ -655,36 +660,45 @@ in {
    # here.
    systemd.services.gitlab-postgresql = let pgsql = config.services.postgresql; in mkIf databaseActuallyCreateLocally {
      after = [ "postgresql.service" ];
-      wantedBy = [ "multi-user.target" ];
-      path = [ pgsql.package ];
+      bindsTo = [ "postgresql.service" ];
+      wantedBy = [ "gitlab.target" ];
+      partOf = [ "gitlab.target" ];
+      path = [
+        pgsql.package
+        pkgs.util-linux
+      ];
      script = ''
        set -eu

-        PSQL="${pkgs.util-linux}/bin/runuser -u ${pgsql.superUser} -- psql --port=${toString pgsql.port}"
+        PSQL() {
+            psql --port=${toString pgsql.port} "$@"
+        }

-        $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${cfg.databaseName}'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "${cfg.databaseName}" OWNER "${cfg.databaseUsername}"'
-        current_owner=$($PSQL -tAc "SELECT pg_catalog.pg_get_userbyid(datdba) FROM pg_catalog.pg_database WHERE datname = '${cfg.databaseName}'")
+        PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${cfg.databaseName}'" | grep -q 1 || PSQL -tAc 'CREATE DATABASE "${cfg.databaseName}" OWNER "${cfg.databaseUsername}"'
+        current_owner=$(PSQL -tAc "SELECT pg_catalog.pg_get_userbyid(datdba) FROM pg_catalog.pg_database WHERE datname = '${cfg.databaseName}'")
        if [[ "$current_owner" != "${cfg.databaseUsername}" ]]; then
-            $PSQL -tAc 'ALTER DATABASE "${cfg.databaseName}" OWNER TO "${cfg.databaseUsername}"'
+            PSQL -tAc 'ALTER DATABASE "${cfg.databaseName}" OWNER TO "${cfg.databaseUsername}"'
            if [[ -e "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}" ]]; then
                echo "Reassigning ownership of database ${cfg.databaseName} to user ${cfg.databaseUsername} failed on last boot. Failing..."
                exit 1
            fi
            touch "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}"
-            $PSQL "${cfg.databaseName}" -tAc "REASSIGN OWNED BY \"$current_owner\" TO \"${cfg.databaseUsername}\""
+            PSQL "${cfg.databaseName}" -tAc "REASSIGN OWNED BY \"$current_owner\" TO \"${cfg.databaseUsername}\""
            rm "${config.services.postgresql.dataDir}/.reassigning_${cfg.databaseName}"
        fi
-        $PSQL '${cfg.databaseName}' -tAc "CREATE EXTENSION IF NOT EXISTS pg_trgm"
-        $PSQL '${cfg.databaseName}' -tAc "CREATE EXTENSION IF NOT EXISTS btree_gist;"
+        PSQL '${cfg.databaseName}' -tAc "CREATE EXTENSION IF NOT EXISTS pg_trgm"
+        PSQL '${cfg.databaseName}' -tAc "CREATE EXTENSION IF NOT EXISTS btree_gist;"
      '';

      serviceConfig = {
+        User = pgsql.superUser;
        Type = "oneshot";
+        RemainAfterExit = true;
      };
    };

    # Use postfix to send out mails.
-    services.postfix.enable = mkDefault true;
+    services.postfix.enable = mkDefault (cfg.smtp.enable && cfg.smtp.address == "localhost");

    users.users.${cfg.user} =
      { group = cfg.group;
@ -703,7 +717,6 @@ in {
      "d ${cfg.statePath} 0750 ${cfg.user} ${cfg.group} -"
      "d ${cfg.statePath}/builds 0750 ${cfg.user} ${cfg.group} -"
      "d ${cfg.statePath}/config 0750 ${cfg.user} ${cfg.group} -"
-      "d ${cfg.statePath}/config/initializers 0750 ${cfg.user} ${cfg.group} -"
      "d ${cfg.statePath}/db 0750 ${cfg.user} ${cfg.group} -"
      "d ${cfg.statePath}/log 0750 ${cfg.user} ${cfg.group} -"
      "d ${cfg.statePath}/repositories 2770 ${cfg.user} ${cfg.group} -"
@ -726,13 +739,156 @@ in {
      "L+ /run/gitlab/uploads - - - - ${cfg.statePath}/uploads"

      "L+ /run/gitlab/shell-config.yml - - - - ${pkgs.writeText "config.yml" (builtins.toJSON gitlabShellConfig)}"
-
-      "L+ ${cfg.statePath}/config/unicorn.rb - - - - ${./defaultUnicornConfig.rb}"
    ];

+
+    systemd.services.gitlab-config = {
+      wantedBy = [ "gitlab.target" ];
+      partOf = [ "gitlab.target" ];
+      path = with pkgs; [
+        jq
+        openssl
+        replace
+        git
+      ];
+      serviceConfig = {
+        Type = "oneshot";
+        User = cfg.user;
+        Group = cfg.group;
+        TimeoutSec = "infinity";
+        Restart = "on-failure";
+        WorkingDirectory = "${cfg.packages.gitlab}/share/gitlab";
+        RemainAfterExit = true;
+
+        ExecStartPre = let
+          preStartFullPrivileges = ''
+            shopt -s dotglob nullglob
+            set -eu
+
+            chown --no-dereference '${cfg.user}':'${cfg.group}' '${cfg.statePath}'/*
+            if [[ -n "$(ls -A '${cfg.statePath}'/config/)" ]]; then
+              chown --no-dereference '${cfg.user}':'${cfg.group}' '${cfg.statePath}'/config/*
+            fi
+          '';
+        in "+${pkgs.writeShellScript "gitlab-pre-start-full-privileges" preStartFullPrivileges}";
+
+        ExecStart = pkgs.writeShellScript "gitlab-config" ''
+          set -eu
+
+          umask u=rwx,g=rx,o=
+
+          cp -f ${cfg.packages.gitlab}/share/gitlab/VERSION ${cfg.statePath}/VERSION
+          rm -rf ${cfg.statePath}/db/*
+          rm -f ${cfg.statePath}/lib
+          find '${cfg.statePath}/config/' -maxdepth 1 -mindepth 1 -type d -execdir rm -rf {} \;
+          cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/config.dist/* ${cfg.statePath}/config
+          cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/db/* ${cfg.statePath}/db
+          ln -sf ${extraGitlabRb} ${cfg.statePath}/config/initializers/extra-gitlab.rb
+
+          ${cfg.packages.gitlab-shell}/bin/install
+
+          ${optionalString cfg.smtp.enable ''
+              install -m u=rw ${smtpSettings} ${cfg.statePath}/config/initializers/smtp_settings.rb
+              ${optionalString (cfg.smtp.passwordFile != null) ''
+                  smtp_password=$(<'${cfg.smtp.passwordFile}')
+                  replace-literal -e '@smtpPassword@' "$smtp_password" '${cfg.statePath}/config/initializers/smtp_settings.rb'
+              ''}
+          ''}
+
+          (
+            umask u=rwx,g=,o=
+
+            openssl rand -hex 32 > ${cfg.statePath}/gitlab_shell_secret
+
+            rm -f '${cfg.statePath}/config/database.yml'
+
+            ${if cfg.databasePasswordFile != null then ''
+                export db_password="$(<'${cfg.databasePasswordFile}')"
+
+                if [[ -z "$db_password" ]]; then
+                  >&2 echo "Database password was an empty string!"
+                  exit 1
+                fi
+
+                jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} \
+                   '.production.password = $ENV.db_password' \
+                   >'${cfg.statePath}/config/database.yml'
+              ''
+              else ''
+                jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} \
+                   >'${cfg.statePath}/config/database.yml'
+              ''
+            }
+
+            ${utils.genJqSecretsReplacementSnippet
+                gitlabConfig
+                "${cfg.statePath}/config/gitlab.yml"
+            }
+
+            rm -f '${cfg.statePath}/config/secrets.yml'
+
+            export secret="$(<'${cfg.secrets.secretFile}')"
+            export db="$(<'${cfg.secrets.dbFile}')"
+            export otp="$(<'${cfg.secrets.otpFile}')"
+            export jws="$(<'${cfg.secrets.jwsFile}')"
+            jq -n '{production: {secret_key_base: $ENV.secret,
+                    otp_key_base: $ENV.otp,
+                    db_key_base: $ENV.db,
+                    openid_connect_signing_key: $ENV.jws}}' \
+               > '${cfg.statePath}/config/secrets.yml'
+          )
+
+          # We remove potentially broken links to old gitlab-shell versions
+          rm -Rf ${cfg.statePath}/repositories/**/*.git/hooks
+
+          git config --global core.autocrlf "input"
+        '';
+      };
+    };
+
+    systemd.services.gitlab-db-config = {
+      after = [ "gitlab-config.service" "gitlab-postgresql.service" "postgresql.service" ];
+      bindsTo = [
+        "gitlab-config.service"
+      ] ++ optional (cfg.databaseHost == "") "postgresql.service"
+        ++ optional databaseActuallyCreateLocally "gitlab-postgresql.service";
+      wantedBy = [ "gitlab.target" ];
+      partOf = [ "gitlab.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        User = cfg.user;
+        Group = cfg.group;
+        TimeoutSec = "infinity";
+        Restart = "on-failure";
+        WorkingDirectory = "${cfg.packages.gitlab}/share/gitlab";
+        RemainAfterExit = true;
+
+        ExecStart = pkgs.writeShellScript "gitlab-db-config" ''
+          set -eu
+          umask u=rwx,g=rx,o=
+
+          initial_root_password="$(<'${cfg.initialRootPasswordFile}')"
+          ${gitlab-rake}/bin/gitlab-rake gitlab:db:configure GITLAB_ROOT_PASSWORD="$initial_root_password" \
+                                                             GITLAB_ROOT_EMAIL='${cfg.initialRootEmail}' > /dev/null
+        '';
+      };
+    };
+
    systemd.services.gitlab-sidekiq = {
-      after = [ "network.target" "redis.service" "gitlab.service" ];
-      wantedBy = [ "multi-user.target" ];
+      after = [
+        "network.target"
+        "redis.service"
+        "postgresql.service"
+        "gitlab-config.service"
+        "gitlab-db-config.service"
+      ];
+      bindsTo = [
+        "redis.service"
+        "gitlab-config.service"
+        "gitlab-db-config.service"
+      ] ++ optional (cfg.databaseHost == "") "postgresql.service";
+      wantedBy = [ "gitlab.target" ];
+      partOf = [ "gitlab.target" ];
      environment = gitlabEnv;
      path = with pkgs; [
        postgresqlPackage
@ -758,9 +914,10 @@ in {
    };

    systemd.services.gitaly = {
-      after = [ "network.target" "gitlab.service" ];
-      bindsTo = [ "gitlab.service" ];
-      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" "gitlab-config.service" ];
+      bindsTo = [ "gitlab-config.service" ];
+      wantedBy = [ "gitlab.target" ];
+      partOf = [ "gitlab.target" ];
      path = with pkgs; [
        openssh
        procps  # See https://gitlab.com/gitlab-org/gitaly/issues/1562
@ -783,8 +940,10 @@ in {

    systemd.services.gitlab-pages = mkIf (gitlabConfig.production.pages.enabled or false) {
      description = "GitLab static pages daemon";
-      after = [ "network.target" "redis.service" "gitlab.service" ]; # gitlab.service creates configs
-      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" "gitlab-config.service" ];
+      bindsTo = [ "gitlab-config.service" ];
+      wantedBy = [ "gitlab.target" ];
+      partOf = [ "gitlab.target" ];

      path = [ pkgs.unzip ];

@ -803,7 +962,8 @@ in {

    systemd.services.gitlab-workhorse = {
      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
+      wantedBy = [ "gitlab.target" ];
+      partOf = [ "gitlab.target" ];
      path = with pkgs; [
        exiftool
        git
@ -832,8 +992,10 @@ in {

    systemd.services.gitlab-mailroom = mkIf (gitlabConfig.production.incoming_email.enabled or false) {
      description = "GitLab incoming mail daemon";
-      after = [ "network.target" "redis.service" "gitlab.service" ]; # gitlab.service creates configs
-      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" "redis.service" "gitlab-config.service" ];
+      bindsTo = [ "gitlab-config.service" ];
+      wantedBy = [ "gitlab.target" ];
+      partOf = [ "gitlab.target" ];
      environment = gitlabEnv;
      serviceConfig = {
        Type = "simple";
@ -842,15 +1004,26 @@ in {

        User = cfg.user;
        Group = cfg.group;
-        ExecStart = "${cfg.packages.gitlab.rubyEnv}/bin/bundle exec mail_room -c ${cfg.packages.gitlab}/share/gitlab/config.dist/mail_room.yml";
+        ExecStart = "${cfg.packages.gitlab.rubyEnv}/bin/bundle exec mail_room -c ${cfg.statePath}/config/mail_room.yml";
        WorkingDirectory = gitlabEnv.HOME;
      };
    };

    systemd.services.gitlab = {
-      after = [ "gitlab-workhorse.service" "network.target" "gitlab-postgresql.service" "redis.service" ];
-      requires = [ "gitlab-sidekiq.service" ];
-      wantedBy = [ "multi-user.target" ];
+      after = [
+        "gitlab-workhorse.service"
+        "network.target"
+        "redis.service"
+        "gitlab-config.service"
+        "gitlab-db-config.service"
+      ];
+      bindsTo = [
+        "redis.service"
+        "gitlab-config.service"
+        "gitlab-db-config.service"
+      ] ++ optional (cfg.databaseHost == "") "postgresql.service";
+      wantedBy = [ "gitlab.target" ];
+      partOf = [ "gitlab.target" ];
      environment = gitlabEnv;
      path = with pkgs; [
        postgresqlPackage
@ -868,96 +1041,7 @@ in {
        TimeoutSec = "infinity";
        Restart = "on-failure";
        WorkingDirectory = "${cfg.packages.gitlab}/share/gitlab";
-        ExecStartPre = let
-          preStartFullPrivileges = ''
-            shopt -s dotglob nullglob
-            set -eu
-
-            chown --no-dereference '${cfg.user}':'${cfg.group}' '${cfg.statePath}'/*
-            chown --no-dereference '${cfg.user}':'${cfg.group}' '${cfg.statePath}'/config/*
-          '';
-          preStart = ''
-            set -eu
-
-            cp -f ${cfg.packages.gitlab}/share/gitlab/VERSION ${cfg.statePath}/VERSION
-            rm -rf ${cfg.statePath}/db/*
-            rm -rf ${cfg.statePath}/config/initializers/*
-            rm -f ${cfg.statePath}/lib
-            cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/config.dist/* ${cfg.statePath}/config
-            cp -rf --no-preserve=mode ${cfg.packages.gitlab}/share/gitlab/db/* ${cfg.statePath}/db
-            ln -sf ${extraGitlabRb} ${cfg.statePath}/config/initializers/extra-gitlab.rb
-
-            ${cfg.packages.gitlab-shell}/bin/install
-
-            ${optionalString cfg.smtp.enable ''
-              install -m u=rw ${smtpSettings} ${cfg.statePath}/config/initializers/smtp_settings.rb
-              ${optionalString (cfg.smtp.passwordFile != null) ''
-                smtp_password=$(<'${cfg.smtp.passwordFile}')
-                ${pkgs.replace}/bin/replace-literal -e '@smtpPassword@' "$smtp_password" '${cfg.statePath}/config/initializers/smtp_settings.rb'
-              ''}
-            ''}
-
-            (
-              umask u=rwx,g=,o=
-
-              ${pkgs.openssl}/bin/openssl rand -hex 32 > ${cfg.statePath}/gitlab_shell_secret
-
-              if [[ -h '${cfg.statePath}/config/database.yml' ]]; then
-                rm '${cfg.statePath}/config/database.yml'
-              fi
-
-              ${if cfg.databasePasswordFile != null then ''
-                  export db_password="$(<'${cfg.databasePasswordFile}')"
-
-                  if [[ -z "$db_password" ]]; then
-                    >&2 echo "Database password was an empty string!"
-                    exit 1
-                  fi
-
-                  ${pkgs.jq}/bin/jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} \
-                                    '.production.password = $ENV.db_password' \
-                                    >'${cfg.statePath}/config/database.yml'
-                ''
-                else ''
-                  ${pkgs.jq}/bin/jq <${pkgs.writeText "database.yml" (builtins.toJSON databaseConfig)} \
-                                    >'${cfg.statePath}/config/database.yml'
-                ''
-              }
-
-              ${utils.genJqSecretsReplacementSnippet
-                  gitlabConfig
-                  "${cfg.statePath}/config/gitlab.yml"
-              }
-
-              if [[ -h '${cfg.statePath}/config/secrets.yml' ]]; then
-                rm '${cfg.statePath}/config/secrets.yml'
-              fi
-
-              export secret="$(<'${cfg.secrets.secretFile}')"
-              export db="$(<'${cfg.secrets.dbFile}')"
-              export otp="$(<'${cfg.secrets.otpFile}')"
-              export jws="$(<'${cfg.secrets.jwsFile}')"
-              ${pkgs.jq}/bin/jq -n '{production: {secret_key_base: $ENV.secret,
-                                                  otp_key_base: $ENV.otp,
-                                                  db_key_base: $ENV.db,
-                                                  openid_connect_signing_key: $ENV.jws}}' \
-                                > '${cfg.statePath}/config/secrets.yml'
-            )
-
-            initial_root_password="$(<'${cfg.initialRootPasswordFile}')"
-            ${gitlab-rake}/bin/gitlab-rake gitlab:db:configure GITLAB_ROOT_PASSWORD="$initial_root_password" \
-                                                               GITLAB_ROOT_EMAIL='${cfg.initialRootEmail}' > /dev/null
-
-            # We remove potentially broken links to old gitlab-shell versions
-            rm -Rf ${cfg.statePath}/repositories/**/*.git/hooks
-
-            ${pkgs.git}/bin/git config --global core.autocrlf "input"
-          '';
-        in [
-          "+${pkgs.writeShellScript "gitlab-pre-start-full-privileges" preStartFullPrivileges}"
-          "${pkgs.writeShellScript "gitlab-pre-start" preStart}"
-        ];
-        ExecStart = "${cfg.packages.gitlab.rubyEnv}/bin/unicorn -c ${cfg.statePath}/config/unicorn.rb -E production";
+        ExecStart = "${cfg.packages.gitlab.rubyEnv}/bin/puma -C ${cfg.statePath}/config/puma.rb -e production";
      };

    };
--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@ -37,6 +37,11 @@ let
      . /etc/profile
      cd "$HOME"

+      # Allow the user to execute commands at the beginning of the X session.
+      if test -f ~/.xprofile; then
+          source ~/.xprofile
+      fi
+
      ${optionalString cfg.displayManager.job.logToJournal ''
        if [ -z "$_DID_SYSTEMD_CAT" ]; then
          export _DID_SYSTEMD_CAT=1
@ -64,22 +69,23 @@ let

      # Speed up application start by 50-150ms according to
      # http://kdemonkey.blogspot.nl/2008/04/magic-trick.html
-      rm -rf "$HOME/.compose-cache"
-      mkdir "$HOME/.compose-cache"
+      compose_cache="''${XCOMPOSECACHE:-$HOME/.compose-cache}"
+      mkdir -p "$compose_cache"
+      # To avoid accidentally deleting a wrongly set up XCOMPOSECACHE directory,
+      # defensively try to delete cache *files* only, following the file format specified in
+      # https://gitlab.freedesktop.org/xorg/lib/libx11/-/blob/master/modules/im/ximcp/imLcIm.c#L353-358
+      # sprintf (*res, "%s/%c%d_%03x_%08x_%08x", dir, _XimGetMyEndian(), XIM_CACHE_VERSION, (unsigned int)sizeof (DefTree), hash, hash2);
+      ${pkgs.findutils}/bin/find "$compose_cache" -maxdepth 1 -regextype posix-extended -regex '.*/[Bl][0-9]+_[0-9a-f]{3}_[0-9a-f]{8}_[0-9a-f]{8}' -delete
+      unset compose_cache

      # Work around KDE errors when a user first logs in and
      # .local/share doesn't exist yet.
-      mkdir -p "$HOME/.local/share"
+      mkdir -p "''${XDG_DATA_HOME:-$HOME/.local/share}"

      unset _DID_SYSTEMD_CAT

      ${cfg.displayManager.sessionCommands}

-      # Allow the user to execute commands at the beginning of the X session.
-      if test -f ~/.xprofile; then
-          source ~/.xprofile
-      fi
-
      # Start systemd user services for graphical sessions
      /run/current-system/systemd/bin/systemctl --user start graphical-session.target

--- a/nixos/modules/virtualisation/lxd.nix
+++ b/nixos/modules/virtualisation/lxd.nix
@ -66,7 +66,7 @@ in {
        type = types.bool;
        default = false;
        description = ''
-          enables various settings to avoid common pitfalls when
+          Enables various settings to avoid common pitfalls when
          running containers requiring many file operations.
          Fixes errors like "Too many open files" or
          "neighbour: ndisc_cache: neighbor table overflow!".
@ -74,6 +74,17 @@ in {
          for details.
        '';
      };
+
+      startTimeout = mkOption {
+        type = types.int;
+        default = 600;
+        apply = toString;
+        description = ''
+          Time to wait (in seconds) for LXD to become ready to process requests.
+          If LXD does not reply within the configured time, lxd.service will be
+          considered failed and systemd will attempt to restart it.
+        '';
+      };
    };
  };

@ -81,40 +92,58 @@ in {
  config = mkIf cfg.enable {
    environment.systemPackages = [ cfg.package ];

-    security.apparmor = {
-      enable = true;
-      profiles = [
-        "${cfg.lxcPackage}/etc/apparmor.d/usr.bin.lxc-start"
-        "${cfg.lxcPackage}/etc/apparmor.d/lxc-containers"
-      ];
-      packages = [ cfg.lxcPackage ];
-    };
+    # Note: the following options are also declared in virtualisation.lxc, but
+    # the latter can't be simply enabled to reuse the formers, because it
+    # does a bunch of unrelated things.
+    systemd.tmpfiles.rules = [ "d /var/lib/lxc/rootfs 0755 root root -" ];
+
+    security.apparmor.packages = [ pkgs.lxcPackage ];
+    security.apparmor.profiles = [
+      "${cfg.lxcPackage}/etc/apparmor.d/lxc-containers"
+      "${cfg.lxcPackage}/etc/apparmor.d/usr.bin.lxc-start"
+    ];

    # TODO: remove once LXD gets proper support for cgroupsv2
    # (currently most of the e.g. CPU accounting stuff doesn't work)
    systemd.enableUnifiedCgroupHierarchy = false;

+    systemd.sockets.lxd = {
+      description = "LXD UNIX socket";
+      wantedBy = [ "sockets.target" ];
+
+      socketConfig = {
+        ListenStream = "/var/lib/lxd/unix.socket";
+        SocketMode = "0660";
+        SocketGroup = "lxd";
+        Service = "lxd.service";
+      };
+    };
+
    systemd.services.lxd = {
      description = "LXD Container Management Daemon";

      wantedBy = [ "multi-user.target" ];
-      after = [ "systemd-udev-settle.service" ];
+      after = [ "network-online.target" "lxcfs.service" ];
+      requires = [ "network-online.target" "lxd.socket"  "lxcfs.service" ];
+      documentation = [ "man:lxd(1)" ];

-      path = lib.optional config.boot.zfs.enabled config.boot.zfs.package;
-
-      preStart = ''
-        mkdir -m 0755 -p /var/lib/lxc/rootfs
-      '';
+      path = optional cfg.zfsSupport config.boot.zfs.package;

      serviceConfig = {
        ExecStart = "@${cfg.package}/bin/lxd lxd --group lxd";
-        Type = "simple";
+        ExecStartPost = "${cfg.package}/bin/lxd waitready --timeout=${cfg.startTimeout}";
+        ExecStop = "${cfg.package}/bin/lxd shutdown";
+
        KillMode = "process"; # when stopping, leave the containers alone
        LimitMEMLOCK = "infinity";
        LimitNOFILE = "1048576";
        LimitNPROC = "infinity";
        TasksMax = "infinity";

+        Restart = "on-failure";
+        TimeoutStartSec = "${cfg.startTimeout}s";
+        TimeoutStopSec = "30s";
+
        # By default, `lxd` loads configuration files from hard-coded
        # `/usr/share/lxc/config` - since this is a no-go for us, we have to
        # explicitly tell it where the actual configuration files are
--- a/nixos/tests/gitlab.nix
+++ b/nixos/tests/gitlab.nix
@ -11,6 +11,8 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : with lib; {

  nodes = {
    gitlab = { ... }: {
+      imports = [ common/user-account.nix ];
+
      virtualisation.memorySize = if pkgs.stdenv.is64bit then 4096 else 2047;
      systemd.services.gitlab.serviceConfig.Restart = mkForce "no";
      systemd.services.gitlab-workhorse.serviceConfig.Restart = mkForce "no";
@ -27,11 +29,31 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : with lib; {
        };
      };

+      services.dovecot2 = {
+        enable = true;
+        enableImap = true;
+      };
+
      services.gitlab = {
        enable = true;
        databasePasswordFile = pkgs.writeText "dbPassword" "xo0daiF4";
        initialRootPasswordFile = pkgs.writeText "rootPassword" initialRootPassword;
        smtp.enable = true;
+        extraConfig = {
+          incoming_email = {
+            enabled = true;
+            mailbox = "inbox";
+            address = "alice@localhost";
+            user = "alice";
+            password = "foobar";
+            host = "localhost";
+            port = 143;
+          };
+          pages = {
+            enabled = true;
+            host = "localhost";
+          };
+        };
        secrets = {
          secretFile = pkgs.writeText "secret" "r8X9keSKynU7p4aKlh4GO1Bo77g5a7vj";
          otpFile = pkgs.writeText "otpsecret" "Zu5hGx3YvQx40DvI8WoZJQpX2paSDOlG";
@ -64,12 +86,16 @@ import ./make-test-python.nix ({ pkgs, lib, ...} : with lib; {
  in
  ''
    gitlab.start()
+
    gitlab.wait_for_unit("gitaly.service")
    gitlab.wait_for_unit("gitlab-workhorse.service")
+    gitlab.wait_for_unit("gitlab-pages.service")
+    gitlab.wait_for_unit("gitlab-mailroom.service")
    gitlab.wait_for_unit("gitlab.service")
    gitlab.wait_for_unit("gitlab-sidekiq.service")
    gitlab.wait_for_file("/var/gitlab/state/tmp/sockets/gitlab.socket")
    gitlab.wait_until_succeeds("curl -sSf http://gitlab/users/sign_in")
+
    gitlab.succeed(
        "curl -isSf http://gitlab | grep -i location | grep -q http://gitlab/users/sign_in"
    )
--- a/pkgs/applications/blockchains/ergo/default.nix
+++ b/pkgs/applications/blockchains/ergo/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "ergo";
-  version = "4.0.0";
+  version = "4.0.7";

  src = fetchurl {
    url = "https://github.com/ergoplatform/ergo/releases/download/v${version}/ergo-${version}.jar";
-    sha256 = "sha256-M0kgd/txqc04WNLNZiq+imHMM9YGFd12jMWJyY2ExrY=";
+    sha256 = "sha256-CDNH7vYLG7Gn22yl+cXtGAD+c8tbNU52FmdxneTM2u4=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/editors/android-studio/common.nix
+++ b/pkgs/applications/editors/android-studio/common.nix
@ -72,8 +72,8 @@ let
    installPhase = ''
      cp -r . $out
      wrapProgram $out/bin/studio.sh \
+        --set-default JAVA_HOME "$out/jre" \
        --set ANDROID_EMULATOR_USE_SYSTEM_LIBS 1 \
-        --set JAVA_HOME "$out/jre" \
        --set QT_XKB_CONFIG_ROOT "${xkeyboard_config}/share/X11/xkb" \
        --set FONTCONFIG_FILE ${fontsConf} \
        --prefix PATH : "${lib.makeBinPath [
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@ -14,13 +14,13 @@ let
    sha256Hash = "1f9bclvyvm3sg9an7wxlfwd8jwnb9cl726dvggmysa6r7shc7xw9";
  };
  betaVersion = {
-    version = "4.2.0.20"; # "Android Studio 4.2 Beta 4"
-    build = "202.7094744";
-    sha256Hash = "10c4qfq6d9ggs88s8h3pryhlnzw17m60qci78rjbh32wmm02sciz";
+    version = "4.2.0.21"; # "Android Studio 4.2 Beta 5"
+    build = "202.7141121";
+    sha256Hash = "05610xf9zz3yxarx6fv83fynlvqw9jl7h2a40yj3xx5kb7mzdnf2";
  };
  latestVersion = { # canary & dev
-    version = "2020.3.1.5"; # "Android Studio Arctic Fox (2020.3.1) Canary 5"
-    sha256Hash = "0x749sbg7qa5ncwwaywcldlhyyyyfh05bms2czz1rv6h7zgq16vq";
+    version = "2020.3.1.7"; # "Android Studio Arctic Fox (2020.3.1) Canary 7"
+    sha256Hash = "03gq4s8rmg7si0r2y1w26v9bjwhj6gzmrdny5z3j5pq8xsfjfqiw";
  };
 in {
  # Attributes are named by their corresponding release channels
--- a/pkgs/applications/editors/emacs-modes/elpa-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/elpa-generated.nix
@ -685,10 +685,10 @@
      elpaBuild {
        pname = "csv-mode";
        ename = "csv-mode";
-        version = "1.14";
+        version = "1.15";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/csv-mode-1.14.tar";
-          sha256 = "1jz4134pk8dwzsqih9wybx4l9yl244cgcilw8rdnnqmm8i6vxgrp";
+          url = "https://elpa.gnu.org/packages/csv-mode-1.15.tar";
+          sha256 = "0pigqhqg5mfza6jdskcr9yvrzdxnd68iyp3vyb8p8wskdacmbiyx";
        };
        packageRequires = [ cl-lib emacs ];
        meta = {
@ -726,16 +726,16 @@
          license = lib.licenses.free;
        };
      }) {};
-    dash = callPackage ({ elpaBuild, fetchurl, lib }:
+    dash = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
      elpaBuild {
        pname = "dash";
        ename = "dash";
-        version = "2.12.0";
+        version = "2.18.1";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/dash-2.12.0.tar";
-          sha256 = "02r547vian59zr55z6ri4p2b7q5y5k256wi9j8a317vjzyh54m05";
+          url = "https://elpa.gnu.org/packages/dash-2.18.1.tar";
+          sha256 = "17mrvmrfh5c3kri4r3gf1c3gz4i5vl9ac60grpx4103b56y4cgra";
        };
-        packageRequires = [];
+        packageRequires = [ emacs ];
        meta = {
          homepage = "https://elpa.gnu.org/packages/dash.html";
          license = lib.licenses.free;
@ -2373,10 +2373,10 @@
      elpaBuild {
        pname = "oauth2";
        ename = "oauth2";
-        version = "0.15";
+        version = "0.16";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/oauth2-0.15.el";
-          sha256 = "0ij17g6i8d4cyzc8v6sy2qglwhzd767331gavll6d507krdh3ca3";
+          url = "https://elpa.gnu.org/packages/oauth2-0.16.tar";
+          sha256 = "1rzly2nwjywrfgcmp8zidbmjl2ahyd8l8507lb1mxm4xqryvf316";
        };
        packageRequires = [ cl-lib nadvice ];
        meta = {
@ -2714,6 +2714,21 @@
          license = lib.licenses.free;
        };
      }) {};
+    pyim = callPackage ({ async, elpaBuild, emacs, fetchurl, lib, xr }:
+      elpaBuild {
+        pname = "pyim";
+        ename = "pyim";
+        version = "3.2";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/pyim-3.2.tar";
+          sha256 = "1rr9mq334dqf7mx1ii7910zkigw7chl63iws4sw0qsn014kjlb0a";
+        };
+        packageRequires = [ async emacs xr ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/pyim.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    python = callPackage ({ cl-lib ? null, elpaBuild, emacs, fetchurl, lib }:
      elpaBuild {
        pname = "python";
@ -3058,10 +3073,10 @@
      elpaBuild {
        pname = "rt-liberation";
        ename = "rt-liberation";
-        version = "2.1";
+        version = "2.2";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/rt-liberation-2.1.tar";
-          sha256 = "1ahl1ys72rvqs2bf9zv9648h65fx0283ibqlk1b8ayahc04w6qbl";
+          url = "https://elpa.gnu.org/packages/rt-liberation-2.2.tar";
+          sha256 = "01nkkrgygq5p5s0pfxpcn794jr6ln65ad809v9mvzz7972xw625s";
        };
        packageRequires = [];
        meta = {
@ -3563,10 +3578,10 @@
      elpaBuild {
        pname = "tramp";
        ename = "tramp";
-        version = "2.5.0.1";
+        version = "2.5.0.2";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/tramp-2.5.0.1.tar";
-          sha256 = "0kqlc03bbsdywp0m3mf0m62hqyam8vg81phh7nqmpdjzskrdc1yy";
+          url = "https://elpa.gnu.org/packages/tramp-2.5.0.2.tar";
+          sha256 = "16f782rjkmxxs5sz3wv4d46i7hbl483ashmrkvljf7lpnrl91s93";
        };
        packageRequires = [ emacs ];
        meta = {
@ -3604,6 +3619,21 @@
          license = lib.licenses.free;
        };
      }) {};
+    transient = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "transient";
+        ename = "transient";
+        version = "0.3.0";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/transient-0.3.0.tar";
+          sha256 = "1a457apfl762nn5xf1h3hbvrgs9hybkxh0jwb2y713zkhhck66cp";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/transient.html";
+          license = lib.licenses.free;
+        };
+      }) {};
    trie = callPackage ({ elpaBuild, fetchurl, heap, lib, tNFA }:
      elpaBuild {
        pname = "trie";
@ -4062,10 +4092,10 @@
      elpaBuild {
        pname = "xr";
        ename = "xr";
-        version = "1.20";
+        version = "1.21";
        src = fetchurl {
-          url = "https://elpa.gnu.org/packages/xr-1.20.tar";
-          sha256 = "0i3vfsp110z60gabn9x9rv21fvm7nnr234mvmpp7gx4l4hpadvzy";
+          url = "https://elpa.gnu.org/packages/xr-1.21.tar";
+          sha256 = "0mc10d33lsqs0ihcja8w78jzh2pk0dfm9m86kap6r3hi6wkr1cmi";
        };
        packageRequires = [ emacs ];
        meta = {
--- a/pkgs/applications/editors/emacs-modes/org-generated.nix
+++ b/pkgs/applications/editors/emacs-modes/org-generated.nix
@ -4,10 +4,10 @@
      elpaBuild {
        pname = "org";
        ename = "org";
-        version = "20210208";
+        version = "20210301";
        src = fetchurl {
-          url = "https://orgmode.org/elpa/org-20210208.tar";
-          sha256 = "1awqk2dk3sgglq6fqgaz8y8rqw3p5rcnkp7i6m15n7wlq9nx7njp";
+          url = "https://orgmode.org/elpa/org-20210301.tar";
+          sha256 = "0930km35lvbw89ifrqmcv96fjmp4fi12yv3spn51q27sfsmzqsrj";
        };
        packageRequires = [];
        meta = {
@ -19,10 +19,10 @@
      elpaBuild {
        pname = "org-plus-contrib";
        ename = "org-plus-contrib";
-        version = "20210208";
+        version = "20210301";
        src = fetchurl {
-          url = "https://orgmode.org/elpa/org-plus-contrib-20210208.tar";
-          sha256 = "13yrzx7sdndf38hamm1m82kfgnqgm8752mjxmmqw1iqr3r33ihi3";
+          url = "https://orgmode.org/elpa/org-plus-contrib-20210301.tar";
+          sha256 = "11mwar5x848iwc1cdssr3vyx0amji840x6f0dmjpigngpcnj02m8";
        };
        packageRequires = [];
        meta = {
--- a/pkgs/applications/editors/emacs-modes/recipes-archive-melpa.json
+++ b/pkgs/applications/editors/emacs-modes/recipes-archive-melpa.json
--- a/pkgs/applications/misc/spicetify-cli/default.nix
+++ b/pkgs/applications/misc/spicetify-cli/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "spicetify-cli";
-  version = "1.2.0";
+  version = "1.2.1";

  src = fetchFromGitHub {
    owner = "khanhas";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Gkq19OlX6ci2i5mno77O/v3VfUkv6FRQFcH98qaUuXs=";
+    sha256 = "sha256-HASFaPqm/A1QQ4nkd2hgeyqWplwE1RTrWA937rJA5Oo=";
  };

-  vendorSha256 = "sha256-ARhWKYh8Wy2UEYGabn6l/kbnJ0nHYTIt4hn9wuVgBkw=";
+  vendorSha256 = "sha256-g0RYIVIq4oMXdRZDBDnVYg7ombN5WEo/6O9hChQvOYs=";

  # used at runtime, but not installed by default
  postInstall = ''
--- a/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
+++ b/pkgs/applications/networking/browsers/tor-browser-bundle-bin/default.nix
@ -91,19 +91,19 @@ let
  fteLibPath = makeLibraryPath [ stdenv.cc.cc gmp ];

  # Upstream source
-  version = "10.0.9";
+  version = "10.0.12";

  lang = "en-US";

  srcs = {
    x86_64-linux = fetchurl {
      url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux64-${version}_${lang}.tar.xz";
-      sha256 = "Dtlfm/memHSxir5XkUGkJICGEM+tPs//ET4PdVM1HPM=";
+      sha256 = "0i5g997kgn7n6ji7pxbyvkx33nqfi2s1val680fp5hh1zz31yvfv";
    };

    i686-linux = fetchurl {
      url = "https://dist.torproject.org/torbrowser/${version}/tor-browser-linux32-${version}_${lang}.tar.xz";
-      sha256 = "GZywFEX/5Br+Zu1w6pegoNOTrSIVQNE2LINsa3Vdlxs=";
+      sha256 = "16915fvvq3d16v1bzclnb52sa6yyaalihk3gv93jcnph9vsz8ags";
    };
  };
 in
--- a/pkgs/applications/networking/cluster/argocd/default.nix
+++ b/pkgs/applications/networking/cluster/argocd/default.nix
@ -2,14 +2,14 @@

 buildGoModule rec {
  pname = "argocd";
-  version = "1.8.5";
+  version = "1.8.6";
  commit = "28aea3dfdede00443b52cc584814d80e8f896200";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo-cd";
    rev = "v${version}";
-    sha256 = "sha256-JjxibnGSDTjd0E9L3X2wnl9G713IYBs+O449RdrT19w=";
+    sha256 = "sha256-kJ3/1owK5T+FbcvjmK2CO+i/KwmVZRSGzF6fCt8J9E8=";
  };

  vendorSha256 = "sha256-rZ/ox180h9scocheYtMmKkoHY2/jH+I++vYX8R0fdlA=";
--- a/pkgs/applications/networking/feedreaders/newsflash/default.nix
+++ b/pkgs/applications/networking/feedreaders/newsflash/default.nix
@ -1,4 +1,5 @@
 { lib
+, stdenv
 , rustPlatform
 , fetchFromGitLab
 , meson
@ -17,18 +18,22 @@
 , gst_all_1
 }:

-rustPlatform.buildRustPackage rec {
+stdenv.mkDerivation rec {
  pname = "newsflash";
-  version = "1.2.2";
+  version = "1.3.0";

  src = fetchFromGitLab {
    owner = "news-flash";
    repo = "news_flash_gtk";
    rev = version;
-    hash = "sha256-TeheK14COX1NIrql74eI8Wx4jtpUP1eO5mugT5LzlPY=";
+    hash = "sha256-Vu8PXdnayrglAFVfO+WZTzk4Qrb/3uqzQIwClnRHto8=";
  };

-  cargoHash = "sha256-Fbj4sabrwpfa0QNEN4l91y/6AuPIKu7QPzYNUO6RtU0=";
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-dWumQi/Bk7w2C8zVVExxguWchZU+K2qTC02otsiK9jA=";
+  };

  patches = [
    # Post install tries to generate an icon cache & update the
@ -54,7 +59,11 @@ rustPlatform.buildRustPackage rec {

    # Provides glib-compile-resources to compile gresources
    glib
-  ];
+  ] ++ (with rustPlatform; [
+    cargoSetupHook
+    rust.cargo
+    rust.rustc
+  ]);

  buildInputs = [
    gtk3
@ -76,13 +85,6 @@ rustPlatform.buildRustPackage rec {
    gst-plugins-bad
  ]);

-  # Unset default rust phases to use meson & ninja instead
-  configurePhase = null;
-  buildPhase = null;
-  checkPhase = null;
-  installPhase = null;
-  installCheckPhase = null;
-
  meta = with lib; {
    description = "A modern feed reader designed for the GNOME desktop";
    homepage = "https://gitlab.com/news-flash/news_flash_gtk";
--- a/pkgs/applications/office/skanlite/default.nix
+++ b/pkgs/applications/office/skanlite/default.nix
@ -3,13 +3,12 @@
  libksane
 }:

-let
-  minorVersion = "2.2";
-in mkDerivation rec {
-  name = "skanlite-2.2.0";
+mkDerivation rec {
+  pname   = "skanlite";
+  version = "2.2.0";

  src = fetchurl {
-    url    = "mirror://kde/stable/skanlite/${minorVersion}/${name}.tar.xz";
+    url    = "mirror://kde/stable/skanlite/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
    sha256 = "VP7MOZdUe64XIVr3r0aKIl1IPds3vjBTZzOS3N3VhOQ=";
  };

@ -23,8 +22,8 @@ in mkDerivation rec {

  meta = with lib; {
    description = "KDE simple image scanning application";
-    homepage    = "http://www.kde.org/applications/graphics/skanlite/";
-    license = licenses.gpl2;
+    homepage    = "https://apps.kde.org/skanlite";
+    license     = licenses.gpl2Plus;
    maintainers = with maintainers; [ pshendry ];
    platforms   = platforms.linux;
  };
--- a/pkgs/applications/office/wpsoffice/default.nix
+++ b/pkgs/applications/office/wpsoffice/default.nix
@ -55,13 +55,13 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ autoPatchelfHook dpkg wrapGAppsHook wrapQtAppsHook ];

-  meta = {
-    description = "Office program originally named Kingsoft Office";
-    homepage = "http://wps-community.org/";
+  meta = with lib; {
+    description = "Office suite, formerly Kingsoft Office";
+    homepage = "https://www.wps.com/";
    platforms = [ "x86_64-linux" ];
    hydraPlatforms = [];
-    license = lib.licenses.unfreeRedistributable;
-    maintainers = with lib.maintainers; [ mlatus th0rgal ];
+    license = licenses.unfreeRedistributable;
+    maintainers = with maintainers; [ mlatus th0rgal ];
  };

  buildInputs = with xorg; [
--- a/pkgs/applications/science/logic/lean/default.nix
+++ b/pkgs/applications/science/logic/lean/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "lean";
-  version = "3.26.0";
+  version = "3.27.0";

  src = fetchFromGitHub {
    owner  = "leanprover-community";
    repo   = "lean";
    rev    = "v${version}";
-    sha256 = "sha256-xCULu6ljfyrA/Idr/BJ+3rLVmQqJZPoo+a7s++u50zU=";
+    sha256 = "sha256-DSIWuMlweu9dsah5EdVCNQ9ADjYoEZongfw/Yh7/N/A=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/version-management/git-and-tools/ghq/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/ghq/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "ghq";
-  version = "1.1.6";
+  version = "1.1.7";

  src = fetchFromGitHub {
    owner = "x-motemen";
    repo = "ghq";
    rev = "v${version}";
-    sha256 = "sha256-6oRyT/i+PndmjWBNJQzgrysE7jXiL/hAwwN++uCs6ZI=";
+    sha256 = "sha256-kEs844gj1/PW7Kkpn1tvxfruznRIh2pjHCoSWGF1upQ=";
  };

  vendorSha256 = "sha256-5Eth9v98z1gxf1Fz5Lbn2roX7dSBmA7GRzg8uvT0hTI=";
--- a/pkgs/applications/version-management/git-and-tools/radicle-upstream/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/radicle-upstream/default.nix
@ -2,12 +2,12 @@

 let
  pname = "radicle-upstream";
-  version = "0.1.6";
+  version = "0.1.11";
  name = "${pname}-${version}";

  src = fetchurl {
    url = "https://releases.radicle.xyz/radicle-upstream-${version}.AppImage";
-    sha256 =  "1s299rxala6gqj69j5q4d4n5wfdk2zsb4r9qrhml0m79b4f79yar";
+    sha256 =  "1j0xc9ns3andycbrrzkn6ql6739b1dimzlxq17wwpmqhni9nh673";
  };

  contents = appimageTools.extractType2 { inherit name src; };
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@ -137,6 +137,7 @@ stdenv.mkDerivation {
    sed -i '/ask_to_continue/d' lib/tasks/gitlab/two_factor.rake
    sed -ri -e '/log_level/a config.logger = Logger.new(STDERR)' config/environments/production.rb

+    mv config/puma.rb.example config/puma.rb
    # Always require lib-files and application.rb through their store
    # path, not their relative state directory path. This gets rid of
    # warnings and means we don't have to link back to lib from the
--- a/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
+++ b/pkgs/applications/version-management/gitlab/remove-hardcoded-locations.patch
@ -1,8 +1,8 @@
 diff --git a/config/environments/production.rb b/config/environments/production.rb
-index c5cbfcf64c..4d01f6fab8 100644
+index d9b3ee354b0..1eb0507488b 100644
 --- a/config/environments/production.rb
 +++ b/config/environments/production.rb
-@@ -70,10 +70,10 @@ Rails.application.configure do
+@@ -69,10 +69,10 @@
 
   config.action_mailer.delivery_method = :sendmail
   # Defaults to:
@ -11,17 +11,17 @@ index c5cbfcf64c..4d01f6fab8 100644
 -  # #   arguments: '-i -t'
 -  # # }
 +  config.action_mailer.sendmail_settings = {
-+    location: '/usr/sbin/sendmail',
+    location: '/run/wrappers/bin/sendmail',
 +    arguments: '-i -t'
 +  }
   config.action_mailer.perform_deliveries = true
   config.action_mailer.raise_delivery_errors = true
 
 diff --git a/config/gitlab.yml.example b/config/gitlab.yml.example
-index bd696a7f2c..44e3863736 100644
+index 92e7501d49d..4ee5a1127df 100644
 --- a/config/gitlab.yml.example
 +++ b/config/gitlab.yml.example
-@@ -590,7 +590,7 @@ production: &base
+@@ -1168,7 +1168,7 @@ production: &base
   # CAUTION!
   # Use the default values unless you really know what you are doing
   git:
@ -31,10 +31,10 @@ index bd696a7f2c..44e3863736 100644
   ## Webpack settings
   # If enabled, this will tell rails to serve frontend assets from the webpack-dev-server running
 diff --git a/config/initializers/1_settings.rb b/config/initializers/1_settings.rb
-index 0bea8a4f4b..290248547b 100644
+index bbed08f5044..2906e5c44af 100644
 --- a/config/initializers/1_settings.rb
 +++ b/config/initializers/1_settings.rb
-@@ -177,7 +177,7 @@ Settings.gitlab['ssh_user'] ||= Settings.gitlab['user']
+@@ -183,7 +183,7 @@
 Settings.gitlab['user_home'] ||= begin
   Etc.getpwnam(Settings.gitlab['user']).dir
                                  rescue ArgumentError # no user configured
@ -43,7 +43,7 @@ index 0bea8a4f4b..290248547b 100644
 end
 Settings.gitlab['time_zone'] ||= nil
 Settings.gitlab['signup_enabled'] ||= true if Settings.gitlab['signup_enabled'].nil?
-@@ -507,7 +507,7 @@ Settings.backup['upload']['storage_class'] ||= nil
+@@ -751,7 +751,7 @@
 # Git
 #
 Settings['git'] ||= Settingslogic.new({})
@ -52,37 +52,94 @@ index 0bea8a4f4b..290248547b 100644
 
 # Important: keep the satellites.path setting until GitLab 9.0 at
 # least. This setting is fed to 'rm -rf' in
+diff --git a/config/puma.rb.example b/config/puma.rb.example
+index 9fc354a8fe8..2352ca9b58c 100644
+--- a/config/puma.rb.example
+++ b/config/puma.rb.example
+@@ -5,12 +5,8 @@
+ # The default is "config.ru".
+ #
+ rackup 'config.ru'
+-pidfile '/home/git/gitlab/tmp/pids/puma.pid'
+-state_path '/home/git/gitlab/tmp/pids/puma.state'
+-
+-stdout_redirect '/home/git/gitlab/log/puma.stdout.log',
+-  '/home/git/gitlab/log/puma.stderr.log',
+-  true
+pidfile ENV['PUMA_PATH'] + '/tmp/pids/puma.pid'
+state_path ENV['PUMA_PATH'] + '/tmp/pids/puma.state'
+ 
+ # Configure "min" to be the minimum number of threads to use to answer
+ # requests and "max" the maximum.
+@@ -31,12 +27,12 @@ queue_requests false
+ 
+ # Bind the server to "url". "tcp://", "unix://" and "ssl://" are the only
+ # accepted protocols.
+-bind 'unix:///home/git/gitlab/tmp/sockets/gitlab.socket'
+bind "unix://#{ENV['PUMA_PATH']}/tmp/sockets/gitlab.socket"
+ 
+ workers 3
+ 
+-require_relative "/home/git/gitlab/lib/gitlab/cluster/lifecycle_events"
+-require_relative "/home/git/gitlab/lib/gitlab/cluster/puma_worker_killer_initializer"
+require_relative ENV['GITLAB_PATH'] + "lib/gitlab/cluster/lifecycle_events"
+require_relative ENV['GITLAB_PATH'] + "lib/gitlab/cluster/puma_worker_killer_initializer"
+ 
+ on_restart do
+   # Signal application hooks that we're about to restart
+@@ -80,7 +76,7 @@ if defined?(nakayoshi_fork)
+ end
+ 
+ # Use json formatter
+-require_relative "/home/git/gitlab/lib/gitlab/puma_logging/json_formatter"
+require_relative ENV['GITLAB_PATH'] + "lib/gitlab/puma_logging/json_formatter"
+ 
+ json_formatter = Gitlab::PumaLogging::JSONFormatter.new
+ log_formatter do |str|
 diff --git a/lib/api/api.rb b/lib/api/api.rb
-index e953f3d2ec..3a8d9f076b 100644
+index ada0da28749..8a3f5824008 100644
 --- a/lib/api/api.rb
 +++ b/lib/api/api.rb
-@@ -2,7 +2,7 @@ module API
-   class API < Grape::API
+@@ -4,7 +4,7 @@ module API
+   class API < ::API::Base
     include APIGuard
 
 -    LOG_FILENAME = Rails.root.join("log", "api_json.log")
 +    LOG_FILENAME = File.join(ENV["GITLAB_LOG_PATH"], "api_json.log")
 
-     NO_SLASH_URL_PART_REGEX = %r{[^/]+}
-     PROJECT_ENDPOINT_REQUIREMENTS = { id: NO_SLASH_URL_PART_REGEX }.freeze
+     NO_SLASH_URL_PART_REGEX = %r{[^/]+}.freeze
+     NAMESPACE_OR_PROJECT_REQUIREMENTS = { id: NO_SLASH_URL_PART_REGEX }.freeze
+diff --git a/lib/gitlab/authorized_keys.rb b/lib/gitlab/authorized_keys.rb
+index 50cd15b7a10..3ac89e5b8e9 100644
+--- a/lib/gitlab/authorized_keys.rb
+++ b/lib/gitlab/authorized_keys.rb
+@@ -157,7 +157,7 @@ def command(id)
+         raise KeyError, "Invalid ID: #{id.inspect}"
+       end
+ 
+-      "#{File.join(Gitlab.config.gitlab_shell.path, 'bin', 'gitlab-shell')} #{id}"
+      "#{File.join('/run/current-system/sw/bin', 'gitlab-shell')} #{id}"
+     end
+ 
+     def strip(key)
 diff --git a/lib/gitlab/logger.rb b/lib/gitlab/logger.rb
-index a42e312b5d..ccaab9229e 100644
+index 89a4e36a232..ae379ffb27a 100644
 --- a/lib/gitlab/logger.rb
 +++ b/lib/gitlab/logger.rb
-@@ -26,7 +26,7 @@ module Gitlab
+@@ -37,7 +37,7 @@ def self.build
     end
 
     def self.full_log_path
 -      Rails.root.join("log", file_name)
-+        File.join(ENV["GITLAB_LOG_PATH"], file_name)
+      File.join(ENV["GITLAB_LOG_PATH"], file_name)
     end
 
     def self.cache_key
 diff --git a/lib/gitlab/uploads_transfer.rb b/lib/gitlab/uploads_transfer.rb
-index 7d7400bdab..cb25211d44 100644
+index e0e7084e27e..19fab855b90 100644
 --- a/lib/gitlab/uploads_transfer.rb
 +++ b/lib/gitlab/uploads_transfer.rb
-@@ -1,7 +1,7 @@
+@@ -3,7 +3,7 @@
 module Gitlab
   class UploadsTransfer < ProjectTransfer
     def root_dir
@ -92,10 +149,10 @@ index 7d7400bdab..cb25211d44 100644
   end
 end
 diff --git a/lib/system_check/app/log_writable_check.rb b/lib/system_check/app/log_writable_check.rb
-index 3e0c436d6e..28cefc5514 100644
+index 2c108f0c18d..3a16ff52d01 100644
 --- a/lib/system_check/app/log_writable_check.rb
 +++ b/lib/system_check/app/log_writable_check.rb
-@@ -21,7 +21,7 @@ module SystemCheck
+@@ -23,7 +23,7 @@ def show_error
       private
 
       def log_path
@ -105,10 +162,10 @@ index 3e0c436d6e..28cefc5514 100644
     end
   end
 diff --git a/lib/system_check/app/uploads_directory_exists_check.rb b/lib/system_check/app/uploads_directory_exists_check.rb
-index 7026d0ba07..c56e1f7ed9 100644
+index 54dff63ab61..882da702f29 100644
 --- a/lib/system_check/app/uploads_directory_exists_check.rb
 +++ b/lib/system_check/app/uploads_directory_exists_check.rb
-@@ -4,12 +4,13 @@ module SystemCheck
+@@ -6,12 +6,13 @@ class UploadsDirectoryExistsCheck < SystemCheck::BaseCheck
       set_name 'Uploads directory exists?'
 
       def check?
@ -120,15 +177,15 @@ index 7026d0ba07..c56e1f7ed9 100644
 +        uploads_dir = ENV['GITLAB_UPLOADS_PATH'] || Rails.root.join('public/uploads')
         try_fixing_it(
 -          "sudo -u #{gitlab_user} mkdir #{Rails.root}/public/uploads"
-+            "sudo -u #{gitlab_user} mkdir #{uploads_dir}"
+          "sudo -u #{gitlab_user} mkdir #{uploads_dir}"
         )
         for_more_information(
-           see_installation_guide_section 'GitLab'
+           see_installation_guide_section('GitLab')
 diff --git a/lib/system_check/app/uploads_path_permission_check.rb b/lib/system_check/app/uploads_path_permission_check.rb
-index 7df6c06025..bb447c16b2 100644
+index 2e1cc687c43..ca69d63bcf6 100644
 --- a/lib/system_check/app/uploads_path_permission_check.rb
 +++ b/lib/system_check/app/uploads_path_permission_check.rb
-@@ -25,7 +25,7 @@ module SystemCheck
+@@ -27,7 +27,7 @@ def show_error
       private
 
       def rails_uploads_path
@ -138,10 +195,10 @@ index 7df6c06025..bb447c16b2 100644
 
       def uploads_fullpath
 diff --git a/lib/system_check/app/uploads_path_tmp_permission_check.rb b/lib/system_check/app/uploads_path_tmp_permission_check.rb
-index b276a81eac..070e3ebd81 100644
+index 567c7540777..29906b1c132 100644
 --- a/lib/system_check/app/uploads_path_tmp_permission_check.rb
 +++ b/lib/system_check/app/uploads_path_tmp_permission_check.rb
-@@ -33,7 +33,7 @@ module SystemCheck
+@@ -35,7 +35,7 @@ def upload_path_tmp
       end
 
       def uploads_fullpath
@ -150,14 +207,3 @@ index b276a81eac..070e3ebd81 100644
       end
     end
   end
--- a/lib/gitlab/authorized_keys.rb
-+++ b/lib/gitlab/authorized_keys.rb
-@@ -157,7 +157,7 @@
-         raise KeyError, "Invalid ID: #{id.inspect}"
-       end
- 
-      "#{File.join(Gitlab.config.gitlab_shell.path, 'bin', 'gitlab-shell')} #{id}"
-+      "#{File.join('/run/current-system/sw/bin', 'gitlab-shell')} #{id}"
-     end
- 
-     def strip(key)
--- a/pkgs/applications/video/tartube/default.nix
+++ b/pkgs/applications/video/tartube/default.nix
@ -15,13 +15,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "tartube";
-  version = "2.3.085";
+  version = "2.3.110";

  src = fetchFromGitHub {
    owner = "axcore";
    repo = "tartube";
    rev = "v${version}";
-    sha256 = "bkz64nj6748552ZMRcL/I1lUXGpZjaATUEqv3Kkphck=";
+    sha256 = "0sdbd2lsc4bvgkwi55arjwbzwmq05abfmv6vsrvz4gsdv8s8wha5";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/window-managers/i3/status-rust.nix
+++ b/pkgs/applications/window-managers/i3/status-rust.nix
@ -6,25 +6,26 @@
 , dbus
 , libpulseaudio
 , notmuch
+, openssl
 , ethtool
 }:

 rustPlatform.buildRustPackage rec {
  pname = "i3status-rust";
-  version = "0.14.3";
+  version = "0.14.7";

  src = fetchFromGitHub {
    owner = "greshake";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1k9dgmd4wz9950kr35da31rhph43gmvg8dif7hg1xw41xch6bi60";
+    sha256 = "1ndqh4bzwim32n8psgsgdd47xmlb45rhvcwla1wm506byb21nk4c";
  };

-  cargoSha256 = "0qqkcgl9iz4kxl1a2vv2p7vy7wxn970y28jynf3n7hfp16i3liy2";
+  cargoSha256 = "098dzwqwbhcyswm73m880z0w03i7xrq56x79vfyvacw4k27q2zm9";

  nativeBuildInputs = [ pkg-config makeWrapper ];

-  buildInputs = [ dbus libpulseaudio notmuch ];
+  buildInputs = [ dbus libpulseaudio notmuch openssl ];

  cargoBuildFlags = [
    "--features=notmuch"
--- a/pkgs/data/fonts/iosevka/bin.nix
+++ b/pkgs/data/fonts/iosevka/bin.nix
@ -10,7 +10,7 @@ let
    (builtins.attrNames (builtins.removeAttrs variantHashes [ "iosevka" ]));
 in stdenv.mkDerivation rec {
  pname = "${name}-bin";
-  version = "5.0.3";
+  version = "5.0.4";

  src = fetchurl {
    url = "https://github.com/be5invis/Iosevka/releases/download/v${version}/ttc-${name}-${version}.zip";
--- a/pkgs/data/fonts/iosevka/variants.nix
+++ b/pkgs/data/fonts/iosevka/variants.nix
@ -1,26 +1,26 @@
 # This file was autogenerated. DO NOT EDIT!
 {
-  iosevka = "1w1y543iypvhwx27qswkvhhiwzd3ik2jklapz2g497f3ppj834g4";
-  iosevka-aile = "12dybqmcpq83xiw4k9m9fmkhj204sxb9hnqndb212vvgj3vbl0fm";
-  iosevka-curly = "09rl8l9jkqhq811h35x15s4gssig0xrzvas154gg5igrdqha5kk8";
-  iosevka-curly-slab = "19l13inmnaysz2mp7x4rh4zffa5n8qd3n727j54dd2581g9f0n9c";
-  iosevka-etoile = "0flsdjdq0jsfblnazdw82kflzwvjvqaxzsyifgbn4flgjwy46mhm";
-  iosevka-slab = "04wg7aklybwrbali53c22fs5xfgacyfkxw20bhnxqbfcsykriz11";
-  iosevka-ss01 = "07a6ghjzk8kf266bgqv8khx54cxl2hfkqnjq6n5s3bbahbs3fh4x";
-  iosevka-ss02 = "06prf0jigh1xi00lg46qw4kp416psv1xkijdpbvjkmxgmcbnqx2s";
-  iosevka-ss03 = "03ga07y7nmcky3dschlk4cjg3lcxjqra6wvsb8q9vc39qz01cnxr";
-  iosevka-ss04 = "0d17p18kbh78f4w0pvslh3r0a52d207dyp4njrqxnpzjn2w8w1kg";
-  iosevka-ss05 = "1qh1z1kffid718h2mc0f6wygkwkpc1rlj29h2ljigv8kdp4kcik6";
-  iosevka-ss06 = "0b6gn7j5qa23qpay08ri6z9jrqkcsb8m67d84bqs419rw0wdhmfr";
-  iosevka-ss07 = "0f5bj8vn9frmmhg5b971gav7379xwlg439sm2vi79vjqlp5ls5gy";
-  iosevka-ss08 = "0vqhywgly5w2j0nwmspa2ba7rk1n4jsb3lidngnpkpvpkr2w1n7z";
-  iosevka-ss09 = "1ysb28qwqjkxissqsiz67l3fj5kflf94baxwjjvqqi67f72kq8m4";
-  iosevka-ss10 = "11sdzyplb1bf8blzmj40brdnvy6z6yghvh91k27bf73rgdby7svk";
-  iosevka-ss11 = "0jrn998c8jrkjw7sa429kkgpfp897gdbikr0j9sc5b0fyjci0qdx";
-  iosevka-ss12 = "1qrnp3s3abxryi2nf8x4m5l7z83iklksr8mgwcxi07cfi8ix87jr";
-  iosevka-ss13 = "0hs3m1vc3l54xj4flgyr8m4mklgqlzf3ffcvwlp8i4a5b9cdxczh";
-  iosevka-ss14 = "112l7skaplmrn16h8lw5288ivcw1wm7mvilqrmdgswmvyxkpqdzg";
-  iosevka-ss15 = "13bbgjmw20d1dr6h8ckc2zaq0bilx494g5p94a2ighdm5d4sbk4y";
-  iosevka-ss16 = "180qfpp9ixjznk7srijbj1l2dzshb9wayqgvfmgqhl94fif23bja";
-  iosevka-ss17 = "0f1r0zad32mdqgd0ik08q07ni46w6dm93npz633azn3l9ch6hd41";
+  iosevka = "0g32pzxij72fjy0ycwzy23dg06ypmxcg24dk4scvhjp9b5ajx79k";
+  iosevka-aile = "0yynkwhanza4y593ajn8hkshk46dl9g84qf1shmy21wd3lqr7psx";
+  iosevka-curly = "0zd5hh0hr6prn32yd7fibl2wighv9f6p7jwgfrwcizljai44adnx";
+  iosevka-curly-slab = "147bzw9lr8f54yh0hv8887sxy4571563mxjcag0dfw8z3rfffw8c";
+  iosevka-etoile = "04jjg4vp0fag7xgiqxnql60gyvlpjmgqqj5q4j3rys9nyw3pl0gi";
+  iosevka-slab = "10qwardvknnw6l3yiyji9v02450vfj76lvnlszijv78lfm1xp1qk";
+  iosevka-ss01 = "12z1yjspzcbzgs224n1dxis4ghybfkzpw4dwr1wzza553kplwz6w";
+  iosevka-ss02 = "08vrlzcyqa83mn2155p4h6hsk20jx3sv0yqimxfsyrwcalc63dcq";
+  iosevka-ss03 = "0rhp4rdza36hazs20h4bk524xsgx54pxbw69k235km71m9x6ba59";
+  iosevka-ss04 = "1ijjcy8z0fbfrw2fjqnmxbi9l6r41sixk72h3vp75gzrkq7dbh86";
+  iosevka-ss05 = "06q9wxkyp7iv9pz3xj6d3v8ay82425wcgl9dybr3dfp4mcsdn7zz";
+  iosevka-ss06 = "10pdw28dgdk5343rzbbj5mgmagv4ndl2gg4f02kzq0vlv5xh8vj6";
+  iosevka-ss07 = "16xym710sq398zi223cjzxpcblc851ypl7v2dzhvskgsasvj4ypr";
+  iosevka-ss08 = "14mqs6gi71p544asr1sz48g6q9zl6zj6sadhhcf8gdsnwa475ds2";
+  iosevka-ss09 = "049va8vpzjczslirsxklwcpcsiaqrpc2zm9rmnf5qfyf7f1rn4yd";
+  iosevka-ss10 = "1g8s9d7vlb2yx5d8cgsxcl5hb38g1f80d3l04lj2gr22lzk0y271";
+  iosevka-ss11 = "15j3wfz8ybszp702c8ycv8kwnbdpa07w8kw9njhsfzvb5iw1xx0i";
+  iosevka-ss12 = "1k5250sik2yfa5s5dxaqp0s45wfbxh1s1xn06qjj81ywmw9hy6yg";
+  iosevka-ss13 = "1ym8mn2qqwys01wrkplx11kajkfi0x5vzn8m234cbzn8drlgh0l5";
+  iosevka-ss14 = "0wkc7kwz6bzxxijycm4d4samy83zsghd8lyq0yn6g48rb6kj9fgw";
+  iosevka-ss15 = "0j46sr85vcq25n8ia7nk8rgr3rmgr69wwf7pgllllscablacw73k";
+  iosevka-ss16 = "017vipi1cmcjglx0x6da6ans1bsr3xlr43n4mv5qj7h50j1dv3l6";
+  iosevka-ss17 = "0kbvy54v543znrzb9584mv6h96hfp9fndxb6wg32clqhzm2yh7fw";
 }
--- a/pkgs/desktops/gnome-3/core/gnome-tour/default.nix
+++ b/pkgs/desktops/gnome-3/core/gnome-tour/default.nix
@ -1,4 +1,5 @@
 { lib
+, stdenv
 , rustPlatform
 , gettext
 , meson
@ -15,9 +16,11 @@
 , gnome3
 , libhandy
 , librsvg
+, rustc
+, cargo
 }:

-rustPlatform.buildRustPackage rec {
+stdenv.mkDerivation rec {
  pname = "gnome-tour";
  version = "3.38.0";

@ -30,6 +33,7 @@ rustPlatform.buildRustPackage rec {

  nativeBuildInputs = [
    appstream-glib
+    cargo
    desktop-file-utils
    gettext
    glib # glib-compile-resources
@ -37,6 +41,8 @@ rustPlatform.buildRustPackage rec {
    ninja
    pkg-config
    python3
+    rustPlatform.cargoSetupHook
+    rustc
    wrapGAppsHook
  ];

@ -48,12 +54,6 @@ rustPlatform.buildRustPackage rec {
    librsvg
  ];

-  # Don't use buildRustPackage phases, only use it for rust deps setup
-  configurePhase = null;
-  buildPhase = null;
-  checkPhase = null;
-  installPhase = null;
-
  postPatch = ''
    chmod +x build-aux/meson_post_install.py
    patchShebangs build-aux/meson_post_install.py
--- a/pkgs/development/compilers/gleam/default.nix
+++ b/pkgs/development/compilers/gleam/default.nix
@ -2,13 +2,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "gleam";
-  version = "0.14.0";
+  version = "0.14.1";

  src = fetchFromGitHub {
    owner = "gleam-lang";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-ujQ7emfGhzpRGeZ6RGZ57hFX4aIflTcwE9IEUMYb/ZI=";
+    sha256 = "sha256-KAcb+YNfdNc5LJIApuzjXKnPTFOK0C5Jui32nij4O4U=";
  };

  nativeBuildInputs = [ pkg-config ];
@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
  buildInputs = [ openssl ] ++
    lib.optionals stdenv.isDarwin [ Security ];

-  cargoSha256 = "sha256-/SudEQynLkLl7Y731Uqm9AkEugTCnq4PFFRQcwz+qL8=";
+  cargoSha256 = "sha256-Hxat6UZziIxHGLPydnnmgzdwtvjaeeqOgD+ZC823uJU=";

  meta = with lib; {
    description = "A statically typed language for the Erlang VM";
--- a/pkgs/development/libraries/armadillo/default.nix
+++ b/pkgs/development/libraries/armadillo/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "armadillo";
-  version = "10.2.1";
+  version = "10.2.2";

  src = fetchurl {
    url = "mirror://sourceforge/arma/armadillo-${version}.tar.xz";
-    sha256 = "sha256-fY500kh2mvI/yJTYu4jwXjIxeTPL5NqPPFa+j4mp/MQ=";
+    sha256 = "sha256-lClfxi7MQ3PlqWx7Yrkj/XGoHzFaqVl7KCqv2FWelDU=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/libraries/bashup-events/generic.nix
+++ b/pkgs/development/libraries/bashup-events/generic.nix
@ -1,8 +1,6 @@
 {
  # general
  lib
-, callPackage
-, runCommand
 , resholvePackage
 , bash
 , shellcheck
@ -46,7 +44,9 @@ resholvePackage rec {
  inherit src;

  installPhase = ''
+    runHook preInstall
    install -Dt $out/bin bashup.events
+    runHook postInstall
  '';

  inherit doCheck;
@ -54,9 +54,11 @@ resholvePackage rec {

  # check based on https://github.com/bashup/events/blob/master/.dkrc
  checkPhase = ''
+    runHook preCheck
    SHELLCHECK_OPTS='-e SC2016,SC2145' ${shellcheck}/bin/shellcheck ./bashup.events
    ${bash}/bin/bash -n ./bashup.events
    ${bash}/bin/bash ./bashup.events
+    runHook postCheck
  '';

  solutions = {
@ -70,7 +72,11 @@ resholvePackage rec {

  inherit doInstallCheck;
  installCheckInputs = [ bash ];
-  installCheckPhase = installCheck "${bash}/bin/bash";
+  installCheckPhase = ''
+    runHook preInstallCheck
+    ${installCheck "${bash}/bin/bash"}
+    runHook postInstallCheck
+  '';

  meta = with lib; {
    inherit branch;
--- a/pkgs/development/libraries/crypto++/default.nix
+++ b/pkgs/development/libraries/crypto++/default.nix
@ -21,6 +21,14 @@ stdenv.mkDerivation rec {
    substituteInPlace GNUmakefile \
        --replace "AR = libtool" "AR = ar" \
        --replace "ARFLAGS = -static -o" "ARFLAGS = -cru"
+
+    # See https://github.com/weidai11/cryptopp/issues/1011
+    substituteInPlace GNUmakefile \
+      --replace "ZOPT = -O0" "ZOPT ="
+  '';
+
+  preConfigure = ''
+    sh TestScripts/configure.sh
  '';

  makeFlags = [ "PREFIX=${placeholder "out"}" ];
--- a/pkgs/development/libraries/geos/default.nix
+++ b/pkgs/development/libraries/geos/default.nix
@ -1,10 +1,11 @@
 { lib, stdenv, fetchurl, python }:

 stdenv.mkDerivation rec {
-  name = "geos-3.9.1";
+  pname = "geos";
+  version = "3.9.1";

  src = fetchurl {
-    url = "https://download.osgeo.org/geos/${name}.tar.bz2";
+    url = "https://download.osgeo.org/geos/${pname}-${version}.tar.bz2";
    sha256 = "sha256-fmMFB9ysncB1ZdJJom8GoVyfWwxS3SkSmg49OB1+OCo=";
  };

@ -18,6 +19,6 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "C++ port of the Java Topology Suite (JTS)";
    homepage = "https://trac.osgeo.org/geos";
-    license = licenses.lgpl21;
+    license = licenses.lgpl21Only;
  };
 }
--- a/pkgs/development/libraries/libnbd/default.nix
+++ b/pkgs/development/libraries/libnbd/default.nix
@ -0,0 +1,61 @@
+{ lib
+, stdenv
+, fetchurl
+, bash-completion
+, pkg-config
+, perl
+, libxml2
+, fuse
+, gnutls
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libnbd";
+  version = "1.7.2";
+
+  src = fetchurl {
+    url = "https://download.libguestfs.org/libnbd/${lib.versions.majorMinor version}-development/${pname}-${version}.tar.gz";
+    hash = "sha256-+xC4wDEeWi3RteF04C/qjMmjM+lmhtrtXZZyM1UUli4=";
+  };
+
+  nativeBuildInputs = [
+    bash-completion
+    pkg-config
+    perl
+  ];
+  buildInputs = [
+    fuse
+    gnutls
+    libxml2
+  ];
+
+  installFlags = [ "bashcompdir=$(out)/share/bash-completion/completions" ];
+
+  meta = with lib; {
+    homepage = "https://gitlab.com/nbdkit/libnbd";
+    description = "Network Block Device client library in userspace";
+    longDescription = ''
+      NBD — Network Block Device — is a protocol for accessing Block Devices
+      (hard disks and disk-like things) over a Network.  This is the NBD client
+      library in userspace, a simple library for writing NBD clients.
+
+      The key features are:
+      - Synchronous API for ease of use.
+      - Asynchronous API for writing non-blocking, multithreaded clients. You
+        can mix both APIs freely.
+      - High performance.
+      - Minimal dependencies for the basic library.
+      - Well-documented, stable API.
+      - Bindings in several programming languages.
+      - Shell (nbdsh) for command line and scripting.
+    '';
+    license = with licenses; lgpl21Plus;
+    maintainers = with maintainers; [ AndersonTorres ];
+    platforms = with platforms; linux;
+  };
+}
+# TODO: NBD URI support apparently is not enabled
+# TODO: package the 1.6-stable version too
+# TODO: git version needs ocaml
+# TODO: bindings for go, ocaml and python
+
--- a/pkgs/development/libraries/libxcrypt/default.nix
+++ b/pkgs/development/libraries/libxcrypt/default.nix
@ -0,0 +1,30 @@
+{ lib, stdenv, fetchFromGitHub, autoconf, automake, libtool, pkg-config, perl }:
+
+stdenv.mkDerivation rec {
+  pname = "libxcrypt";
+  version = "4.4.18";
+
+  src = fetchFromGitHub {
+    owner = "besser82";
+    repo = "libxcrypt";
+    rev = "v${version}";
+    sha256 = "4015bf1b3a2aab31da5a544424be36c1a0f0ffc1eaa219c0e7b048e4cdcbbfe1";
+  };
+
+  preConfigure = ''
+    patchShebangs autogen.sh
+    ./autogen.sh
+  '';
+
+  nativeBuildInputs = [ autoconf automake libtool pkg-config perl ];
+
+  doCheck = true;
+
+  meta = with lib; {
+    description = "Extended crypt library for descrypt, md5crypt, bcrypt, and others";
+    homepage = "https://github.com/besser82/libxcrypt/";
+    platforms = platforms.all;
+    maintainers = with maintainers; [ dottedmag ];
+    license = licenses.lgpl21Plus;
+  };
+}
--- a/pkgs/development/libraries/qt-5/5.12/default.nix
+++ b/pkgs/development/libraries/qt-5/5.12/default.nix
@ -99,6 +99,7 @@ let
        sha256 = "0h8ymfnwgkjkwaankr3iifiscsvngqpwb91yygndx344qdiw9y0n";
      })
      ./qtwebkit.patch
+      ./qtwebkit-icu68.patch

      ./qtwebkit-darwin-no-readline.patch
      ./qtwebkit-darwin-no-qos-classes.patch
--- a/pkgs/development/libraries/qt-5/5.12/qtwebkit-icu68.patch
+++ b/pkgs/development/libraries/qt-5/5.12/qtwebkit-icu68.patch
@ -0,0 +1,170 @@
+Regressed by https://github.com/unicode-org/icu/commit/c3fe7e09d844
+
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:31:
+Source/WebCore/platform/text/TextCodecICU.cpp:311:42: error: use of undeclared identifier 'TRUE'
+        ucnv_setFallback(m_converterICU, TRUE);
+                                         ^
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:40:
+In file included from Source/WebCore/platform/text/icu/UTextProvider.cpp:27:
+Source/WebCore/platform/text/icu/UTextProvider.h:83:28: error: use of undeclared identifier 'TRUE'
+            isAccessible = TRUE;
+                           ^
+Source/WebCore/platform/text/icu/UTextProvider.h:88:28: error: use of undeclared identifier 'FALSE'
+            isAccessible = FALSE;
+                           ^
+Source/WebCore/platform/text/icu/UTextProvider.h:97:28: error: use of undeclared identifier 'TRUE'
+            isAccessible = TRUE;
+                           ^
+Source/WebCore/platform/text/icu/UTextProvider.h:102:28: error: use of undeclared identifier 'FALSE'
+            isAccessible = FALSE;
+                           ^
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:41:
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:103:20: error: use of undeclared identifier 'TRUE'
+            return TRUE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:108:20: error: use of undeclared identifier 'FALSE'
+            return FALSE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:114:20: error: use of undeclared identifier 'TRUE'
+            return TRUE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:119:20: error: use of undeclared identifier 'FALSE'
+            return FALSE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:147:12: error: use of undeclared identifier 'TRUE'
+    return TRUE;
+           ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:339:16: error: use of undeclared identifier 'FALSE'
+        return FALSE;
+               ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:359:12: error: use of undeclared identifier 'TRUE'
+    return TRUE;
+           ^
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:42:
+Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp:128:16: error: use of undeclared identifier 'FALSE'
+        return FALSE;
+               ^
+Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp:148:12: error: use of undeclared identifier 'TRUE'
+    return TRUE;
+           ^
+
+--- a/Source/WebCore/platform/text/TextCodecICU.cpp
+++ b/Source/WebCore/platform/text/TextCodecICU.cpp
+@@ -308,7 +308,7 @@ void TextCodecICU::createICUConverter() const
+     m_converterICU = ucnv_open(m_canonicalConverterName, &err);
+     ASSERT(U_SUCCESS(err));
+     if (m_converterICU)
+-        ucnv_setFallback(m_converterICU, TRUE);
+        ucnv_setFallback(m_converterICU, true);
+ }
+ 
+ int TextCodecICU::decodeToBuffer(UChar* target, UChar* targetLimit, const char*& source, const char* sourceLimit, int32_t* offsets, bool flush, UErrorCode& err)
+--- a/Source/WebCore/platform/text/icu/UTextProvider.h
+++ b/Source/WebCore/platform/text/icu/UTextProvider.h
+@@ -80,12 +80,12 @@ inline bool uTextAccessInChunkOrOutOfRange(UText* text
+             // Ensure chunk offset is well formed if computed offset exceeds int32_t range.
+             ASSERT(offset < std::numeric_limits<int32_t>::max());
+             text->chunkOffset = offset < std::numeric_limits<int32_t>::max() ? static_cast<int32_t>(offset) : 0;
+-            isAccessible = TRUE;
+            isAccessible = true;
+             return true;
+         }
+         if (nativeIndex >= nativeLength && text->chunkNativeLimit == nativeLength) {
+             text->chunkOffset = text->chunkLength;
+-            isAccessible = FALSE;
+            isAccessible = false;
+             return true;
+         }
+     } else {
+@@ -94,12 +94,12 @@ inline bool uTextAccessInChunkOrOutOfRange(UText* text
+             // Ensure chunk offset is well formed if computed offset exceeds int32_t range.
+             ASSERT(offset < std::numeric_limits<int32_t>::max());
+             text->chunkOffset = offset < std::numeric_limits<int32_t>::max() ? static_cast<int32_t>(offset) : 0;
+-            isAccessible = TRUE;
+            isAccessible = true;
+             return true;
+         }
+         if (nativeIndex <= 0 && !text->chunkNativeStart) {
+             text->chunkOffset = 0;
+-            isAccessible = FALSE;
+            isAccessible = false;
+             return true;
+         }
+     }
+--- a/Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp
+++ b/Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp
+@@ -100,23 +100,23 @@ static UBool uTextLatin1Access(UText* uText, int64_t i
+         if (index < uText->chunkNativeLimit && index >= uText->chunkNativeStart) {
+             // Already inside the buffer. Set the new offset.
+             uText->chunkOffset = static_cast<int32_t>(index - uText->chunkNativeStart);
+-            return TRUE;
+            return true;
+         }
+         if (index >= length && uText->chunkNativeLimit == length) {
+             // Off the end of the buffer, but we can't get it.
+             uText->chunkOffset = static_cast<int32_t>(index - uText->chunkNativeStart);
+-            return FALSE;
+            return false;
+         }
+     } else {
+         if (index <= uText->chunkNativeLimit && index > uText->chunkNativeStart) {
+             // Already inside the buffer. Set the new offset.
+             uText->chunkOffset = static_cast<int32_t>(index - uText->chunkNativeStart);
+-            return TRUE;
+            return true;
+         }
+         if (!index && !uText->chunkNativeStart) {
+             // Already at the beginning; can't go any farther.
+             uText->chunkOffset = 0;
+-            return FALSE;
+            return false;
+         }
+     }
+     
+@@ -144,7 +144,7 @@ static UBool uTextLatin1Access(UText* uText, int64_t i
+ 
+     uText->nativeIndexingLimit = uText->chunkLength;
+ 
+-    return TRUE;
+    return true;
+ }
+ 
+ static int32_t uTextLatin1Extract(UText* uText, int64_t start, int64_t limit, UChar* dest, int32_t destCapacity, UErrorCode* status)
+@@ -336,7 +336,7 @@ static int64_t uTextLatin1ContextAwareNativeLength(UTe
+ static UBool uTextLatin1ContextAwareAccess(UText* text, int64_t nativeIndex, UBool forward)
+ {
+     if (!text->context)
+-        return FALSE;
+        return false;
+     int64_t nativeLength = uTextLatin1ContextAwareNativeLength(text);
+     UBool isAccessible;
+     if (uTextAccessInChunkOrOutOfRange(text, nativeIndex, nativeLength, forward, isAccessible))
+@@ -356,7 +356,7 @@ static UBool uTextLatin1ContextAwareAccess(UText* text
+         ASSERT(newContext == UTextProviderContext::PriorContext);
+         textLatin1ContextAwareSwitchToPriorContext(text, nativeIndex, nativeLength, forward);
+     }
+-    return TRUE;
+    return true;
+ }
+ 
+ static int32_t uTextLatin1ContextAwareExtract(UText*, int64_t, int64_t, UChar*, int32_t, UErrorCode* errorCode)
+--- a/Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp
+++ b/Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp
+@@ -125,7 +125,7 @@ static inline int64_t uTextUTF16ContextAwareNativeLeng
+ static UBool uTextUTF16ContextAwareAccess(UText* text, int64_t nativeIndex, UBool forward)
+ {
+     if (!text->context)
+-        return FALSE;
+        return false;
+     int64_t nativeLength = uTextUTF16ContextAwareNativeLength(text);
+     UBool isAccessible;
+     if (uTextAccessInChunkOrOutOfRange(text, nativeIndex, nativeLength, forward, isAccessible))
+@@ -145,7 +145,7 @@ static UBool uTextUTF16ContextAwareAccess(UText* text,
+         ASSERT(newContext == UTextProviderContext::PriorContext);
+         textUTF16ContextAwareSwitchToPriorContext(text, nativeIndex, nativeLength, forward);
+     }
+-    return TRUE;
+    return true;
+ }
+ 
+ static int32_t uTextUTF16ContextAwareExtract(UText*, int64_t, int64_t, UChar*, int32_t, UErrorCode* errorCode)
--- a/pkgs/development/libraries/qt-5/5.14/default.nix
+++ b/pkgs/development/libraries/qt-5/5.14/default.nix
@ -112,6 +112,7 @@ let
        sha256 = "0h8ymfnwgkjkwaankr3iifiscsvngqpwb91yygndx344qdiw9y0n";
      })
      ./qtwebkit.patch
+      ./qtwebkit-icu68.patch
    ] ++ optionals stdenv.isDarwin [
      ./qtwebkit-darwin-no-readline.patch
      ./qtwebkit-darwin-no-qos-classes.patch
--- a/pkgs/development/libraries/qt-5/5.14/qtwebkit-icu68.patch
+++ b/pkgs/development/libraries/qt-5/5.14/qtwebkit-icu68.patch
@ -0,0 +1,170 @@
+Regressed by https://github.com/unicode-org/icu/commit/c3fe7e09d844
+
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:31:
+Source/WebCore/platform/text/TextCodecICU.cpp:311:42: error: use of undeclared identifier 'TRUE'
+        ucnv_setFallback(m_converterICU, TRUE);
+                                         ^
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:40:
+In file included from Source/WebCore/platform/text/icu/UTextProvider.cpp:27:
+Source/WebCore/platform/text/icu/UTextProvider.h:83:28: error: use of undeclared identifier 'TRUE'
+            isAccessible = TRUE;
+                           ^
+Source/WebCore/platform/text/icu/UTextProvider.h:88:28: error: use of undeclared identifier 'FALSE'
+            isAccessible = FALSE;
+                           ^
+Source/WebCore/platform/text/icu/UTextProvider.h:97:28: error: use of undeclared identifier 'TRUE'
+            isAccessible = TRUE;
+                           ^
+Source/WebCore/platform/text/icu/UTextProvider.h:102:28: error: use of undeclared identifier 'FALSE'
+            isAccessible = FALSE;
+                           ^
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:41:
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:103:20: error: use of undeclared identifier 'TRUE'
+            return TRUE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:108:20: error: use of undeclared identifier 'FALSE'
+            return FALSE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:114:20: error: use of undeclared identifier 'TRUE'
+            return TRUE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:119:20: error: use of undeclared identifier 'FALSE'
+            return FALSE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:147:12: error: use of undeclared identifier 'TRUE'
+    return TRUE;
+           ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:339:16: error: use of undeclared identifier 'FALSE'
+        return FALSE;
+               ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:359:12: error: use of undeclared identifier 'TRUE'
+    return TRUE;
+           ^
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:42:
+Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp:128:16: error: use of undeclared identifier 'FALSE'
+        return FALSE;
+               ^
+Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp:148:12: error: use of undeclared identifier 'TRUE'
+    return TRUE;
+           ^
+
+--- a/Source/WebCore/platform/text/TextCodecICU.cpp
+++ b/Source/WebCore/platform/text/TextCodecICU.cpp
+@@ -308,7 +308,7 @@ void TextCodecICU::createICUConverter() const
+     m_converterICU = ucnv_open(m_canonicalConverterName, &err);
+     ASSERT(U_SUCCESS(err));
+     if (m_converterICU)
+-        ucnv_setFallback(m_converterICU, TRUE);
+        ucnv_setFallback(m_converterICU, true);
+ }
+ 
+ int TextCodecICU::decodeToBuffer(UChar* target, UChar* targetLimit, const char*& source, const char* sourceLimit, int32_t* offsets, bool flush, UErrorCode& err)
+--- a/Source/WebCore/platform/text/icu/UTextProvider.h
+++ b/Source/WebCore/platform/text/icu/UTextProvider.h
+@@ -80,12 +80,12 @@ inline bool uTextAccessInChunkOrOutOfRange(UText* text
+             // Ensure chunk offset is well formed if computed offset exceeds int32_t range.
+             ASSERT(offset < std::numeric_limits<int32_t>::max());
+             text->chunkOffset = offset < std::numeric_limits<int32_t>::max() ? static_cast<int32_t>(offset) : 0;
+-            isAccessible = TRUE;
+            isAccessible = true;
+             return true;
+         }
+         if (nativeIndex >= nativeLength && text->chunkNativeLimit == nativeLength) {
+             text->chunkOffset = text->chunkLength;
+-            isAccessible = FALSE;
+            isAccessible = false;
+             return true;
+         }
+     } else {
+@@ -94,12 +94,12 @@ inline bool uTextAccessInChunkOrOutOfRange(UText* text
+             // Ensure chunk offset is well formed if computed offset exceeds int32_t range.
+             ASSERT(offset < std::numeric_limits<int32_t>::max());
+             text->chunkOffset = offset < std::numeric_limits<int32_t>::max() ? static_cast<int32_t>(offset) : 0;
+-            isAccessible = TRUE;
+            isAccessible = true;
+             return true;
+         }
+         if (nativeIndex <= 0 && !text->chunkNativeStart) {
+             text->chunkOffset = 0;
+-            isAccessible = FALSE;
+            isAccessible = false;
+             return true;
+         }
+     }
+--- a/Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp
+++ b/Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp
+@@ -100,23 +100,23 @@ static UBool uTextLatin1Access(UText* uText, int64_t i
+         if (index < uText->chunkNativeLimit && index >= uText->chunkNativeStart) {
+             // Already inside the buffer. Set the new offset.
+             uText->chunkOffset = static_cast<int32_t>(index - uText->chunkNativeStart);
+-            return TRUE;
+            return true;
+         }
+         if (index >= length && uText->chunkNativeLimit == length) {
+             // Off the end of the buffer, but we can't get it.
+             uText->chunkOffset = static_cast<int32_t>(index - uText->chunkNativeStart);
+-            return FALSE;
+            return false;
+         }
+     } else {
+         if (index <= uText->chunkNativeLimit && index > uText->chunkNativeStart) {
+             // Already inside the buffer. Set the new offset.
+             uText->chunkOffset = static_cast<int32_t>(index - uText->chunkNativeStart);
+-            return TRUE;
+            return true;
+         }
+         if (!index && !uText->chunkNativeStart) {
+             // Already at the beginning; can't go any farther.
+             uText->chunkOffset = 0;
+-            return FALSE;
+            return false;
+         }
+     }
+     
+@@ -144,7 +144,7 @@ static UBool uTextLatin1Access(UText* uText, int64_t i
+ 
+     uText->nativeIndexingLimit = uText->chunkLength;
+ 
+-    return TRUE;
+    return true;
+ }
+ 
+ static int32_t uTextLatin1Extract(UText* uText, int64_t start, int64_t limit, UChar* dest, int32_t destCapacity, UErrorCode* status)
+@@ -336,7 +336,7 @@ static int64_t uTextLatin1ContextAwareNativeLength(UTe
+ static UBool uTextLatin1ContextAwareAccess(UText* text, int64_t nativeIndex, UBool forward)
+ {
+     if (!text->context)
+-        return FALSE;
+        return false;
+     int64_t nativeLength = uTextLatin1ContextAwareNativeLength(text);
+     UBool isAccessible;
+     if (uTextAccessInChunkOrOutOfRange(text, nativeIndex, nativeLength, forward, isAccessible))
+@@ -356,7 +356,7 @@ static UBool uTextLatin1ContextAwareAccess(UText* text
+         ASSERT(newContext == UTextProviderContext::PriorContext);
+         textLatin1ContextAwareSwitchToPriorContext(text, nativeIndex, nativeLength, forward);
+     }
+-    return TRUE;
+    return true;
+ }
+ 
+ static int32_t uTextLatin1ContextAwareExtract(UText*, int64_t, int64_t, UChar*, int32_t, UErrorCode* errorCode)
+--- a/Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp
+++ b/Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp
+@@ -125,7 +125,7 @@ static inline int64_t uTextUTF16ContextAwareNativeLeng
+ static UBool uTextUTF16ContextAwareAccess(UText* text, int64_t nativeIndex, UBool forward)
+ {
+     if (!text->context)
+-        return FALSE;
+        return false;
+     int64_t nativeLength = uTextUTF16ContextAwareNativeLength(text);
+     UBool isAccessible;
+     if (uTextAccessInChunkOrOutOfRange(text, nativeIndex, nativeLength, forward, isAccessible))
+@@ -145,7 +145,7 @@ static UBool uTextUTF16ContextAwareAccess(UText* text,
+         ASSERT(newContext == UTextProviderContext::PriorContext);
+         textUTF16ContextAwareSwitchToPriorContext(text, nativeIndex, nativeLength, forward);
+     }
+-    return TRUE;
+    return true;
+ }
+ 
+ static int32_t uTextUTF16ContextAwareExtract(UText*, int64_t, int64_t, UChar*, int32_t, UErrorCode* errorCode)
--- a/pkgs/development/libraries/qt-5/5.15/default.nix
+++ b/pkgs/development/libraries/qt-5/5.15/default.nix
@ -95,6 +95,7 @@ let
        sha256 = "0h8ymfnwgkjkwaankr3iifiscsvngqpwb91yygndx344qdiw9y0n";
      })
      ./qtwebkit.patch
+      ./qtwebkit-icu68.patch
    ] ++ optionals stdenv.isDarwin [
      ./qtwebkit-darwin-no-readline.patch
      ./qtwebkit-darwin-no-qos-classes.patch
--- a/pkgs/development/libraries/qt-5/5.15/qtwebkit-icu68.patch
+++ b/pkgs/development/libraries/qt-5/5.15/qtwebkit-icu68.patch
@ -0,0 +1,170 @@
+Regressed by https://github.com/unicode-org/icu/commit/c3fe7e09d844
+
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:31:
+Source/WebCore/platform/text/TextCodecICU.cpp:311:42: error: use of undeclared identifier 'TRUE'
+        ucnv_setFallback(m_converterICU, TRUE);
+                                         ^
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:40:
+In file included from Source/WebCore/platform/text/icu/UTextProvider.cpp:27:
+Source/WebCore/platform/text/icu/UTextProvider.h:83:28: error: use of undeclared identifier 'TRUE'
+            isAccessible = TRUE;
+                           ^
+Source/WebCore/platform/text/icu/UTextProvider.h:88:28: error: use of undeclared identifier 'FALSE'
+            isAccessible = FALSE;
+                           ^
+Source/WebCore/platform/text/icu/UTextProvider.h:97:28: error: use of undeclared identifier 'TRUE'
+            isAccessible = TRUE;
+                           ^
+Source/WebCore/platform/text/icu/UTextProvider.h:102:28: error: use of undeclared identifier 'FALSE'
+            isAccessible = FALSE;
+                           ^
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:41:
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:103:20: error: use of undeclared identifier 'TRUE'
+            return TRUE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:108:20: error: use of undeclared identifier 'FALSE'
+            return FALSE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:114:20: error: use of undeclared identifier 'TRUE'
+            return TRUE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:119:20: error: use of undeclared identifier 'FALSE'
+            return FALSE;
+                   ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:147:12: error: use of undeclared identifier 'TRUE'
+    return TRUE;
+           ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:339:16: error: use of undeclared identifier 'FALSE'
+        return FALSE;
+               ^
+Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp:359:12: error: use of undeclared identifier 'TRUE'
+    return TRUE;
+           ^
+In file included from Source/WebCore/platform/text/TextAllInOne.cpp:42:
+Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp:128:16: error: use of undeclared identifier 'FALSE'
+        return FALSE;
+               ^
+Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp:148:12: error: use of undeclared identifier 'TRUE'
+    return TRUE;
+           ^
+
+--- a/Source/WebCore/platform/text/TextCodecICU.cpp
+++ b/Source/WebCore/platform/text/TextCodecICU.cpp
+@@ -308,7 +308,7 @@ void TextCodecICU::createICUConverter() const
+     m_converterICU = ucnv_open(m_canonicalConverterName, &err);
+     ASSERT(U_SUCCESS(err));
+     if (m_converterICU)
+-        ucnv_setFallback(m_converterICU, TRUE);
+        ucnv_setFallback(m_converterICU, true);
+ }
+ 
+ int TextCodecICU::decodeToBuffer(UChar* target, UChar* targetLimit, const char*& source, const char* sourceLimit, int32_t* offsets, bool flush, UErrorCode& err)
+--- a/Source/WebCore/platform/text/icu/UTextProvider.h
+++ b/Source/WebCore/platform/text/icu/UTextProvider.h
+@@ -80,12 +80,12 @@ inline bool uTextAccessInChunkOrOutOfRange(UText* text
+             // Ensure chunk offset is well formed if computed offset exceeds int32_t range.
+             ASSERT(offset < std::numeric_limits<int32_t>::max());
+             text->chunkOffset = offset < std::numeric_limits<int32_t>::max() ? static_cast<int32_t>(offset) : 0;
+-            isAccessible = TRUE;
+            isAccessible = true;
+             return true;
+         }
+         if (nativeIndex >= nativeLength && text->chunkNativeLimit == nativeLength) {
+             text->chunkOffset = text->chunkLength;
+-            isAccessible = FALSE;
+            isAccessible = false;
+             return true;
+         }
+     } else {
+@@ -94,12 +94,12 @@ inline bool uTextAccessInChunkOrOutOfRange(UText* text
+             // Ensure chunk offset is well formed if computed offset exceeds int32_t range.
+             ASSERT(offset < std::numeric_limits<int32_t>::max());
+             text->chunkOffset = offset < std::numeric_limits<int32_t>::max() ? static_cast<int32_t>(offset) : 0;
+-            isAccessible = TRUE;
+            isAccessible = true;
+             return true;
+         }
+         if (nativeIndex <= 0 && !text->chunkNativeStart) {
+             text->chunkOffset = 0;
+-            isAccessible = FALSE;
+            isAccessible = false;
+             return true;
+         }
+     }
+--- a/Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp
+++ b/Source/WebCore/platform/text/icu/UTextProviderLatin1.cpp
+@@ -100,23 +100,23 @@ static UBool uTextLatin1Access(UText* uText, int64_t i
+         if (index < uText->chunkNativeLimit && index >= uText->chunkNativeStart) {
+             // Already inside the buffer. Set the new offset.
+             uText->chunkOffset = static_cast<int32_t>(index - uText->chunkNativeStart);
+-            return TRUE;
+            return true;
+         }
+         if (index >= length && uText->chunkNativeLimit == length) {
+             // Off the end of the buffer, but we can't get it.
+             uText->chunkOffset = static_cast<int32_t>(index - uText->chunkNativeStart);
+-            return FALSE;
+            return false;
+         }
+     } else {
+         if (index <= uText->chunkNativeLimit && index > uText->chunkNativeStart) {
+             // Already inside the buffer. Set the new offset.
+             uText->chunkOffset = static_cast<int32_t>(index - uText->chunkNativeStart);
+-            return TRUE;
+            return true;
+         }
+         if (!index && !uText->chunkNativeStart) {
+             // Already at the beginning; can't go any farther.
+             uText->chunkOffset = 0;
+-            return FALSE;
+            return false;
+         }
+     }
+     
+@@ -144,7 +144,7 @@ static UBool uTextLatin1Access(UText* uText, int64_t i
+ 
+     uText->nativeIndexingLimit = uText->chunkLength;
+ 
+-    return TRUE;
+    return true;
+ }
+ 
+ static int32_t uTextLatin1Extract(UText* uText, int64_t start, int64_t limit, UChar* dest, int32_t destCapacity, UErrorCode* status)
+@@ -336,7 +336,7 @@ static int64_t uTextLatin1ContextAwareNativeLength(UTe
+ static UBool uTextLatin1ContextAwareAccess(UText* text, int64_t nativeIndex, UBool forward)
+ {
+     if (!text->context)
+-        return FALSE;
+        return false;
+     int64_t nativeLength = uTextLatin1ContextAwareNativeLength(text);
+     UBool isAccessible;
+     if (uTextAccessInChunkOrOutOfRange(text, nativeIndex, nativeLength, forward, isAccessible))
+@@ -356,7 +356,7 @@ static UBool uTextLatin1ContextAwareAccess(UText* text
+         ASSERT(newContext == UTextProviderContext::PriorContext);
+         textLatin1ContextAwareSwitchToPriorContext(text, nativeIndex, nativeLength, forward);
+     }
+-    return TRUE;
+    return true;
+ }
+ 
+ static int32_t uTextLatin1ContextAwareExtract(UText*, int64_t, int64_t, UChar*, int32_t, UErrorCode* errorCode)
+--- a/Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp
+++ b/Source/WebCore/platform/text/icu/UTextProviderUTF16.cpp
+@@ -125,7 +125,7 @@ static inline int64_t uTextUTF16ContextAwareNativeLeng
+ static UBool uTextUTF16ContextAwareAccess(UText* text, int64_t nativeIndex, UBool forward)
+ {
+     if (!text->context)
+-        return FALSE;
+        return false;
+     int64_t nativeLength = uTextUTF16ContextAwareNativeLength(text);
+     UBool isAccessible;
+     if (uTextAccessInChunkOrOutOfRange(text, nativeIndex, nativeLength, forward, isAccessible))
+@@ -145,7 +145,7 @@ static UBool uTextUTF16ContextAwareAccess(UText* text,
+         ASSERT(newContext == UTextProviderContext::PriorContext);
+         textUTF16ContextAwareSwitchToPriorContext(text, nativeIndex, nativeLength, forward);
+     }
+-    return TRUE;
+    return true;
+ }
+ 
+ static int32_t uTextUTF16ContextAwareExtract(UText*, int64_t, int64_t, UChar*, int32_t, UErrorCode* errorCode)
--- a/pkgs/development/libraries/tecla/default.nix
+++ b/pkgs/development/libraries/tecla/default.nix
@ -8,6 +8,11 @@ stdenv.mkDerivation rec {
    sha256 = "06pfq5wa8d25i9bdjkp4xhms5101dsrbg82riz7rz1a0a32pqxgj";
  };

+  postPatch = ''
+    substituteInPlace install-sh \
+      --replace "stripprog=" "stripprog=\$STRIP # "
+  '';
+
  meta = {
    homepage = "https://www.astro.caltech.edu/~mcs/tecla/";
    description = "Command-line editing library";
--- a/pkgs/development/misc/resholve/deps.nix
+++ b/pkgs/development/misc/resholve/deps.nix
@ -60,13 +60,13 @@ rec {
  # resholve's primary dependency is this developer build of the oil shell.
  oildev = python27Packages.buildPythonPackage rec {
    pname = "oildev-unstable";
-    version = "2020-03-31";
+    version = "2021-02-26";

    src = fetchFromGitHub {
      owner = "oilshell";
      repo = "oil";
-      rev = "ea80cdad7ae1152a25bd2a30b87fe3c2ad32394a";
-      sha256 = "0pxn0f8qbdman4gppx93zwml7s5byqfw560n079v68qjgzh2brq2";
+      rev = "11c6bd3ca0e126862c7a1f938c8510779837affa";
+      hash = "sha256-UTQywtx+Dn1/qx5uocqgGn7oFYW4R5DbuiRNF8t/BzY=";

      /*
      It's not critical to drop most of these; the primary target is
--- a/pkgs/development/misc/resholve/resholve.nix
+++ b/pkgs/development/misc/resholve/resholve.nix
@ -11,12 +11,12 @@
 , doCheck ? true
 }:
 let
-  version = "0.4.2";
+  version = "0.5.0";
  rSrc = fetchFromGitHub {
    owner = "abathur";
    repo = "resholve";
    rev = "v${version}";
-    hash = "sha256-ArUQjqh4LRvFLzHiTIcae0q/VFxFF/X9eOFeRnYmTO0=";
+    hash = "sha256-dscmT0ss1buP56QzQtfs2HANr9oWWMxCS+fwBIKBxv4=";
  };
  deps = callPackage ./deps.nix {
    /*
@ -29,6 +29,9 @@ let
      "${rSrc}/0002-add_MANIFEST_in.patch"
      "${rSrc}/0003-fix_codegen_shebang.patch"
      "${rSrc}/0004-disable-internal-py-yajl-for-nix-built.patch"
+      "${rSrc}/0005_revert_libc_locale.patch"
+      "${rSrc}/0006_disable_failing_libc_tests.patch"
+      "${rSrc}/0007_restore_root_init_py.patch"
    ];
  };
 in
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/ocaml-modules/ppx_derivers/default.nix
+++ b/pkgs/development/ocaml-modules/ppx_derivers/default.nix
@ -1,9 +1,11 @@
-{ lib, fetchFromGitHub, buildDunePackage }:
+{ lib, fetchFromGitHub, buildDunePackage, ocaml }:

 buildDunePackage rec {
  pname = "ppx_derivers";
  version = "1.2.1";

+  useDune2 = lib.versionAtLeast ocaml.version "4.08";
+
  minimumOCamlVersion = "4.02";

  src = fetchFromGitHub {
--- a/pkgs/development/php-packages/xdebug/default.nix
+++ b/pkgs/development/php-packages/xdebug/default.nix
@ -3,8 +3,8 @@
 buildPecl {
  pname = "xdebug";

-  version = "3.0.2";
-  sha256 = "05sfgkw55ym7mg0b54l9x3i9598kf2bkp4z3sdl1hd31q3g4cv89";
+  version = "3.0.3";
+  sha256 = "sha256-5yZagVGOOX+XLcki50bRpIRTcXf/SJVDUWfRCeKTJDI=";

  doCheck = true;
  checkTarget = "test";
--- a/pkgs/development/python-modules/accupy/default.nix
+++ b/pkgs/development/python-modules/accupy/default.nix
@ -1,14 +1,16 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
 , mpmath
 , numpy
-, pipdate
 , pybind11
 , pyfma
 , eigen
+, importlib-metadata
 , pytestCheckHook
 , matplotlib
+, dufte
 , isPy27
 }:

@ -22,20 +24,24 @@ buildPythonPackage rec {
    sha256 = "36506aca53154528997ac22aee6292c83da0f4850bb375c149512b5284bd4948";
  };

+  nativeBuildInputs = [
+    pybind11
+  ];
+
  buildInputs = [
-    pybind11 eigen
+    eigen
  ];

  propagatedBuildInputs = [
    mpmath
    numpy
-    pipdate
    pyfma
-  ];
+  ] ++ lib.optional (pythonOlder "3.8") importlib-metadata;

  checkInputs = [
    pytestCheckHook
    matplotlib
+    dufte
  ];

  postConfigure = ''
--- a/pkgs/development/python-modules/afdko/default.nix
+++ b/pkgs/development/python-modules/afdko/default.nix
@ -17,14 +17,19 @@ buildPythonPackage rec {
    sha256 = "1qg7dgl81yq0sp50pkhgvmf8az1svx20zmpkfa68ka9d0ssh1wjw";
  };

-  # Skip date-dependent test. See
-  # https://github.com/adobe-type-tools/afdko/pull/1232
-  # https://github.com/NixOS/nixpkgs/pull/98158#issuecomment-704321117
  patches = [
+    # Skip date-dependent test. See
+    # https://github.com/adobe-type-tools/afdko/pull/1232
+    # https://github.com/NixOS/nixpkgs/pull/98158#issuecomment-704321117
    (fetchpatch {
      url = "https://github.com/adobe-type-tools/afdko/commit/2c36ad10f9d964759f643e8ed7b0972a27aa26bd.patch";
      sha256 = "0p6a485mmzrbfldfbhgfghsypfiad3cabcw7qlw2rh993ivpnibf";
    })
+    # fix tests for fonttools 4.21.1
+    (fetchpatch {
+      url = "https://github.com/adobe-type-tools/afdko/commit/0919e7454a0a05a1b141c23bf8134c67e6b688fc.patch";
+      sha256 = "0glly85swyl1kcc0mi8i0w4bm148bb001jz1winz5drfrw3a63jp";
+    })
  ];

  nativeBuildInputs = [ setuptools_scm ];
--- a/pkgs/development/python-modules/ailment/default.nix
+++ b/pkgs/development/python-modules/ailment/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "ailment";
-  version = "9.0.5739";
+  version = "9.0.5903";
  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1fjwksia6h7w7m5zhys65yr4zxvyfgp9hr1k5dn802p9kvz34bpc";
+    sha256 = "sha256-75Ul9JfMFYv3AfBlgmer6IDyfgOAS4AdXexznoxi35Y=";
  };

  propagatedBuildInputs = [ pyvex ];
--- a/pkgs/development/python-modules/aiopylgtv/default.nix
+++ b/pkgs/development/python-modules/aiopylgtv/default.nix
@ -0,0 +1,38 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, numpy
+, pythonOlder
+, sqlitedict
+, websockets
+}:
+
+buildPythonPackage rec {
+  pname = "aiopylgtv";
+  version = "0.4.0";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "bendavid";
+    repo = pname;
+    rev = version;
+    sha256 = "0x0xcnlz42arsp53zlq5wyv9pwif1in8j2pv48gh0pkdnz9s86b6";
+  };
+
+  propagatedBuildInputs = [
+    numpy
+    sqlitedict
+    websockets
+  ];
+
+  # Project has no tests
+  doCheck = false;
+  pythonImportsCheck = [ "aiopylgtv" ];
+
+  meta = with lib; {
+    description = "Python library to control webOS based LG TV units";
+    homepage = "https://github.com/bendavid/aiopylgtv";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/archinfo/default.nix
+++ b/pkgs/development/python-modules/archinfo/default.nix
@ -7,13 +7,13 @@

 buildPythonPackage rec {
  pname = "archinfo";
-  version = "9.0.5739";
+  version = "9.0.5903";

  src = fetchFromGitHub {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-6qjX0r2vLYgJdrKBVKedplfa1yhWv9tBvTu5BsViXBc=";
+    sha256 = "sha256-4e+ZGIt/ouZj5rsmaVxUrz8gAq4Yq2+Qx4jdOojB4Sw=";
  };

  checkInputs = [
--- a/pkgs/development/python-modules/asteval/default.nix
+++ b/pkgs/development/python-modules/asteval/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "asteval";
-  version = "0.9.22";
+  version = "0.9.23";
  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "newville";
    repo = pname;
    rev = version;
-    sha256 = "sha256-93IBv6beYE/VTKJCWUbA1QTRdmQdn2kg35KBw6kmDis=";
+    sha256 = "sha256-9Zxb2EzB6nxDQHdlryFiwyNW+76VvysLUB78bXKzfv0=";
  };

  checkInputs = [ pytestCheckHook ];
--- a/pkgs/development/python-modules/asysocks/default.nix
+++ b/pkgs/development/python-modules/asysocks/default.nix
@ -5,11 +5,11 @@

 buildPythonPackage rec {
  pname = "asysocks";
-  version = "0.1.0";
+  version = "0.1.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-NH53FaOJx79q5IIYeiz976H9Q8Vnw13qFw4zgRc2TTw=";
+    sha256 = "sha256-7EzSALAJcx8BNHX44FeeiSPRcTe9UFHXQ4IoSKxMU8w=";
  };

  # Upstream hasn't release the tests yet
--- a/pkgs/development/python-modules/boto3/default.nix
+++ b/pkgs/development/python-modules/boto3/default.nix
@ -13,11 +13,11 @@

 buildPythonPackage rec {
  pname = "boto3";
-  version = "1.17.12"; # N.B: if you change this, change botocore too
+  version = "1.17.17"; # N.B: if you change this, change botocore and awscli to a matching version

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-YvBs0eenjYqqTlJ8MnZT6abBr0FbWYNgSKkMKKJ+Xwk=";
+    sha256 = "sha256-RSPqs3/wBdUXQIO1k4LP1ia3iQwI1WzhYqS9kq99RN8=";
  };

  propagatedBuildInputs = [ botocore jmespath s3transfer ] ++ lib.optionals (!isPy3k) [ futures ];
--- a/pkgs/development/python-modules/botocore/default.nix
+++ b/pkgs/development/python-modules/botocore/default.nix
@ -12,11 +12,11 @@

 buildPythonPackage rec {
  pname = "botocore";
-  version = "1.20.12"; # N.B: if you change this, change boto3 and awscli to a matching version
+  version = "1.20.17"; # N.B: if you change this, change boto3 and awscli to a matching version

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-OakjFaF6b4vBkU27Ag9S6SnxjluZpPocXYeF+RNCftg=";
+    sha256 = "sha256-F4zjFdGf4O8z6M5nVKSC0Ano0TLFrcxFf1zx2ZqYdTs=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/chirpstack-api/default.nix
+++ b/pkgs/development/python-modules/chirpstack-api/default.nix
@ -0,0 +1,32 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, google-api-core
+, grpcio
+}:
+
+buildPythonPackage rec {
+  pname = "chirpstack-api";
+  version = "3.9.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "08djidy3fyhghyzvndcjas3hb1s9d7719gvmgbl8bzxjm4h2c433";
+  };
+
+  propagatedBuildInputs = [
+    google-api-core
+    grpcio
+  ];
+
+  # Project has no tests
+  doCheck = false;
+  pythonImportsCheck = [ "chirpstack_api" ];
+
+  meta = with lib; {
+    description = "ChirpStack gRPC API message and service wrappers for Python";
+    homepage = "https://github.com/brocaar/chirpstack-api";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/claripy/default.nix
+++ b/pkgs/development/python-modules/claripy/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "claripy";
-  version = "9.0.5739";
+  version = "9.0.5903";
  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "angr";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1aym01f99zwb9w8qwy8gz631ka7g6akzdld0m4ykc5ip0rq70mki";
+    sha256 = "sha256-NIKWUx1VT5TjnuqppuT6VzwNRwcBLc0xI5k3F2Nmj8A=";
  };

  # Use upstream z3 implementation
--- a/pkgs/development/python-modules/databricks-connect/default.nix
+++ b/pkgs/development/python-modules/databricks-connect/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "databricks-connect";
-  version = "7.3.8";
+  version = "7.3.9";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0c0f036cf30e00fdc47c983875c72d16a3073ae9be9bcf39371514280f00a82d";
+    sha256 = "f789515f3be1bd1f88043110d62859b01a9661e384a81f1768fca4e4bb49a358";
  };

  sourceRoot = ".";
--- a/pkgs/development/python-modules/editdistance/default.nix
+++ b/pkgs/development/python-modules/editdistance/default.nix
@ -0,0 +1,36 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, cython
+}:
+
+buildPythonPackage rec {
+  pname = "editdistance";
+  version = "0.5.3";
+
+
+  src = fetchFromGitHub {
+    owner = "roy-ht";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0vk8vz41p2cs7s7zbaw3cnw2jnvy5rhy525xral68dh14digpgsd";
+  };
+
+  nativeBuildInputs = [ cython ];
+
+  preBuild = ''
+    cythonize --inplace editdistance/bycython.pyx
+  '';
+
+  checkInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "editdistance" ];
+
+  meta = with lib; {
+    description = "Python implementation of the edit distance (Levenshtein distance)";
+    homepage = "https://github.com/roy-ht/editdistance";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/elmax/default.nix
+++ b/pkgs/development/python-modules/elmax/default.nix
@ -0,0 +1,40 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, httpx
+, poetry-core
+, pythonOlder
+, yarl
+}:
+
+buildPythonPackage rec {
+  pname = "elmax";
+  version = "0.1.1";
+  format = "pyproject";
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "home-assistant-ecosystem";
+    repo = "python-elmax";
+    rev = version;
+    sha256 = "sha256-vDISJ/CVOjpM+GPF2TCm3/AMFTWTM0b/+ZPCpAEvNvY=";
+  };
+
+  nativeBuildInputs = [ poetry-core ];
+
+  propagatedBuildInputs = [
+    httpx
+    yarl
+  ];
+
+  # Project has no tests
+  doCheck = false;
+  pythonImportsCheck = [ "elmax" ];
+
+  meta = with lib; {
+    description = "Python API client for the Elmax Cloud services";
+    homepage = "https://github.com/home-assistant-ecosystem/python-elmax";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/exdown/default.nix
+++ b/pkgs/development/python-modules/exdown/default.nix
@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder
+{ lib, buildPythonPackage, isPy27, fetchPypi, pythonOlder
 , importlib-metadata }:

 buildPythonPackage rec {
@ -6,6 +6,8 @@ buildPythonPackage rec {
  version = "0.7.1";
  format = "pyproject";

+  disabled = isPy27;
+
  src = fetchPypi {
    inherit pname version;
    sha256 = "sha256-vnSso3vmPIjX7JX+NwoxguwqwPHocJACeh5H0ClPcUI=";
--- a/pkgs/development/python-modules/fonttools/default.nix
+++ b/pkgs/development/python-modules/fonttools/default.nix
@ -20,14 +20,14 @@

 buildPythonPackage rec {
  pname = "fonttools";
-  version = "4.20.0";
+  version = "4.21.1";
  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner  = pname;
    repo   = pname;
    rev    = version;
-    sha256 = "0yj83vsjh23g7gkmq6svbgc898x3qgygkhvpcbpycvmpwxxqxh1v";
+    sha256 = "1x9qrg6ppqhm5214ymwvn0r34qdz8pqvyxd0sj7rkp06wa757z2i";
  };

  # all dependencies are optional, but
@ -67,9 +67,10 @@ buildPythonPackage rec {
      -k 'not ttcompile_timestamp_calcs and not recalc_timestamp'
  '';

-  meta = {
+  meta = with lib; {
    homepage = "https://github.com/fonttools/fonttools";
    description = "A library to manipulate font files from Python";
-    license = lib.licenses.mit;
+    license = licenses.mit;
+    maintainers = [ maintainers.sternenseemann ];
  };
 }
--- a/pkgs/development/python-modules/grpcio/default.nix
+++ b/pkgs/development/python-modules/grpcio/default.nix
@ -1,6 +1,5 @@
 { lib, stdenv
 , buildPythonPackage
-, darwin
 , grpc
 , six
 , protobuf
@ -20,8 +19,7 @@ buildPythonPackage rec {

  outputs = [ "out" "dev" ];

-  nativeBuildInputs = [ cython pkg-config ]
-    ++ lib.optional stdenv.isDarwin darwin.cctools;
+  nativeBuildInputs = [ cython pkg-config ];

  buildInputs = [ c-ares openssl zlib ];
  propagatedBuildInputs = [ six protobuf ]
--- a/pkgs/development/python-modules/httpx/default.nix
+++ b/pkgs/development/python-modules/httpx/default.nix
@ -18,14 +18,14 @@

 buildPythonPackage rec {
  pname = "httpx";
-  version = "0.16.1";
+  version = "0.17.0";
  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "encode";
    repo = pname;
    rev = version;
-    sha256 = "00gmq45fckcqkj910bvd7pyqz1mvgsdvz4s0k7dzbnc5czzq1f4a";
+    sha256 = "sha256-pRdhPAxKZOVbRhOm4881Dn+IRtpX5T3oFuYdtWp3cgY=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/identify/default.nix
+++ b/pkgs/development/python-modules/identify/default.nix
@ -1,22 +1,33 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, editdistance
+}:

 buildPythonPackage rec {
  pname = "identify";
  version = "1.6.1";

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "7b435803dc79a0f0ce887887a62ad360f3a9e8162ac0db9ee649d5d24085bf30";
+
+  src = fetchFromGitHub {
+    owner = "pre-commit";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1sqhqqjp53dwm8yq4nrgggxbvzs3szbg49z5sj2ss9xzlgmimclm";
  };

-  pythonImportsCheck = [ "identify" ];
+  checkInputs = [
+    editdistance
+    pytestCheckHook
+  ];

-  # Tests not included in PyPI tarball
-  doCheck = false;
+  pythonImportsCheck = [ "identify" ];

  meta = with lib; {
    description = "File identification library for Python";
    homepage = "https://github.com/chriskuehl/identify";
    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
  };
 }
--- a/pkgs/development/python-modules/ircrobots/default.nix
+++ b/pkgs/development/python-modules/ircrobots/default.nix
@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "ircrobots";
-  version = "0.3.6";
+  version = "0.3.7";
  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "jesopo";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1c8h8b78gmnfipppr9dxp7sl6wd9lx4l3pdwykaib1f49dqwavys";
+    sha256 = "0cm4hcmprca24d979ydbzwn9mfxw16jki6ld7yykxryf0983nqc7";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/jaraco_classes/default.nix
+++ b/pkgs/development/python-modules/jaraco_classes/default.nix
@ -1,19 +1,34 @@
-{ buildPythonPackage, fetchPypi, isPy27, setuptools_scm, six, more-itertools }:
+{ lib, buildPythonPackage, fetchFromGitHub, isPy27
+, setuptools_scm, toml
+, more-itertools
+, pytestCheckHook
+}:

 buildPythonPackage rec {
  pname = "jaraco.classes";
  version = "3.1.1";
  disabled = isPy27;

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "92bf5d4e6957b17f21034c956dc90977f8ef496c3919ccb165f457f0e2f63cac";
+  src = fetchFromGitHub {
+    owner = "jaraco";
+    repo = "jaraco.classes";
+    rev = "v${version}";
+    sha256 = "0wzrcsxi9gb65inayg0drm08iaw37jm1lqxhz3860i6pwjh503pr";
  };

  pythonNamespaces = [ "jaraco" ];

-  nativeBuildInputs = [ setuptools_scm ];
-  propagatedBuildInputs = [ six more-itertools ];
+  SETUPTOOLS_SCM_PRETEND_VERSION = version;

-  doCheck = false;
+  nativeBuildInputs = [ setuptools_scm toml ];
+
+  propagatedBuildInputs = [ more-itertools ];
+
+  checkInputs = [ pytestCheckHook ];
+
+  meta = with lib; {
+    description = "Utility functions for Python class constructs";
+    homepage = "https://github.com/jaraco/jaraco.classes";
+    license = licenses.mit;
+  };
 }
--- a/pkgs/development/python-modules/ldaptor/default.nix
+++ b/pkgs/development/python-modules/ldaptor/default.nix
@ -8,25 +8,23 @@
 , service-identity
 , zope_interface
 , isPy3k
-, pythonAtLeast
 , python
 }:

 buildPythonPackage rec {
  pname = "ldaptor";
-  version = "20.1.1";
+  version = "21.2.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "778f45d68a0b5d63a892c804c05e57b464413a41d8ae52f92ae569321473ab67";
+    sha256 = "sha256-jEnrGTddSqs+W4NYYGFODLF+VrtaIOGHSAj6W+xno1g=";
  };

  propagatedBuildInputs = [
    twisted passlib pyopenssl pyparsing service-identity zope_interface
  ];

-  # https://github.com/twisted/ldaptor/pull/210
-  disabled = !isPy3k || pythonAtLeast "3.9";
+  disabled = !isPy3k;

  checkPhase = ''
    ${python.interpreter} -m twisted.trial ldaptor
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@ -34,6 +34,8 @@ buildPythonPackage rec {
    inherit pname version;
    sha256 = "14ed84b463e9b84c8ff9308a79b04bf591ae3122a376ee0f62c68a1bd917a773";
  };
+  # See https://github.com/scipy/scipy/issues/13585 and https://github.com/pandas-dev/pandas/pull/40020
+  patches = [ ./fix-tests.patch ];

  nativeBuildInputs = [ cython ];
  buildInputs = lib.optional stdenv.isDarwin libcxx;
@ -59,16 +61,6 @@ buildPythonPackage rec {
  # https://github.com/NixOS/nixpkgs/issues/39687
  hardeningDisable = lib.optional stdenv.cc.isClang "strictoverflow";

-  # For OSX, we need to add a dependency on libcxx, which provides
-  # `complex.h` and other libraries that pandas depends on to build.
-  postPatch = lib.optionalString stdenv.isDarwin ''
-    cpp_sdk="${libcxx}/include/c++/v1";
-    echo "Adding $cpp_sdk to the setup.py common_include variable"
-    substituteInPlace setup.py \
-      --replace "['pandas/src/klib', 'pandas/src']" \
-                "['pandas/src/klib', 'pandas/src', '$cpp_sdk']"
-  '';
-
  # Parallel Cythonization is broken in Python 3.8 on Darwin. Fixed in the next
  # release. https://github.com/pandas-dev/pandas/pull/30862
  setupPyBuildFlags = lib.optionals (!(isPy38 && stdenv.isDarwin)) [
--- a/pkgs/development/python-modules/pandas/fix-tests.patch
+++ b/pkgs/development/python-modules/pandas/fix-tests.patch
@ -0,0 +1,12 @@
+diff --color -ur a/pandas/tests/arrays/sparse/test_array.py b/pandas/tests/arrays/sparse/test_array.py
+--- a/pandas/tests/arrays/sparse/test_array.py	2020-12-07 12:42:08.000000000 +0100
+++ b/pandas/tests/arrays/sparse/test_array.py	2021-02-27 21:48:16.483903149 +0100
+@@ -1188,7 +1188,7 @@
+         row = [0, 3, 1, 0]
+         col = [0, 3, 1, 2]
+         data = [4, 5, 7, 9]
+-        sp_array = scipy.sparse.coo_matrix((data, (row, col)))
+        sp_array = scipy.sparse.coo_matrix((data, (row, col)), dtype="int")
+         result = pd.Series.sparse.from_coo(sp_array)
+ 
+         index = pd.MultiIndex.from_arrays([[0, 0, 1, 3], [0, 2, 1, 3]])
--- a/pkgs/development/python-modules/pleroma-bot/default.nix
+++ b/pkgs/development/python-modules/pleroma-bot/default.nix
@ -0,0 +1,34 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, requests-mock
+, oauthlib
+, requests_oauthlib
+, requests
+, pyaml
+}:
+
+buildPythonPackage rec {
+  pname = "pleroma-bot";
+  version = "0.8.6";
+
+  src = fetchFromGitHub {
+    owner = "robertoszek";
+    repo = "pleroma-bot";
+    rev = version;
+    sha256 = "1q0xhgqq41zbqiawpd4kbdx41zhwxxp5ipn1c2rc8d7pjyb5p75w";
+  };
+
+  propagatedBuildInputs = [ pyaml requests requests_oauthlib oauthlib ];
+  checkInputs = [ pytestCheckHook requests-mock ];
+
+  pythonImportsCheck = [ "pleroma_bot" ];
+
+  meta = with lib; {
+    homepage = "https://robertoszek.github.io/pleroma-bot/";
+    description = "Bot for mirroring one or multiple Twitter accounts in Pleroma/Mastodon";
+    license = licenses.mit;
+    maintainers = with maintainers; [ robertoszek ];
+  };
+}
--- a/pkgs/development/python-modules/ptpython/default.nix
+++ b/pkgs/development/python-modules/ptpython/default.nix
@ -1,5 +1,12 @@
-{ lib, buildPythonPackage, pythonOlder, fetchPypi, prompt_toolkit, appdirs, docopt, jedi
-, pygments, importlib-metadata, isPy3k }:
+{ lib, buildPythonPackage, pythonOlder, fetchPypi
+, appdirs
+, black
+, importlib-metadata
+, isPy3k
+, jedi
+, prompt_toolkit
+, pygments
+}:

 buildPythonPackage rec {
  pname = "ptpython";
@ -11,8 +18,13 @@ buildPythonPackage rec {
    sha256 = "4b0f6e381a8251ec8d6aa94fe12f3400bf6edf789f89c8a6099f8a91d4a5d2e1";
  };

-  propagatedBuildInputs = [ appdirs prompt_toolkit docopt jedi pygments ]
-    ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata ];
+  propagatedBuildInputs = [
+    appdirs
+    black # yes, this is in install_requires
+    jedi
+    prompt_toolkit
+    pygments
+  ] ++ lib.optionals (pythonOlder "3.8") [ importlib-metadata ];

  # no tests to run
  doCheck = false;
--- a/pkgs/development/python-modules/pydantic/default.nix
+++ b/pkgs/development/python-modules/pydantic/default.nix
@ -1,44 +1,45 @@
 { lib
 , buildPythonPackage
-, fetchFromGitHub
-, ujson
 , email_validator
-, typing-extensions
-, python
-, isPy3k
-, pytest
-, pytestcov
+, fetchFromGitHub
 , pytest-mock
+, pytestCheckHook
+, python-dotenv
+, pythonOlder
+, typing-extensions
+, ujson
 }:

 buildPythonPackage rec {
  pname = "pydantic";
-  version = "1.7.3";
-  disabled = !isPy3k;
+  version = "1.8";
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "samuelcolvin";
    repo = pname;
    rev = "v${version}";
-    sha256 = "xihEDmly0vprmA+VdeCoGXg9PjWRPmBWAwk/9f2DLts=";
+    sha256 = "sha256-+HfnM/IrFlUyQJdiOYyaJUNenh8dLtd8CUJWSbn6hwQ=";
  };

  propagatedBuildInputs = [
-    ujson
    email_validator
+    python-dotenv
    typing-extensions
+    ujson
  ];

  checkInputs = [
-    pytest
-    pytestcov
    pytest-mock
+    pytestCheckHook
  ];

-  checkPhase = ''
-    pytest
+  preCheck = ''
+    export HOME=$(mktemp -d)
  '';

+  pythonImportsCheck = [ "pydantic" ];
+
  meta = with lib; {
    homepage = "https://github.com/samuelcolvin/pydantic";
    description = "Data validation and settings management using Python type hinting";
--- a/pkgs/development/python-modules/pyfma/default.nix
+++ b/pkgs/development/python-modules/pyfma/default.nix
@ -1,15 +1,19 @@
 { lib
 , buildPythonPackage
+, isPy27
 , fetchPypi
 , pybind11
+, exdown
 , numpy
-, pytest
+, pytestCheckHook
 }:

 buildPythonPackage rec {
  pname = "pyfma";
  version = "0.1.2";

+  disabled = isPy27;
+
  src = fetchPypi {
    inherit pname version;
    sha256 = "3a9e2503fd01baa4978af5f491b79b7646d7872df9ecc7ab63ba10c250c50d8a";
@ -20,17 +24,12 @@ buildPythonPackage rec {
  ];

  checkInputs = [
+    exdown
    numpy
-    pytest
+    pytestCheckHook
  ];

-  preBuild = ''
-    export HOME=$(mktemp -d)
-  '';
-
-  checkPhase = ''
-    pytest test
-  '';
+  pythonImportsCheck = [ "pyfma" ];

  meta = with lib; {
    description = "Fused multiply-add for Python";
--- a/pkgs/development/python-modules/pymediaroom/default.nix
+++ b/pkgs/development/python-modules/pymediaroom/default.nix
@ -0,0 +1,36 @@
+{ lib
+, async-timeout
+, buildPythonPackage
+, fetchFromGitHub
+, pythonOlder
+, xmltodict
+}:
+
+buildPythonPackage rec {
+  pname = "pymediaroom";
+  version = "0.6.4.1";
+  disabled = pythonOlder "3.5";
+
+  src = fetchFromGitHub {
+    owner = "dgomes";
+    repo = pname;
+    rev = version;
+    sha256 = "1klf2dxd8rlq3n4b9m03lzwcsasn9vi6m3hzrjqhqnprhrnp0xmy";
+  };
+
+  propagatedBuildInputs = [
+    async-timeout
+    xmltodict
+  ];
+
+  # Project has no tests
+  doCheck = false;
+  pythonImportsCheck = [ "pymediaroom" ];
+
+  meta = with lib; {
+    description = "Python Remote Control for Mediaroom STB";
+    homepage = "https://github.com/dgomes/pymediaroom";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/development/python-modules/pytest-httpx/default.nix
+++ b/pkgs/development/python-modules/pytest-httpx/default.nix
@ -1,20 +1,33 @@
-{ lib, buildPythonPackage, fetchPypi, httpx, pytest }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, httpx
+, pytest
+, pytest-asyncio
+, pytestCheckHook
+}:

 buildPythonPackage rec {
  pname = "pytest-httpx";
-  version = "0.10.1";
+  version = "0.11.0";

-  src = fetchPypi {
-    inherit version;
-    pname = "pytest_httpx";
-    extension = "tar.gz";
-    sha256 = "13ld6nnsc3f7i4zl4qm1jh358z0awr6xfk05azwgngmjb7jmcz0a";
+  src = fetchFromGitHub {
+    owner = "Colin-b";
+    repo = "pytest_httpx";
+    rev = "v${version}";
+    sha256 = "08idd3y6khxjqkn46diqvkjvsl4w4pxhl6z1hspbkrj0pqwf9isi";
  };

-  propagatedBuildInputs = [ httpx pytest ];
+  propagatedBuildInputs = [
+    httpx
+    pytest
+  ];
+
+  checkInputs = [
+    pytest-asyncio
+    pytestCheckHook
+  ];

-  # not in pypi tarball
-  doCheck = false;
  pythonImportsCheck = [ "pytest_httpx" ];

  meta = with lib; {
--- a/pkgs/development/python-modules/python-dotenv/default.nix
+++ b/pkgs/development/python-modules/python-dotenv/default.nix
@ -1,29 +1,38 @@
-{ lib, buildPythonPackage, fetchPypi, isPy27
+{ lib
+, buildPythonPackage
 , click
+, fetchPypi
 , ipython
-, pytest
-, sh
-, typing
 , mock
+, pytestCheckHook
+, pythonOlder
+, sh
 }:

 buildPythonPackage rec {
  pname = "python-dotenv";
  version = "0.15.0";
+  disabled = pythonOlder "3.5";

  src = fetchPypi {
    inherit pname version;
    sha256 = "587825ed60b1711daea4832cf37524dfd404325b7db5e25ebe88c495c9f807a0";
  };

-  propagatedBuildInputs = [ click ] ++ lib.optionals isPy27 [ typing ];
+  propagatedBuildInputs = [ click ];

-  checkInputs = [ ipython mock pytest sh ];
+  checkInputs = [
+    ipython
+    mock
+    pytestCheckHook
+    sh
+  ];

-  # cli tests are impure
-  checkPhase = ''
-    pytest tests/ -k 'not cli'
-  '';
+  disabledTests = [
+    "cli"
+  ];
+
+  pythonImportsCheck = [ "dotenv" ];

  meta = with lib; {
    description = "Add .env support to your django/flask apps in development and deployments";
--- a/pkgs/development/python-modules/pyuv/default.nix
+++ b/pkgs/development/python-modules/pyuv/default.nix
@ -1,28 +1,32 @@
 { lib
 , buildPythonPackage
-, isPyPy
-, pkgs
+, fetchFromGitHub
+, libuv
 }:

 buildPythonPackage rec {
  pname = "pyuv";
-  version = "1.2.0";
-  disabled = isPyPy;  # see https://github.com/saghul/pyuv/issues/49
+  version = "1.4.0";

-  src = pkgs.fetchurl {
-    url = "https://github.com/saghul/pyuv/archive/${pname}-${version}.tar.gz";
-    sha256 = "19yl1l5l6dq1xr8xcv6dhx1avm350nr4v2358iggcx4ma631rycx";
+  src = fetchFromGitHub {
+    owner = "saghul";
+    repo = "pyuv";
+    rev = "pyuv-${version}";
+    sha256 = "1wiwwdylz66lfsjh6p4iv7pfhzvnhwjk332625njizfhz3gq9fwr";
  };

-  patches = [ ./pyuv-external-libuv.patch ];
+  setupPyBuildFlags = [ "--use-system-libuv" ];

-  buildInputs = [ pkgs.libuv ];
+  buildInputs = [ libuv ];
+
+  doCheck = false; # doesn't work in sandbox
+
+  pythonImportsCheck = [ "pyuv" ];

  meta = with lib; {
    description = "Python interface for libuv";
    homepage = "https://github.com/saghul/pyuv";
-    repositories.git = "git://github.com/saghul/pyuv.git";
    license = licenses.mit;
+    maintainers = with maintainers; [ dotlambda ];
  };
-
 }
--- a/pkgs/development/python-modules/pyuv/pyuv-external-libuv.patch
+++ b/pkgs/development/python-modules/pyuv/pyuv-external-libuv.patch
@ -1,25 +0,0 @@
-diff --git a/setup.py b/setup.py
-index 5071c3b..4b4a176 100644
--- a/setup.py
-+++ b/setup.py
-@@ -7,7 +7,6 @@ try:
-     from setuptools import setup, Extension
- except ImportError:
-     from distutils.core import setup, Extension
-from setup_libuv import libuv_build_ext, libuv_sdist
-
-
- def get_version():
-@@ -35,11 +34,10 @@ setup(name             = "pyuv",
-           "Programming Language :: Python :: 3.3",
-           "Programming Language :: Python :: 3.4"
-       ],
-      cmdclass     = {'build_ext': libuv_build_ext,
-                      'sdist'    : libuv_sdist},
-       packages     = ['pyuv'],
-       ext_modules  = [Extension('pyuv._cpyuv',
-                                 sources = ['src/pyuv.c'],
-+                                libraries = ['uv']
-                      )]
-      )
-
--- a/pkgs/development/python-modules/pyvex/default.nix
+++ b/pkgs/development/python-modules/pyvex/default.nix
@ -1,4 +1,5 @@
 { lib
+, stdenv
 , archinfo
 , bitstring
 , fetchPypi
@ -14,7 +15,7 @@ buildPythonPackage rec {

  src = fetchPypi {
    inherit pname version;
-    sha256 = "aa12e546599be3cce18d7daef70e93555bf681bd04f6449aa5a6e2bfebb8276b";
+    sha256 = "sha256-qhLlRlmb48zhjX2u9w6TVVv2gb0E9kSapabiv+u4J2s=";
  };

  propagatedBuildInputs = [
@ -35,5 +36,7 @@ buildPythonPackage rec {
    homepage = "https://github.com/angr/pyvex";
    license = with licenses; [ bsd2 gpl3Plus lgpl3Plus ];
    maintainers = with maintainers; [ fab ];
+    # ERROR: pyvex-X-py3-none-manylinux1_aarch64.whl is not a supported wheel on this platform.
+    broken = stdenv.isAarch64;
  };
 }
--- a/pkgs/development/python-modules/sagemaker/default.nix
+++ b/pkgs/development/python-modules/sagemaker/default.nix
@ -14,11 +14,11 @@

 buildPythonPackage rec {
  pname = "sagemaker";
-  version = "2.25.2";
+  version = "2.26.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-oacqDLgt11fplc6e3ruCrwDV/iRhoTgx1mu3Pm/5kmw=";
+    sha256 = "sha256-CT0vXt6x+cp4yHZtfBiRq+/Aurd4Q7Zagn4lNRqji/o=";
  };

  pythonImportsCheck = [
--- a/pkgs/development/python-modules/shapely/default.nix
+++ b/pkgs/development/python-modules/shapely/default.nix
@ -34,7 +34,7 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  # environment variable used in shapely/_buildcfg.py
+  # Environment variable used in shapely/_buildcfg.py
  GEOS_LIBRARY_PATH = "${geos}/lib/libgeos_c${stdenv.hostPlatform.extensions.sharedLibrary}";

  patches = [
@ -48,18 +48,12 @@ buildPythonPackage rec {
        ".travis.yml"
      ];
    })
-
    # Patch to search form GOES .so/.dylib files in a Nix-aware way
    (substituteAll {
      src = ./library-paths.patch;
      libgeos_c = GEOS_LIBRARY_PATH;
      libc = lib.optionalString (!stdenv.isDarwin) "${stdenv.cc.libc}/lib/libc${stdenv.hostPlatform.extensions.sharedLibrary}.6";
    })
-   # included in next release.
-   (fetchpatch {
-     url = "https://github.com/Toblerity/Shapely/commit/ea5b05a0c87235d3d8f09930ad47c396a76c8b0c.patch";
-     sha256 = "sha256-egdydlV+tpXosSQwQFHaXaeBhXEHAs+mn7vLUDpvybA=";
-   })
 ];

  preCheck = ''
@ -70,9 +64,12 @@ buildPythonPackage rec {
    "test_collection"
  ];

+  pythonImportsCheck = [ "shapely" ];
+
  meta = with lib; {
    description = "Geometric objects, predicates, and operations";
-    maintainers = with maintainers; [ knedlsepp ];
    homepage = "https://pypi.python.org/pypi/Shapely/";
+    license = with licenses; [ bsd3 ];
+    maintainers = with maintainers; [ knedlsepp ];
  };
 }
--- a/pkgs/development/python-modules/slicedimage/default.nix
+++ b/pkgs/development/python-modules/slicedimage/default.nix
@ -1,6 +1,6 @@
 { lib
 , buildPythonPackage
-, fetchPypi
+, fetchFromGitHub
 , boto3
 , diskcache
 , enum34
@ -10,7 +10,7 @@
 , requests
 , scikitimage
 , six
-, pytest
+, pytestCheckHook
 , isPy27
 , tifffile
 }:
@ -19,9 +19,11 @@ buildPythonPackage rec {
  pname = "slicedimage";
  version = "4.1.1";

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "7369f1d7fa09f6c9969625c4b76a8a63d2507a94c6fc257183da1c10261703e9";
+  src = fetchFromGitHub {
+    owner = "spacetx";
+    repo = pname;
+    rev = version;
+    sha256 = "1vpg8varvfx0nj6xscdfm7m118hzsfz7qfzn28r9rsfvrhr0dlcw";
  };

  propagatedBuildInputs = [
@ -36,13 +38,13 @@ buildPythonPackage rec {
  ] ++ lib.optionals isPy27 [ pathlib enum34 ];

  checkInputs = [
-    pytest
+    pytestCheckHook
  ];

-  # ignore tests which require setup
-  checkPhase = ''
-    pytest --ignore tests/io_
-  '';
+  # Ignore tests which require setup, check again if disabledTestFiles can be used
+  pytestFlagsArray = [ "--ignore tests/io_" ];
+
+  pythonImportsCheck = [ "slicedimage" ];

  meta = with lib; {
    description = "Library to access sliced imaging data";
--- a/pkgs/development/python-modules/soco/default.nix
+++ b/pkgs/development/python-modules/soco/default.nix
@ -1,12 +1,15 @@
 { buildPythonPackage
-, coveralls
 , fetchFromGitHub
-, flake8
+, fetchpatch
 , graphviz
+, ifaddr
+, isPy27
 , lib
 , mock
+, nix-update-script
 , pytestCheckHook
 , requests
+, requests-mock
 , sphinx
 , sphinx_rtd_theme
 , toml
@ -15,7 +18,8 @@

 buildPythonPackage rec {
  pname = "soco";
-  version = "0.20";
+  version = "0.21.2";
+  disabled = isPy27;

  # N.B. We fetch from GitHub because the PyPI tarball doesn't contain the
  # required files to run the tests.
@ -23,34 +27,46 @@ buildPythonPackage rec {
    owner = "SoCo";
    repo = "SoCo";
    rev = "v${version}";
-    sha256 = "0p87aw7wxgdjz0m0nqqcfvbn24hlbq1hh1zxdq2c0k2jcbmaj8zc";
+    sha256 = "sha256-CCgkzUkt9YqTJt9tPBLmYXW6ZuRoMDd7xahYmNXgfM0=";
  };

+  patches = [(fetchpatch {
+    url = "https://patch-diff.githubusercontent.com/raw/SoCo/SoCo/pull/811.patch";
+    sha256 = "sha256-GBd74c8zc25ROO411SZ9TTa+bi8yXJaaOQqY9FM1qj4=";
+  })];
+
  # N.B. These exist because:
  # 1. Upstream's pinning isn't well maintained, leaving dependency versions no
  #    longer in nixpkgs.
  # 2. There is no benefit for us to be running linting and coverage tests.
  postPatch = ''
    sed -i "/black/d" ./requirements-dev.txt
+    sed -i "/coveralls/d" ./requirements-dev.txt
+    sed -i "/flake8/d" ./requirements-dev.txt
    sed -i "/pylint/d" ./requirements-dev.txt
    sed -i "/pytest-cov/d" ./requirements-dev.txt
  '';

  propagatedBuildInputs = [
+    ifaddr
    requests
    toml
    xmltodict
  ];
+
  checkInputs = [
    pytestCheckHook
-    coveralls
-    flake8
    graphviz
    mock
+    requests-mock
    sphinx
    sphinx_rtd_theme
  ];

+  passthru.updateScript = nix-update-script {
+    attrPath = "python3Packages.${pname}";
+  };
+
  meta = with lib; {
    homepage = "http://python-soco.com/";
    description = "A CLI and library to control Sonos speakers";
--- a/pkgs/development/python-modules/textacy/default.nix
+++ b/pkgs/development/python-modules/textacy/default.nix
@ -51,6 +51,9 @@ buildPythonPackage rec {
  '';

  meta = with lib; {
+    # scikit-learn in pythonPackages is too new for textacy
+    # remove as soon as textacy support scikit-learn >= 0.24
+    broken = true;
    description = "Higher-level text processing, built on spaCy";
    homepage = "https://textacy.readthedocs.io/";
    license = licenses.asl20;
--- a/pkgs/development/python-modules/watchdog/default.nix
+++ b/pkgs/development/python-modules/watchdog/default.nix
@ -1,6 +1,7 @@
 { lib, stdenv
 , buildPythonPackage
 , fetchPypi
+, fetchpatch
 , argh
 , pathtools
 , pyyaml
@ -11,13 +12,21 @@

 buildPythonPackage rec {
  pname = "watchdog";
-  version = "2.0.1";
+  version = "2.0.2";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "0d1c763652c255e2af00d76cf7d05c7b4867e960092b2696db031f69661c0785";
+    sha256 = "sha256-Uy/t2ZPnVVRnH6o2zQTFgM7T+uCEJUp3mvu9iq8AVms=";
  };

+  patches = [
+    (fetchpatch {
+      # Fix test flakiness on Apple Silicon, remove after upgrade to 2.0.6.
+      url = "https://github.com/gorakhargosh/watchdog/commit/331fd7c2c819663be39bc146e78ce67553f265fa.patch";
+      sha256 = "sha256-pLkZmbPN3qRNHs53OP0HIyDxqYCPPo6yOcBLD3aO2YE=";
+    })
+  ];
+
  buildInputs = lib.optionals stdenv.isDarwin
    [ pkgs.darwin.apple_sdk.frameworks.CoreServices ];

--- a/pkgs/development/tools/azcopy/default.nix
+++ b/pkgs/development/tools/azcopy/default.nix
@ -2,18 +2,18 @@

 buildGoModule rec {
  pname = "azure-storage-azcopy";
-  version = "10.8.0";
+  version = "10.9.0";

  src = fetchFromGitHub {
    owner = "Azure";
    repo = "azure-storage-azcopy";
    rev = "v${version}";
-    sha256 = "sha256-zA0/5lpVefZD0m7g7SfqSRAFkQm2b+g/F3doCl9oAn8=";
+    sha256 = "sha256-IVbvBqp/7Y3La0pP6gbWl0ATfEvkCuR4J9ChTDPNhB0=";
  };

  subPackages = [ "." ];

-  vendorSha256 = "sha256-t7PluxN6naDB35eC59Xus1hgZflgViWF2yFog9mkaOA=";
+  vendorSha256 = "sha256-mj1TvNuFFPJGAJCBTQtU5WWPhHbiXUxRiMZQ/XvEy0U=";

  doCheck = false;

--- a/pkgs/development/tools/bazel-kazel/default.nix
+++ b/pkgs/development/tools/bazel-kazel/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "bazel-kazel";
-  version = "0.2.0";
+  version = "0.2.1";

  src = fetchFromGitHub {
    owner = "kubernetes";
    repo = "repo-infra";
    rev = "v${version}";
-    sha256 = "sha256-YWTWw5vDkDvIHOTqZM2xH8VPaVRuB2oyynvwWNmvPXs=";
+    sha256 = "sha256-g7jfuWe4UeAbNf+kOa0Y9BamUnGEbOGxZ+KdQWdWl48=";
  };

  vendorSha256 = "sha256-1+7Mx1Zh1WolqTpWNe560PRzRYaWVUVLvNvUOysaW5I=";
--- a/pkgs/development/tools/build-managers/conan/default.nix
+++ b/pkgs/development/tools/build-managers/conan/default.nix
@ -1,4 +1,4 @@
-{ lib, python3, fetchFromGitHub, git, pkg-config }:
+{ lib, stdenv, python3, fetchFromGitHub, git, pkg-config, fetchpatch }:

 # Note:
 # Conan has specific dependency demands; check
@ -20,6 +20,13 @@ let newPython = python3.override {
        inherit version;
        sha256 = "1vn1db2akw98ybnpns92qi11v94hydwp130s8753k6ikby95883j";
      };
+      patches = oldAttrs.patches or [] ++ [
+        # Don't raise import error on non-linux os. Remove after upgrading to distro≥1.2.0
+        (fetchpatch {
+          url = "https://github.com/nir0s/distro/commit/25aa3f8c5934346dc838387fc081ce81baddeb95.patch";
+          sha256 = "0m09ldf75gacazh2kr04cifgsqfxg670vk4ypl62zv7fp3nyd5dc";
+        })
+      ];
    });
    node-semver = super.node-semver.overridePythonAttrs (oldAttrs: rec {
      version = "0.6.1";
@ -69,7 +76,7 @@ in newPython.pkgs.buildPythonApplication rec {
    six
    tqdm
    urllib3
-  ];
+  ] ++ lib.optionals stdenv.isDarwin [ idna cryptography pyopenssl ];

  checkInputs = [
    pkg-config
@ -90,6 +97,9 @@ in newPython.pkgs.buildPythonApplication rec {
    substituteInPlace conans/requirements.txt \
      --replace "PyYAML>=3.11, <3.14.0" "PyYAML" \
      --replace "deprecation>=2.0, <2.1" "deprecation" \
+      --replace "idna==2.6" "idna" \
+      --replace "cryptography>=1.3.4, <2.4.0" "cryptography" \
+      --replace "pyOpenSSL>=16.0.0, <19.0.0" "pyOpenSSL" \
      --replace "six>=1.10.0,<=1.14.0" "six"
  '';

@ -98,6 +108,5 @@ in newPython.pkgs.buildPythonApplication rec {
    description = "Decentralized and portable C/C++ package manager";
    license = licenses.mit;
    maintainers = with maintainers; [ HaoZeke ];
-    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/tools/doctl/default.nix
+++ b/pkgs/development/tools/doctl/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "doctl";
-  version = "1.56.0";
+  version = "1.57.0";

  vendorSha256 = null;

@ -32,7 +32,7 @@ buildGoModule rec {
    owner = "digitalocean";
    repo = "doctl";
    rev = "v${version}";
-    sha256 = "sha256-rBUao5j4Bofn6uSB20TTN7G1JgKu3mQpISJp+hX28mw=";
+    sha256 = "sha256-waaBillxI7tKQAugyolAWQWf4CG+uIkjtvNXNNFpqRY=";
  };

  meta = with lib; {
--- a/pkgs/development/tools/jbang/default.nix
+++ b/pkgs/development/tools/jbang/default.nix
@ -1,12 +1,12 @@
 { stdenv, lib, fetchzip, jdk, makeWrapper, coreutils, curl }:

 stdenv.mkDerivation rec {
-  version = "0.66.0";
+  version = "0.66.1";
  pname = "jbang";

  src = fetchzip {
    url = "https://github.com/jbangdev/jbang/releases/download/v${version}/${pname}-${version}.tar";
-    sha256 = "sha256-iWM9IcvrcsX/rTzouT7rQbuGSFTIVPnHSCmAHxzFOQo=";
+    sha256 = "sha256-D7xZbuxSdE1zcyVZ9hqNOgq1oZDSFjBeITNqKXEpjyU=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/development/tools/kubectx/default.nix
+++ b/pkgs/development/tools/kubectx/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "kubectx";
-  version = "0.9.2";
+  version = "0.9.3";

  src = fetchFromGitHub {
    owner = "ahmetb";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-a2w4SXF6oOo4ZLYwF8I3mkqW9ktSbHiV/tym8b8Ng4U=";
+    sha256 = "sha256-anTogloat0YJN6LR6mww5IPwokHYoDY6L7i2pMzI8/M=";
  };

  vendorSha256 = "sha256-4sQaqC0BOsDfWH3cHy2EMQNMq6qiAcbV+RwxCdcSxsg=";
--- a/pkgs/development/tools/rust/cargo-criterion/default.nix
+++ b/pkgs/development/tools/rust/cargo-criterion/default.nix
@ -0,0 +1,22 @@
+{ lib, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-criterion";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "bheisler";
+    repo = pname;
+    rev = version;
+    sha256 = "0czagclrn4yhlvlh06wsyiybz69r7mmk3182fywzn9vd0xlclxpi";
+  };
+
+  cargoSha256 = "sha256-XZuZ81hB/GQDopJyfSkxQiehSwJz7VWoJR6/m3WLil8=";
+
+  meta = with lib; {
+    description = "Cargo extension for running Criterion.rs benchmarks";
+    homepage = "https://github.com/bheisler/cargo-criterion";
+    license = with licenses; [ asl20 /* or */ mit ];
+    maintainers = with maintainers; [ humancalico ];
+  };
+}
--- a/pkgs/development/tools/rust/cargo-deny/default.nix
+++ b/pkgs/development/tools/rust/cargo-deny/default.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-deny";
-  version = "0.8.7";
+  version = "0.8.8";

  src = fetchFromGitHub {
    owner = "EmbarkStudios";
    repo = pname;
    rev = version;
-    sha256 = "sha256-LXc4PFJ1FbdF3yotqqOkhhe+MKGZ4sqJgxAvDml9GeA=";
+    sha256 = "sha256-8wmH9DeI+tm3c/6n7bwMe5SslGNCUg4d5BE0+wQ7KTU=";
  };

-  cargoSha256 = "sha256-4FFyRhmMpzKmKrvU2bmGHWUnLAbTDU1bPv7RfhQfYeY=";
+  cargoSha256 = "sha256-f0Wisel7NQOyfbhhs0GwyTBiUfydPMSVAysrov/RxxI=";

  doCheck = false;

--- a/pkgs/development/tools/rust/cargo-play/default.nix
+++ b/pkgs/development/tools/rust/cargo-play/default.nix
@ -0,0 +1,25 @@
+{ fetchFromGitHub, lib, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-play";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "fanzeyi";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "01r00akfmvpzp924yqqybd9s0pwiwxy8vklsg4m9ypzljc3nlv02";
+  };
+
+  cargoSha256 = "0fvsdyivq5991ka6avh12aqdkjx0myk61kmzlr19p2vlfpg70q07";
+
+  # some tests require internet access
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Run your rust code without setting up cargo";
+    homepage = "https://github.com/fanzeyi/cargo-play";
+    license = licenses.mit;
+    maintainers = with maintainers; [ figsoda ];
+  };
+}
--- a/pkgs/development/tools/rust/crate2nix/default.nix
+++ b/pkgs/development/tools/rust/crate2nix/default.nix
@ -10,17 +10,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "crate2nix";
-  version = "0.8.0";
+  version = "0.9.0";

  src = fetchFromGitHub
    {
      owner = "kolloch";
      repo = pname;
      rev = version;
-      sha256 = "sha256-pqg1BsEq3kGmUzt1zpQvXgdnRcIsiuIyvtUBi3VxtZ4=";
+      sha256 = "sha256-dB8wa3CQFw8ckD420zpBGw4TnsLrHqXf+ff/WuhPsVM=";
    } + "/crate2nix";

-  cargoSha256 = "sha256-dAMWrGNMleQ3lDbG46Hr4qvCyxR+QcPOUZw9r2/CxV4=";
+  cargoSha256 = "sha256-6V0ifH63/s5XLo4BCexPtvlUH0UQPHFW8YHF8OCH3ik=";

  nativeBuildInputs = [ makeWrapper ];

--- a/Show More
+++ b/Show More