Merge staging-next into staging

2024-11-11 04:02:55 +03:00 · 2021-11-12 18:01:48 +00:00 · 2021-11-12 18:01:48 +00:00 · 65356b24bf
commit 65356b24bf
parent 532ac929a1 699560194d
67 changed files with 1765 additions and 1403 deletions
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@ -294,7 +294,7 @@ in
      };

      submissionOptions = mkOption {
-        type = types.attrs;
+        type = with types; attrsOf str;
        default = {
          smtpd_tls_security_level = "encrypt";
          smtpd_sasl_auth_enable = "yes";
@ -312,7 +312,7 @@ in
      };

      submissionsOptions = mkOption {
-        type = types.attrs;
+        type = with types; attrsOf str;
        default = {
          smtpd_sasl_auth_enable = "yes";
          smtpd_client_restrictions = "permit_sasl_authenticated,reject";
--- a/nixos/modules/services/x11/clight.nix
+++ b/nixos/modules/services/x11/clight.nix
@ -71,6 +71,14 @@ in {
  };

  config = mkIf cfg.enable {
+    assertions = let
+      inRange = v: l: r: v >= l && v <= r;
+    in [
+      { assertion = config.location.provider == "manual" ->
+          inRange config.location.latitude (-90) 90 && inRange config.location.longitude (-180) 180;
+        message = "You must specify a valid latitude and longitude if manually providing location"; }
+    ];
+
    boot.kernelModules = [ "i2c_dev" ];
    environment.systemPackages = with pkgs; [ clight clightd ];
    services.dbus.packages = with pkgs; [ clight clightd ];
--- a/nixos/modules/services/x11/display-managers/lightdm.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm.nix
@ -146,7 +146,7 @@ in
      };

      background = mkOption {
-        type = types.path;
+        type = types.either types.path (types.strMatching "^#[0-9]\{6\}$");
        # Manual cannot depend on packages, we are actually setting the default in config below.
        defaultText = literalExpression "pkgs.nixos-artwork.wallpapers.simple-dark-gray-bottom.gnomeFilePath";
        description = ''
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@ -13,10 +13,10 @@ let
  archive_fmt = if system == "x86_64-darwin" then "zip" else "tar.gz";

  sha256 = {
-    x86_64-linux = "1xblrp4xyw2pcifmzjmlbnmk7lhmlj002sfk28kyf1k5wdp54yv9";
-    x86_64-darwin = "0ivvdxc4hmv9sh8ap0qy8yciz9pjkm1p1j60dh57y4ll6fdzbbrd";
-    aarch64-linux = "0ssm27i12d7gkq31d1zma4zx5n5mgg0a8pj3sdk9jjjsa68b3pyr";
-    armv7l-linux = "029shxcwnap28ys6lxml3yiiavw4lhnizf35f0a664vdzy1x5dpv";
+    x86_64-linux = "19r4883qa73b23xw0fz21bnp9vcvsbn1q77n6pcm1achwpxscrg6";
+    x86_64-darwin = "0gv4208vcr75wyp6vji1cg6644f5yfwgkgkiav37218v1wjzb4r0";
+    aarch64-linux = "00jzjapyj96bqqq6pz4mdlihwa5g1izkqcp4lqml7hqvmcqrjyrs";
+    armv7l-linux = "0daji52lfbgz0by11idai55ip0m859s35vbyvgv655s21aakrs50";
  }.${system};

  sourceRoot = {
@ -31,7 +31,7 @@ in

    # Please backport all compatible updates to the stable release.
    # This is important for the extension ecosystem.
-    version = "1.62.1";
+    version = "1.62.2";
    pname = "vscodium";

    executableName = "codium";
--- a/pkgs/applications/gis/qmapshack/default.nix
+++ b/pkgs/applications/gis/qmapshack/default.nix
@ -1,5 +1,5 @@
-{ mkDerivation, lib, fetchFromGitHub, cmake
-, qtscript, qtwebengine, gdal, proj, routino, quazip }:
+{ mkDerivation, lib, fetchFromGitHub, cmake, substituteAll
+, qtscript, qttranslations, qtwebengine, gdal, proj, routino, quazip }:

 mkDerivation rec {
  pname = "qmapshack";
@ -12,6 +12,14 @@ mkDerivation rec {
    sha256 = "1yzgkdjxwyg8ggbxyjwr0zjrx99ckrbz2p2524iii9i7qqn8wfsx";
  };

+  patches = [
+    # See https://github.com/NixOS/nixpkgs/issues/86054
+    (substituteAll {
+      src = ./fix-qttranslations-path.patch;
+      inherit qttranslations;
+    })
+  ];
+
  nativeBuildInputs = [ cmake ];

  buildInputs = [ qtscript qtwebengine gdal proj routino quazip ];
--- a/pkgs/applications/gis/qmapshack/fix-qttranslations-path.patch
+++ b/pkgs/applications/gis/qmapshack/fix-qttranslations-path.patch
@ -0,0 +1,74 @@
+diff --git i/src/qmapshack/setup/CAppSetupLinux.cpp w/src/qmapshack/setup/CAppSetupLinux.cpp
+index 63ea06c0..3a03b816 100644
+--- i/src/qmapshack/setup/CAppSetupLinux.cpp
+++ w/src/qmapshack/setup/CAppSetupLinux.cpp
+@@ -30,7 +30,7 @@ void CAppSetupLinux::initQMapShack()
+     prepareGdal("", "");
+ 
+     // setup translators
+-    QString resourceDir = QLibraryInfo::location(QLibraryInfo::TranslationsPath);
+    QLatin1String resourceDir = QLatin1String("@qttranslations@/translations");
+     QString translationPath = QCoreApplication::applicationDirPath();
+     translationPath.replace(QRegExp("bin$"), "share/qmapshack/translations");
+     prepareTranslator(resourceDir, "qt_");
+diff --git i/src/qmapshack/setup/CAppSetupMac.cpp w/src/qmapshack/setup/CAppSetupMac.cpp
+index ad9b21e9..9dca8a1e 100644
+--- i/src/qmapshack/setup/CAppSetupMac.cpp
+++ w/src/qmapshack/setup/CAppSetupMac.cpp
+@@ -63,7 +63,7 @@ void CAppSetupMac::initQMapShack()
+ 
+     // setup translators
+     QString translationPath = getApplicationDir(relTranslationDir).absolutePath();
+-    prepareTranslator(translationPath, "qt_");
+    prepareTranslator(QLatin1String("@qttranslations@/translations"), "qt_");
+     prepareTranslator(translationPath, "qmapshack_");
+ 
+     // load and apply style sheet
+diff --git i/src/qmaptool/setup/CAppSetupLinux.cpp w/src/qmaptool/setup/CAppSetupLinux.cpp
+index dea1c4f3..8da95574 100644
+--- i/src/qmaptool/setup/CAppSetupLinux.cpp
+++ w/src/qmaptool/setup/CAppSetupLinux.cpp
+@@ -29,7 +29,7 @@ void CAppSetupLinux::initQMapTool()
+     prepareGdal("", "");
+ 
+     // setup translators
+-    QString resourceDir = QLibraryInfo::location(QLibraryInfo::TranslationsPath);
+    QLatin1String resourceDir = QLatin1String("@qttranslations@/translations");
+     QString translationPath = QCoreApplication::applicationDirPath();
+     translationPath.replace(QRegExp("bin$"), "share/qmaptool/translations");
+     prepareTranslator(resourceDir, "qt_");
+diff --git i/src/qmaptool/setup/CAppSetupMac.cpp w/src/qmaptool/setup/CAppSetupMac.cpp
+index 02b27e07..fae27748 100644
+--- i/src/qmaptool/setup/CAppSetupMac.cpp
+++ w/src/qmaptool/setup/CAppSetupMac.cpp
+@@ -64,7 +64,7 @@ void CAppSetupMac::initQMapTool()
+ 
+     // setup translators
+     QString translationPath = getApplicationDir(relTranslationDir).absolutePath();
+-    prepareTranslator(translationPath, "qt_");
+    prepareTranslator(QLatin1String("@qttranslations@/translations"), "qt_");
+     prepareTranslator(translationPath, "qmaptool_");
+ 
+     migrateDirContent(defaultCachePath());
+diff --git i/src/qmt_rgb2pct/main.cpp w/src/qmt_rgb2pct/main.cpp
+index 21267d03..d539cec8 100644
+--- i/src/qmt_rgb2pct/main.cpp
+++ w/src/qmt_rgb2pct/main.cpp
+@@ -50,7 +50,7 @@ static void prepareTranslator(QString translationPath, QString translationPrefix
+ static void loadTranslations()
+ {
+ #if defined(Q_OS_LINUX) || defined(Q_OS_FREEBSD) || defined(__FreeBSD_kernel__) || defined(__GNU__) || defined(Q_OS_CYGWIN)
+-    QString resourceDir = QLibraryInfo::location(QLibraryInfo::TranslationsPath);
+    QLatin1String resourceDir = QLatin1String("@qttranslations@/translations");
+     QString translationPath = QCoreApplication::applicationDirPath();
+     translationPath.replace(QRegExp("bin$"), "share/" APP_STR "/translations");
+     prepareTranslator(resourceDir, "qt_");
+@@ -61,7 +61,7 @@ static void loadTranslations()
+     // os x
+     static QString relTranslationDir = "Resources/translations"; // app
+     QString translationPath = getApplicationDir(relTranslationDir).absolutePath();
+-    prepareTranslator(translationPath, "qt_");
+    prepareTranslator(QLatin1String("@qttranslations@/translations"), "qt_");
+     prepareTranslator(translationPath, APP_STR "_");
+ #endif
+ 
--- a/pkgs/applications/misc/calibre/default.nix
+++ b/pkgs/applications/misc/calibre/default.nix
@ -27,21 +27,20 @@

 mkDerivation rec {
  pname = "calibre";
-  version = "5.30.0";
+  version = "5.31.1";

  src = fetchurl {
    url = "https://download.calibre-ebook.com/${version}/${pname}-${version}.tar.xz";
-    sha256 = "058dqqxhc3pl4is1idlnc3pz80k4r681d5aj4a26v9acp8j7zy4f";
+    sha256 = "sha256-3LGEWuHms54ji9GWSyLl8cFWIRBqHY1Jf/CNPJOywrU=";
  };

-  # https://sources.debian.org/patches/calibre/5.30.0+dfsg-1
+  # https://sources.debian.org/patches/calibre/5.31.1+dfsg-1
  patches = [
    #  allow for plugin update check, but no calibre version check
    (fetchpatch {
-      name = "0001_only_plugin_update.patch";
-      url =
-        "https://sources.debian.org/data/main/c/calibre/${version}%2Bdfsg-1/debian/patches/0001-only-plugin-update.patch";
-      sha256 = "sha256-aGT8rJ/eQKAkmyHBWdY0ouZuWvDwtLVJU5xY6d3hY3k=";
+      name = "0001-only-plugin-update.patch";
+      url = "https://raw.githubusercontent.com/debian-calibre/calibre/debian/${version}%2Bdfsg-1/debian/patches/0001-only-plugin-update.patch";
+      sha256 = "sha256-dLzO1TWP7Q4nw2a3oN7qlhGCmcA0NKJrZidUnD6hUMA=";
    })
  ]
  ++ lib.optional (!unrarSupport) ./dont_build_unrar_plugin.patch;
--- a/pkgs/applications/misc/pass-secret-service/default.nix
+++ b/pkgs/applications/misc/pass-secret-service/default.nix
@ -19,9 +19,8 @@ python3.pkgs.buildPythonApplication rec {
  # /etc/ in check phase.
  postPatch = ''
    substituteInPlace Makefile \
-      --replace \
-        "dbus-run-session" \
-        "dbus-run-session --config-file=${dbus}/share/dbus-1/session.conf"
+      --replace "dbus-run-session" "dbus-run-session --config-file=${dbus}/share/dbus-1/session.conf" \
+      --replace '-p $(relpassstore)' '-p $(PASSWORD_STORE_DIR)'
  '';

  propagatedBuildInputs = with python3.pkgs; [
--- a/pkgs/applications/networking/instant-messengers/pidgin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchurl, makeWrapper, pkg-config, gtk2, gtk2-x11, gtkspell2, aspell
+{ callPackage, stdenv, fetchurl, makeWrapper, pkg-config, gtk2, gtk2-x11, gtkspell2, aspell
 , gst_all_1, libstartup_notification, gettext, perlPackages, libxml2, nss
 , nspr, farstream, libXScrnSaver, avahi, dbus, dbus-glib, intltool, libidn
 , lib, python3, libICE, libXext, libSM, libgnt, ncurses, cyrus_sasl, openssl
@ -93,7 +93,7 @@ let unwrapped = stdenv.mkDerivation rec {
 };

 in if plugins == [] then unwrapped
-    else import ./wrapper.nix {
-      inherit makeWrapper symlinkJoin plugins;
+    else callPackage ./wrapper.nix {
+      inherit plugins;
      pidgin = unwrapped;
    }
--- a/pkgs/applications/networking/instant-messengers/pidgin/wrapper.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/wrapper.nix
@ -1,4 +1,4 @@
-{ symlinkJoin, pidgin, makeWrapper, plugins }:
+{ lib, symlinkJoin, pidgin, makeWrapper, plugins }:

 let
 extraArgs = map (x: x.wrapArgs or "") plugins;
@ -11,10 +11,10 @@ in symlinkJoin {

  postBuild = ''
    wrapProgram $out/bin/pidgin \
-      --suffix-each PURPLE_PLUGIN_PATH ':' "$out/lib/purple-${pidgin.majorVersion} $out/lib/pidgin" \
+      --suffix-each PURPLE_PLUGIN_PATH ':' "$out/lib/purple-${lib.versions.major pidgin.version} $out/lib/pidgin" \
      ${toString extraArgs}
    wrapProgram $out/bin/finch \
-      --suffix-each PURPLE_PLUGIN_PATH ':' "$out/lib/purple-${pidgin.majorVersion}" \
+      --suffix-each PURPLE_PLUGIN_PATH ':' "$out/lib/purple-${lib.versions.major pidgin.version}" \
      ${toString extraArgs}
  '';
 }
--- a/pkgs/applications/science/chemistry/octopus/default.nix
+++ b/pkgs/applications/science/chemistry/octopus/default.nix
@ -11,13 +11,13 @@ assert (!blas.isILP64) && (!lapack.isILP64);

 stdenv.mkDerivation rec {
  pname = "octopus";
-  version = "10.5";
+  version = "11.2";

  src = fetchFromGitLab {
    owner = "octopus-code";
    repo = "octopus";
    rev = version;
-    sha256 = "1bgdkmsp6pwq3b6nxxkimrdmz71wqr8qi25gdzwpcv9wmcf1q27v";
+    sha256 = "sha256-leEcUSjpiP13l65K9WKN2GXTtTa8vvK/MFxR2zH6Xno=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/science/chemistry/openmolcas/default.nix
+++ b/pkgs/applications/science/chemistry/openmolcas/default.nix
@ -5,9 +5,9 @@
 } :

 let
-  version = "21.06";
+  version = "21.10";
  # The tag keeps moving, fix a hash instead
-  gitLabRev = "dd982ad4bc94dec8ac1e3e99cb6a7dd249ff71de";
+  gitLabRev = "117305462bac932106e8e3a0347238b768bcb058";

  python = python3.withPackages (ps : with ps; [ six pyparsing ]);

@ -19,7 +19,7 @@ in stdenv.mkDerivation {
    owner = "Molcas";
    repo = "OpenMolcas";
    rev = gitLabRev;
-    sha256 = "07dm73n0s7ckif561yb3s9yqxsv39a73kb9qwny4yp39wdvv52hz";
+    sha256 = "sha256-GMi2dsNBog+TmpmP6fhQcp6Z5Bh2LelV//MqLnvRP5c=";
  };

  patches = [
@ -56,7 +56,9 @@ in stdenv.mkDerivation {
    "-DOPENBLASROOT=${openblas.dev}"
  ];

-  GAROOT=globalarrays;
+  preConfigure = ''
+    export GAROOT=${globalarrays};
+  '';

  postConfigure = ''
    # The Makefile will install pymolcas during the build grrr.
--- a/pkgs/applications/version-management/git-and-tools/git-big-picture/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-big-picture/default.nix
@ -21,7 +21,6 @@ python3Packages.buildPythonApplication rec {
    description = "Tool for visualization of Git repositories";
    homepage = "https://github.com/git-big-picture/git-big-picture";
    license = lib.licenses.gpl3Plus;
-    platforms = lib.platforms.linux;
    maintainers = [ lib.maintainers.nthorne ];
  };
 }
--- a/pkgs/applications/version-management/git-and-tools/glitter/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/glitter/default.nix
@ -2,22 +2,25 @@

 rustPlatform.buildRustPackage rec {
  pname = "glitter";
-  version = "1.4.10";
+  version = "1.5.0";

  src = fetchFromGitHub {
    owner = "milo123459";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-5yv0RZfGLS/cxOxettHQHSPldcq+xa+TNj6dDIAmzOM=";
+    sha256 = "sha256-AEtew+oS66H1BNh71SqRuj8eXmBEA45dRmtc/9fem9s=";
  };

-  cargoSha256 = "sha256-xG7aic7NCcltz9YmQ4V40/h3OR8Vt5IgApp4yoDbPuc=";
+  cargoSha256 = "sha256-bVYfmp0KcVuy0CbUOUoXYQ8BalaKXShitGXLdGWl+rQ=";

  # tests require it to be in a git repository
  preCheck = ''
    git init
  '';

+  # error: Found argument '--test-threads' which wasn't expected, or isn't valid in this context
+  checkFlags = [ "--skip" "runs_correctly" ];
+
  meta = with lib; {
    description = "A git wrapper that allows you to compress multiple commands into one";
    homepage = "https://github.com/milo123459/glitter";
--- a/pkgs/applications/version-management/gitlab/data.json
+++ b/pkgs/applications/version-management/gitlab/data.json
@ -1,14 +1,14 @@
 {
-  "version": "14.4.1",
-  "repo_hash": "0sm44iyn32frc7njg6ypgbcip77mj5c3agn3cihk3lz7z5kr48lm",
+  "version": "14.4.2",
+  "repo_hash": "0zhac96b6p7p9vpj083ajfsj5a2fwkv602zxv79cjvpd924c5ws2",
  "yarn_hash": "0l0lgcgxaira980a1y550pfsm4f2pw97gi8s5pghyfil2v2lyxyw",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v14.4.1-ee",
+  "rev": "v14.4.2-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "14.4.1",
+    "GITALY_SERVER_VERSION": "14.4.2",
    "GITLAB_PAGES_VERSION": "1.46.0",
    "GITLAB_SHELL_VERSION": "13.21.1",
-    "GITLAB_WORKHORSE_VERSION": "14.4.1"
+    "GITLAB_WORKHORSE_VERSION": "14.4.2"
  }
 }
--- a/pkgs/applications/version-management/gitlab/default.nix
+++ b/pkgs/applications/version-management/gitlab/default.nix
@ -198,7 +198,7 @@ stdenv.mkDerivation {
  meta = with lib; {
    homepage = "http://www.gitlab.com/";
    platforms = platforms.linux;
-    maintainers = with maintainers; [ fpletz globin krav talyz yuka ];
+    maintainers = with maintainers; [ fpletz globin krav talyz yayayayaka yuka ];
  } // (if gitlabEnterprise then
    {
      license = licenses.unfreeRedistributable; # https://gitlab.com/gitlab-org/gitlab-ee/raw/master/LICENSE
--- a/pkgs/applications/version-management/gitlab/gitaly/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitaly/default.nix
@ -21,7 +21,7 @@ let
      };
  };

-  version = "14.4.1";
+  version = "14.4.2";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/v${lib.versions.major version}";
 in

@ -33,7 +33,7 @@ buildGoModule {
    owner = "gitlab-org";
    repo = "gitaly";
    rev = "v${version}";
-    sha256 = "sha256-bATqaB7q3MlyacEiBXdcEDs+xsJUbULVnYTSpEznxFg=";
+    sha256 = "sha256-MzYUSoG+HjW9o2zn6Q9Pd5NfI7hZkw1xFXOXHbbxJvo=";
  };

  vendorSha256 = "sha256-9RhPQosen70E9t1iAoc2SeKs9pYMMpMqgXLekWfKNf8=";
--- a/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/applications/version-management/gitlab/gitlab-workhorse/default.nix
@ -5,7 +5,7 @@ in
 buildGoModule rec {
  pname = "gitlab-workhorse";

-  version = "14.4.1";
+  version = "14.4.2";

  src = fetchFromGitLab {
    owner = data.owner;
--- a/pkgs/data/fonts/noto-fonts/tools.nix
+++ b/pkgs/data/fonts/noto-fonts/tools.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "nototools";
-  version = "0.2.13";
+  version = "0.2.16";

  disabled = pythonOlder "3.6";

@ -15,7 +15,7 @@ buildPythonPackage rec {
    owner = "googlefonts";
    repo = "nototools";
    rev = "v${version}";
-    sha256 = "0ggp65xgkf9y7jamncm65lkm84wapsa47abf133pcb702875v8jz";
+    sha256 = "14rrdamkmhrykff8ln07fq9cm8zwj3k113lzwjcy0lgz23g51jyl";
  };

  postPatch = ''
--- a/pkgs/data/misc/wireless-regdb/default.nix
+++ b/pkgs/data/misc/wireless-regdb/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "wireless-regdb";
-  version = "2021.07.14";
+  version = "2021.08.28";

  src = fetchurl {
    url = "https://www.kernel.org/pub/software/network/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-Li3SFqXxoxC4SXdK9j5jCdlMIgfDR3GlNMR64YsWJ0I=";
+    sha256 = "sha256-z/NwxBDR5tMWrgp/qKxieP3x78pdPWZKynz9Kq+lREY=";
  };

  dontBuild = true;
--- a/pkgs/development/libraries/lucene++/default.nix
+++ b/pkgs/development/libraries/lucene++/default.nix
@ -1,28 +1,36 @@
-{ lib, stdenv, fetchFromGitHub, cmake, boost, gtest }:
+{ lib, stdenv, fetchFromGitHub, cmake, boost, gtest, zlib }:

 stdenv.mkDerivation rec {
  pname = "lucene++";
-  version = "3.0.7";
+  version = "3.0.8";

  src = fetchFromGitHub {
    owner = "luceneplusplus";
    repo = "LucenePlusPlus";
    rev = "rel_${version}";
-    sha256 = "06b37fly6l27zc6kbm93f6khfsv61w792j8xihfagpcm9cfz2zi1";
+    sha256 = "12v7r62f7pqh5h210pb74sfx6h70lj4pgfpva8ya2d55fn0qxrr2";
  };

-  postPatch = ''
-    sed -i -e '/Subversion *REQUIRED/d' \
-           -e '/include.*CMakeExternal/d' \
-           CMakeLists.txt
-  '';
-
-  cmakeFlags = [ "-DGTEST_INCLUDE_DIR=${gtest}/include" ];
  nativeBuildInputs = [ cmake ];
-  buildInputs = [ boost gtest ];
+  buildInputs = [ boost gtest zlib ];

  doCheck = true;
-  checkTarget = "test";
+
+  postPatch = ''
+     substituteInPlace src/test/CMakeLists.txt \
+            --replace "add_subdirectory(gtest)" ""
+  '';
+
+  checkPhase = ''
+    runHook preCheck
+    LD_LIBRARY_PATH=$PWD/src/contrib:$PWD/src/core \
+            src/test/lucene++-tester
+    runHook postCheck
+  '';
+
+  postInstall = ''
+    mv $out/include/pkgconfig $out/lib/
+  '';

  meta = {
    description = "C++ port of the popular Java Lucene search engine";
--- a/pkgs/development/libraries/science/math/p4est-sc/default.nix
+++ b/pkgs/development/libraries/science/math/p4est-sc/default.nix
@ -22,11 +22,12 @@ stdenv.mkDerivation {
    sha256 = "14vm0b162jh8399pgpsikbwq4z5lkrw9vfzy3drqykw09n6nc53z";
  };

+  strictDeps = true;
  nativeBuildInputs = [ autoreconfHook pkg-config ];
-  propagatedBuildInputs = [ zlib ]
-    ++ lib.optional mpiSupport mpi
+  propagatedNativeBuildInputs = lib.optional mpiSupport mpi
    ++ lib.optional isOpenmpi openssh
  ;
+  propagatedBuildInputs = [ zlib ];
  inherit debugEnable mpiSupport;

  postPatch = ''
--- a/pkgs/development/libraries/science/math/p4est/default.nix
+++ b/pkgs/development/libraries/science/math/p4est/default.nix
@ -21,6 +21,7 @@ stdenv.mkDerivation {
    sha256 = "0vffnf48rzw6d0as4c3x1f31b4kapmdzr1hfj5rz5ngah72gqrph";
  };

+  strictDeps = true;
  nativeBuildInputs = [ autoreconfHook pkg-config ];
  propagatedBuildInputs = [ p4est-sc ];
  buildInputs = lib.optional withMetis metis;
--- a/pkgs/development/libraries/science/math/petsc/default.nix
+++ b/pkgs/development/libraries/science/math/petsc/default.nix
@ -28,10 +28,12 @@ stdenv.mkDerivation rec {
  mpiSupport = !withp4est || p4est.mpiSupport;
  withp4est = petsc-withp4est;

-  nativeBuildInputs = [ python3 gfortran ];
-  buildInputs = [ blas lapack ]
+  strictDeps = true;
+  nativeBuildInputs = [ python3 gfortran ]
    ++ lib.optional mpiSupport mpi
    ++ lib.optional (mpiSupport && mpi.pname == "openmpi") openssh
+  ;
+  buildInputs = [ blas lapack ]
    ++ lib.optional withp4est p4est
  ;

--- a/pkgs/development/misc/resholve/source.nix
+++ b/pkgs/development/misc/resholve/source.nix
@ -3,7 +3,7 @@
 }:

 rec {
-  version = "0.6.6";
+  version = "0.6.8";
  rSrc =
    # local build -> `make ci`; `make clean` to restore
    # return to remote source
@ -14,6 +14,6 @@ rec {
        owner = "abathur";
        repo = "resholve";
        rev = "v${version}";
-        hash = "sha256-bupf3c9tNPAEMzFEDcvg483bSiwZFuB3ZqveG89dgkE=";
+        hash = "sha256-1bb22GcOIzmQ31ULZuNNCJ8Vcz4Y0+qAhsJ9PhbqnDM=";
      };
 }
--- a/pkgs/development/misc/resholve/test.nix
+++ b/pkgs/development/misc/resholve/test.nix
@ -21,10 +21,17 @@
 , rSrc
 , runDemo ? false
 , binlore
+, sqlite
+, util-linux
+, gawk
+, rlwrap
+, gnutar
+, bc
 }:

 let
-
+  default_packages = [ bash file findutils gettext ];
+  parsed_packages = [ coreutils sqlite util-linux gnused gawk findutils rlwrap gnutar bc ];
 in
 rec {
  re_shunit2 = with shunit2;
@ -56,9 +63,6 @@ rec {
            "/usr/bin/od" = true;
          };
          keep = {
-            # dynamically defined in shunit2:_shunit_mktempFunc
-            eval = [ "shunit_condition_" "_shunit_test_" "_shunit_prepForSourcing" ];
-
            # variables invoked as commands; long-term goal is to
            # resolve the *variable*, but that is complexish, so
            # this is where we are...
@ -166,13 +170,14 @@ rec {
    # LOGLEVEL="DEBUG";

    # default path
-    RESHOLVE_PATH = "${lib.makeBinPath [ bash file findutils gettext ]}";
+    RESHOLVE_PATH = "${lib.makeBinPath default_packages}";
    # but separate packages for combining as needed
    PKG_FILE = "${lib.makeBinPath [ file ]}";
    PKG_FINDUTILS = "${lib.makeBinPath [ findutils ]}";
    PKG_GETTEXT = "${lib.makeBinPath [ gettext ]}";
    PKG_COREUTILS = "${lib.makeBinPath [ coreutils ]}";
-    RESHOLVE_LORE = "${binlore.collect { drvs = [ bash file findutils gettext coreutils ]; } }";
+    RESHOLVE_LORE = "${binlore.collect { drvs = default_packages ++ [ coreutils ] ++ parsed_packages; } }";
+    PKG_PARSED = "${lib.makeBinPath parsed_packages}";

    # explicit interpreter for demo suite; maybe some better way...
    INTERP = "${bash}/bin/bash";
--- a/pkgs/development/nim-packages/python/default.nix
+++ b/pkgs/development/nim-packages/python/default.nix
@ -0,0 +1,25 @@
+{ lib, buildNimPackage, fetchFromGitHub, python27 }:
+
+buildNimPackage rec {
+  pname = "python";
+  version = "1.2";
+  src = fetchFromGitHub {
+    owner = "nim-lang";
+    repo = pname;
+    rev = "b7c3b2c447a69fdb0a974ba149062e52182fda08";
+    hash = "sha256-Wl4on0rf4zbNxmwmq/ZkNiPIFCZY+1BdokPQoba2EVI=";
+  };
+  postPatch = let pythonLib = "${python27}/lib/libpython2.7.so";
+  in ''
+    substituteInPlace src/python.nim \
+      --replace 'items(LibNames)' "[\"${pythonLib}\"]" \
+      --replace 'dynlib: dllname' 'dynlib: "${pythonLib}"'
+  '';
+  doCheck = true;
+  meta = with lib;
+    src.meta // {
+      description = "Nim wrapper for the Python 2 programming language";
+      license = [ licenses.mit ];
+      maintainers = [ maintainers.ehmry ];
+    };
+}
--- a/pkgs/development/nim-packages/rocksdb/default.nix
+++ b/pkgs/development/nim-packages/rocksdb/default.nix
@ -0,0 +1,20 @@
+{ lib, buildNimPackage, fetchFromGitHub, rocksdb, stew, tempfile }:
+
+buildNimPackage rec {
+  pname = "rocksdb";
+  version = "0.2.0";
+  src = fetchFromGitHub {
+    owner = "status-im";
+    repo = "nim-${pname}";
+    rev = "5b1307cb1f4c85bb72ff781d810fb8c0148b1183";
+    hash = "sha256-gjMCB9kpWVi9Qv73/jhoAYw857OmQpry//bDQCtyJo0=";
+  };
+  buildInputs = [ stew tempfile ];
+  propagatedBuildInputs = [ rocksdb ];
+  doCheck = false;
+  meta = with lib;
+    src.meta // {
+      description = "Nim wrapper for RocksDB";
+      maintainers = [ maintainers.ehmry ];
+    };
+}
--- a/pkgs/development/nim-packages/snappy/config.patch
+++ b/pkgs/development/nim-packages/snappy/config.patch
@ -0,0 +1,7 @@
+diff --git a/tests/config.nims b/tests/config.nims
+index 46348f1..fbe9f5e 100644
+--- a/tests/config.nims
+++ b/tests/config.nims
+@@ -1 +1,2 @@
+ switch("path", "..")
+switch("passL", "-lsnappy")
--- a/pkgs/development/nim-packages/snappy/default.nix
+++ b/pkgs/development/nim-packages/snappy/default.nix
@ -0,0 +1,25 @@
+{ lib, buildNimPackage, fetchFromGitHub, snappy }:
+
+buildNimPackage rec {
+  pname = "snappy";
+  version = "0.1.0";
+  src = fetchFromGitHub {
+    owner = "jangko";
+    repo = pname;
+    rev = "d13e2ccb2acaa4e8dedce4f25e8dbf28e19278a6";
+    hash = "sha256-18CFRuDK+E701MHrCixx22QSVmglTc0EJwrMCsKwayM=";
+  };
+  propagatedBuildInputs = [ snappy ];
+  patches = [ ./config.patch ];
+  doCheck = true;
+  preCheck = ''
+    mkdir $NIX_BUILD_TOP/nimcache/
+    mv -v tests/data $NIX_BUILD_TOP/nimcache/data
+  ''; # test standards, please
+  meta = with lib;
+    src.meta // {
+      description = "Nim implementation of snappy compression algorithm";
+      license = [ lib.licenses.mit ];
+      maintainers = [ maintainers.ehmry ];
+    };
+}
--- a/pkgs/development/nim-packages/spry/default.nix
+++ b/pkgs/development/nim-packages/spry/default.nix
@ -0,0 +1,23 @@
+{ lib, buildNimPackage, fetchFromGitHub, python, rocksdb, snappy, spryvm, stew
+, tempfile, ui }:
+
+buildNimPackage rec {
+  pname = "spry";
+  version = "0.9.0";
+  src = fetchFromGitHub {
+    owner = "gokr";
+    repo = pname;
+    rev = "098da7bb34a9113d5db5402fecfc76b1c3fa3b36";
+    hash = "sha256-PfWBrG2Z16tLgcN8JYpHaNMysBbbYX812Lkgk0ItMwE=";
+  };
+  buildInputs = [ python rocksdb snappy spryvm stew tempfile ui ];
+  patches = [ ./nil.patch ];
+  doCheck = true;
+  meta = with lib;
+    src.meta // {
+      description =
+        "A Smalltalk and Rebol inspired language implemented as an AST interpreter in Nim";
+      license = [ licenses.mit ];
+      maintainers = [ maintainers.ehmry ];
+    };
+}
--- a/pkgs/development/nim-packages/spry/nil.patch
+++ b/pkgs/development/nim-packages/spry/nil.patch
@ -0,0 +1,35 @@
+diff --git a/src/ispry.nim b/src/ispry.nim
+index 23ad6c3..dc38a9d 100644
+--- a/src/ispry.nim
+++ b/src/ispry.nim
+@@ -134,8 +134,8 @@ proc main() =
+       #discard spry.setBinding(newEvalWord("@"), result)
+       var output = $result
+       # Print any result
+-      if output.isNil:
+-        output = if suspended: "nil" else: ""
+      if output == "" and suspended:
+        output = "nil"
+       stdout.write(output & "\n")
+ #      except:
+  #       echo "Oops, sorry about that: " & getCurrentExceptionMsg() & "\n"
+diff --git a/src/spry.nim b/src/spry.nim
+index 670a280..d81bb4c 100644
+--- a/src/spry.nim
+++ b/src/spry.nim
+@@ -87,13 +87,13 @@ for kind, key, val in getopt():
+   of cmdEnd: assert(false) # cannot happen
+ 
+ if eval:
+-  if filename == nil:
+  if filename == "":
+     writeHelp()
+   else:
+     code = filename
+ else:
+   code =
+-    if filename == nil:
+    if filename == "":
+       # no filename has been given, so we use stdin
+       readAll stdin
+     else:
--- a/pkgs/development/nim-packages/spryvm/default.nix
+++ b/pkgs/development/nim-packages/spryvm/default.nix
@ -0,0 +1,21 @@
+{ lib, buildNimPackage, fetchFromGitHub, sqlite }:
+
+buildNimPackage rec {
+  pname = "spryvm";
+  version = "0.9.3";
+  src = fetchFromGitHub {
+    owner = "gokr";
+    repo = pname;
+    rev = "36c2b56bb194902d33de7bcf70d3041703e107ab";
+    hash = "sha256-OxB49ef6qPvSXLsyVl5g2ic/P9MMbF3jRYDWrxNJ0Iw=";
+  };
+  propagatedBuildInputs = [ sqlite ];
+  patches = [ ./nil.patch ];
+  doCheck = true;
+  meta = with lib;
+    src.meta // {
+      description = "Spry virtual machine";
+      license = [ licenses.mit ];
+      maintainers = [ maintainers.ehmry ];
+    };
+}
--- a/pkgs/development/nim-packages/spryvm/nil.patch
+++ b/pkgs/development/nim-packages/spryvm/nil.patch
@ -0,0 +1,21 @@
+diff --git a/spryvm/spryui.nim b/spryvm/spryui.nim
+index 37f5329..50440e9 100644
+--- a/spryvm/spryui.nim
+++ b/spryvm/spryui.nim
+@@ -140,14 +140,14 @@ proc addUI*(spry: Interpreter) =
+   nimMeth("openFile"):
+     var win = WindowNode(evalArgInfix(spry))
+     var path = openFile(Window(win.widget))
+-    if path.isNil:
+    if path == "":
+       spry.nilVal
+     else:
+       newValue($path)
+   nimMeth("saveFile"):
+     var win = WindowNode(evalArgInfix(spry))
+     var path = saveFile(Window(win.widget))
+-    if path.isNil:
+    if path == "":
+       spry.nilVal
+     else:
+       newValue($path)
--- a/pkgs/development/nim-packages/stew/default.nix
+++ b/pkgs/development/nim-packages/stew/default.nix
@ -0,0 +1,20 @@
+{ lib, buildNimPackage, fetchFromGitHub, snappy }:
+
+buildNimPackage rec {
+  pname = "stew";
+  version = "0.1.0";
+  src = fetchFromGitHub {
+    owner = "status-im";
+    repo = "nim-${pname}";
+    rev = "478cc6efdefaabadf0666a3351fb959b78009bcc";
+    hash = "sha256-txlTF0zNV5kV4KfE744oB3aVLCfWS9BdoKxUmTQTTRY=";
+  };
+  doCheck = false;
+  meta = with lib;
+    src.meta // {
+      description =
+        "Backports, standard library candidates and small utilities that don't yet deserve their own repository";
+      license = [ lib.licenses.asl20 ];
+      maintainers = [ maintainers.ehmry ];
+    };
+}
--- a/pkgs/development/nim-packages/tempfile/default.nix
+++ b/pkgs/development/nim-packages/tempfile/default.nix
@ -0,0 +1,19 @@
+{ lib, buildNimPackage, fetchFromGitHub }:
+
+buildNimPackage rec {
+  pname = "tempfile";
+  version = "0.1.7";
+  src = fetchFromGitHub {
+    owner = "OpenSystemsLab";
+    repo = "${pname}.nim";
+    rev = version;
+    hash = "sha256-08vvHXVxL1mAcpMzosaHd2FupTJrKJP5JaVcgxN4oYE=";
+  };
+  doCheck = false; # impure
+  meta = with lib;
+    src.meta // {
+      description = "Temporary files and folders";
+      license = [ lib.licenses.mit ];
+      maintainers = [ maintainers.ehmry ];
+    };
+}
--- a/pkgs/development/nim-packages/ui/default.nix
+++ b/pkgs/development/nim-packages/ui/default.nix
@ -0,0 +1,24 @@
+{ lib, buildNimPackage, fetchFromGitHub, libui, pkg-config }:
+
+buildNimPackage rec {
+  pname = "ui";
+  version = "0.9.4";
+  src = fetchFromGitHub {
+    owner = "nim-lang";
+    repo = pname;
+    rev = "547e1cea8e9fb68c138c422b77af0a3152e50210";
+    hash = "sha256-rcvC0TO1r2zU7WEYfcsi/qX+nRITwKj7Fkqd4fHgTwU=";
+  };
+  propagatedBuildInputs = [ libui ];
+  propagatedNativeBuildInputs = [ pkg-config ];
+  postPatch = ''
+    echo {.passL: r\"$(pkg-config --libs libui)\".} >> ui/rawui.nim
+  '';
+  doCheck = true;
+  meta = with lib;
+    src.meta // {
+      description = "Nim bindings to libui";
+      license = [ licenses.mit ];
+      maintainers = [ maintainers.ehmry ];
+    };
+}
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@ -151,7 +151,7 @@
 , "insect"
 , "intelephense"
 , "ionic"
-, {"iosevka": "https://github.com/be5invis/Iosevka/archive/v10.3.1.tar.gz"}
+, {"iosevka": "https://github.com/be5invis/Iosevka/archive/v11.0.1.tar.gz"}
 , "jake"
 , "javascript-typescript-langserver"
 , "joplin"
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
--- a/pkgs/development/python-modules/graphviz/default.nix
+++ b/pkgs/development/python-modules/graphviz/default.nix
@ -4,6 +4,7 @@
 , fetchFromGitHub
 , substituteAll
 , graphviz
+, xdg-utils
 , makeFontsConf
 , freefont_ttf
 , mock
@ -13,7 +14,7 @@

 buildPythonPackage rec {
  pname = "graphviz";
-  version = "0.17";
+  version = "0.18";

  disabled = pythonOlder "3.6";

@ -22,13 +23,14 @@ buildPythonPackage rec {
    owner = "xflr6";
    repo = "graphviz";
    rev = version;
-    sha256 = "sha256-K6z2C7hQH2A9bqgRR4MRqxVAH/k2NQBEelb2/6KDUr0=";
+    sha256 = "sha256-K98CwG+V+EFwzyawVjRwVhbX2FVfoX7dCAD5PXAWTq8=";
  };

  patches = [
    (substituteAll {
-      src = ./hardcode-graphviz-path.patch;
+      src = ./paths.patch;
      inherit graphviz;
+      xdgutils = xdg-utils;
    })
  ];

--- a/pkgs/development/python-modules/graphviz/hardcode-graphviz-path.patch
+++ b/pkgs/development/python-modules/graphviz/hardcode-graphviz-path.patch
@ -1,98 +0,0 @@
-diff --git a/graphviz/backend.py b/graphviz/backend.py
-index b66e616..3da4ef0 100644
--- a/graphviz/backend.py
-+++ b/graphviz/backend.py
-@@ -124,7 +124,7 @@ def command(engine: str, format_: str, filepath=None,
-         raise ValueError(f'unknown formatter: {formatter!r}')
- 
-     output_format = [f for f in (format_, renderer, formatter) if f is not None]
-    cmd = ['dot', '-K%s' % engine, '-T%s' % ':'.join(output_format)]
-+    cmd = ['@graphviz@/bin/dot', '-K%s' % engine, '-T%s' % ':'.join(output_format)]
- 
-     if filepath is None:
-         rendered = None
-@@ -297,7 +297,7 @@ def unflatten(source: str,
-     if fanout and stagger is None:
-         raise RequiredArgumentError('fanout given without stagger')
- 
-    cmd = ['unflatten']
-+    cmd = ['@graphviz@/bin/unflatten']
-     if stagger is not None:
-         cmd += ['-l', str(stagger)]
-     if fanout:
-@@ -332,7 +332,7 @@ def version() -> typing.Tuple[int, ...]:
-         Graphviz Release version entry format:
-         https://gitlab.com/graphviz/graphviz/-/blob/f94e91ba819cef51a4b9dcb2d76153684d06a913/gen_version.py#L17-20
-     """
-    cmd = ['dot', '-V']
-+    cmd = ['@graphviz@/bin/dot', '-V']
-     out, _ = run(cmd, check=True, encoding='ascii',
-                  stdout=subprocess.PIPE,
-                  stderr=subprocess.STDOUT)
-diff --git a/tests/test_backend.py b/tests/test_backend.py
-index e0a0e1c..681f178 100644
--- a/tests/test_backend.py
-+++ b/tests/test_backend.py
-@@ -54,7 +54,7 @@ def test_run_encoding_mocked(mocker, Popen, input='sp\xe4m', encoding='utf-8'):
-         m.decode.assert_called_once_with(encoding)
- 
- 
-@pytest.mark.exe
-+@pytest.mark.skip(reason='empty $PATH has no effect')
- @pytest.mark.usefixtures('empty_path')
- @pytest.mark.parametrize('func, args', [
-     (render, ['dot', 'pdf', 'nonfilepath']),
-@@ -148,7 +148,7 @@ def test_render_mocked(capsys, mocker, Popen, quiet):  # noqa: N803
- 
-     assert render('dot', 'pdf', 'nonfilepath', quiet=quiet) == 'nonfilepath.pdf'
- 
-    Popen.assert_called_once_with(['dot', '-Kdot', '-Tpdf', '-O', 'nonfilepath'],
-+    Popen.assert_called_once_with(['@graphviz@/bin/dot', '-Kdot', '-Tpdf', '-O', 'nonfilepath'],
-                                   stdout=subprocess.PIPE,
-                                   stderr=subprocess.PIPE,
-                                   cwd=None, startupinfo=mocker.ANY)
-@@ -211,7 +211,7 @@ def test_pipe_pipe_invalid_data_mocked(mocker, Popen, quiet):  # noqa: N803
-     assert e.value.stdout is out
-     e.value.stdout = mocker.sentinel.new_stdout
-     assert e.value.stdout is mocker.sentinel.new_stdout
-    Popen.assert_called_once_with(['dot', '-Kdot', '-Tpng'],
-+    Popen.assert_called_once_with(['@graphviz@/bin/dot', '-Kdot', '-Tpng'],
-                                   stdin=subprocess.PIPE,
-                                   stdout=subprocess.PIPE,
-                                   stderr=subprocess.PIPE,
-@@ -231,7 +231,7 @@ def test_pipe_mocked(capsys, mocker, Popen, quiet):  # noqa: N803
- 
-     assert pipe('dot', 'png', b'nongraph', quiet=quiet) == b'stdout'
- 
-    Popen.assert_called_once_with(['dot', '-Kdot', '-Tpng'],
-+    Popen.assert_called_once_with(['@graphviz@/bin/dot', '-Kdot', '-Tpng'],
-                                   stdin=subprocess.PIPE,
-                                   stdout=subprocess.PIPE,
-                                   stderr=subprocess.PIPE,
-@@ -259,7 +259,7 @@ def test_unflatten_mocked(capsys, mocker, Popen):
-     proc.communicate.return_value = (b'nonresult', b'')
- 
-     assert unflatten('nonsource') == 'nonresult'
-    Popen.assert_called_once_with(['unflatten'],
-+    Popen.assert_called_once_with(['@graphviz@/bin/unflatten'],
-                                   stdin=subprocess.PIPE,
-                                   stdout=subprocess.PIPE,
-                                   stderr=subprocess.PIPE,
-@@ -290,7 +290,7 @@ def test_version_parsefail_mocked(mocker, Popen):  # noqa: N803
-     with pytest.raises(RuntimeError, match=r'nonversioninfo'):
-         version()
- 
-    Popen.assert_called_once_with(['dot', '-V'],
-+    Popen.assert_called_once_with(['@graphviz@/bin/dot', '-V'],
-                                   stdout=subprocess.PIPE,
-                                   stderr=subprocess.STDOUT,
-                                   startupinfo=mocker.ANY)
-@@ -312,7 +312,7 @@ def test_version_mocked(mocker, Popen, stdout, expected):  # noqa: N803
- 
-     assert version() == expected
- 
-    Popen.assert_called_once_with(['dot', '-V'],
-+    Popen.assert_called_once_with(['@graphviz@/bin/dot', '-V'],
-                                   stdout=subprocess.PIPE,
-                                   stderr=subprocess.STDOUT,
-                                   startupinfo=mocker.ANY)
--- a/pkgs/development/python-modules/graphviz/paths.patch
+++ b/pkgs/development/python-modules/graphviz/paths.patch
@ -0,0 +1,89 @@
+diff --git a/graphviz/backend/dot_command.py b/graphviz/backend/dot_command.py
+index d1903e6..6470d11 100644
+--- a/graphviz/backend/dot_command.py
+++ b/graphviz/backend/dot_command.py
+@@ -10,7 +10,7 @@ from . import parameters
+ __all__ = ['command']
+ 
+ #: :class:`pathlib.Path` of layout command (``Path('dot')``).
+-DOT_BINARY = pathlib.Path('dot')
+DOT_BINARY = pathlib.Path('@graphviz@/bin/dot')
+ 
+ 
+ def command(engine: str, format_: str, *,
+diff --git a/graphviz/backend/unflattening.py b/graphviz/backend/unflattening.py
+index 5ed25d6..8d2faf8 100644
+--- a/graphviz/backend/unflattening.py
+++ b/graphviz/backend/unflattening.py
+@@ -11,7 +11,7 @@ from . import execute
+ __all__ = ['unflatten']
+ 
+ #: :class:`pathlib.Path` of unflatten command (``Path('unflatten')``).
+-UNFLATTEN_BINARY = pathlib.Path('unflatten')
+UNFLATTEN_BINARY = pathlib.Path('@graphviz@/bin/unflatten')
+ 
+ 
+ def unflatten(source: str,
+diff --git a/graphviz/backend/viewing.py b/graphviz/backend/viewing.py
+index 6d4a4d1..2cc6cd8 100644
+--- a/graphviz/backend/viewing.py
+++ b/graphviz/backend/viewing.py
+@@ -54,7 +54,7 @@ def view_darwin(filepath, *, quiet: bool) -> None:
+ @tools.attach(view, 'freebsd')
+ def view_unixoid(filepath, *, quiet: bool) -> None:
+     """Open filepath in the user's preferred application (linux, freebsd)."""
+-    cmd = ['xdg-open', filepath]
+    cmd = ['@xdgutils@/bin/xdg-open', filepath]
+     log.debug('view: %r', cmd)
+     kwargs = {'stderr': subprocess.DEVNULL} if quiet else {}
+     subprocess.Popen(cmd, **kwargs)
+diff --git a/tests/_common.py b/tests/_common.py
+index ab93461..7eaca89 100644
+--- a/tests/_common.py
+++ b/tests/_common.py
+@@ -10,7 +10,7 @@ __all__ = ['EXPECTED_DOT_BINARY', 'EXPECTED_DEFAULT_ENCODING',
+            'as_cwd',
+            'check_startupinfo', 'StartupinfoMatcher']
+ 
+-EXPECTED_DOT_BINARY = pathlib.Path('dot')
+EXPECTED_DOT_BINARY = pathlib.Path('@graphviz@/bin/dot')
+ 
+ EXPECTED_DEFAULT_ENCODING = 'utf-8'
+ 
+diff --git a/tests/backend/test_execute.py b/tests/backend/test_execute.py
+index 05d6525..78484cb 100644
+--- a/tests/backend/test_execute.py
+++ b/tests/backend/test_execute.py
+@@ -57,6 +57,7 @@ def test_run_check_input_lines_mocked(mocker, sentinel, mock_popen,
+     mock_sys_stderr.flush.assert_called_once_with()
+ 
+ 
+@pytest.mark.skip(reason='empty $PATH has no effect')
+ @pytest.mark.usefixtures('empty_path')
+ @pytest.mark.parametrize(
+     'func, args',
+diff --git a/tests/backend/test_unflattening.py b/tests/backend/test_unflattening.py
+index 033a4d2..7d52689 100644
+--- a/tests/backend/test_unflattening.py
+++ b/tests/backend/test_unflattening.py
+@@ -8,7 +8,7 @@ import graphviz
+ 
+ import _common
+ 
+-EXPECTED_UNFLATTEN_BINARY = pathlib.Path('unflatten')
+EXPECTED_UNFLATTEN_BINARY = pathlib.Path('@graphviz@/bin/unflatten')
+ 
+ 
+ @pytest.mark.exe
+diff --git a/tests/backend/test_viewing.py b/tests/backend/test_viewing.py
+index f5acddb..6b34884 100644
+--- a/tests/backend/test_viewing.py
+++ b/tests/backend/test_viewing.py
+@@ -25,6 +25,6 @@ def test_view(mocker, mock_platform, mock_popen, mock_startfile, quiet):
+     if mock_platform == 'darwin':
+         mock_popen.assert_called_once_with(['open', 'nonfilepath'], **kwargs)
+     elif mock_platform in ('linux', 'freebsd'):
+-        mock_popen.assert_called_once_with(['xdg-open', 'nonfilepath'], **kwargs)
+        mock_popen.assert_called_once_with(['@xdgutils@/bin/xdg-open', 'nonfilepath'], **kwargs)
+     else:
+         raise RuntimeError
--- a/pkgs/development/python-modules/python3-saml/default.nix
+++ b/pkgs/development/python-modules/python3-saml/default.nix
@ -1,36 +1,18 @@
-{ lib, fetchpatch, fetchFromGitHub, buildPythonPackage, isPy3k,
+{ lib, fetchFromGitHub, buildPythonPackage, isPy3k,
 isodate, lxml, xmlsec, freezegun }:

 buildPythonPackage rec {
  pname = "python3-saml";
-  version = "1.10.1";
+  version = "1.12.0";
  disabled = !isPy3k;

  src = fetchFromGitHub {
    owner = "onelogin";
    repo = "python3-saml";
    rev = "v${version}";
-    sha256 = "1yk02xq90bm7p6k091av6gapb5h2ccxzgrbm03sj2x8h0wff9s8k";
+    sha256 = "sha256-VPUsjuo4FIes8ti0tkR0kT3J3RdUt1wtl4QEahVsc2c=";
  };

-  # Remove both patches on update
-  patches = [
-    # Remove the dependency on defusedxml
-    #
-    # This patch is already merged upstream and does not introduce any
-    # functionality changes.
-    (fetchpatch {
-      url = "https://github.com/onelogin/python3-saml/commit/4b6c4b1f2ed3f6eab70ff4391e595b808ace168c.patch";
-      sha256 = "sha256-KHyAoX3our3Rz2z4xo0lTBB1XOGuC3Pe+lUDCzK5WQI=";
-    })
-
-    # Update expiry dates for test response XMLs
-    (fetchpatch {
-      url = "https://github.com/onelogin/python3-saml/commit/05611bbf6d7d8313adb9c77ff88a9210333ccc38.patch";
-      sha256 = "sha256-62TwgCXDFYsZIAeqAysJRziMvhUVhGzta/C2wS3v4HY=";
-    })
-  ];
-
  propagatedBuildInputs = [
    isodate lxml xmlsec
  ];
--- a/pkgs/development/python-modules/scikit-image/add-testing-data.patch
+++ b/pkgs/development/python-modules/scikit-image/add-testing-data.patch
@ -0,0 +1,17 @@
+diff --git a/skimage/data/setup.py b/skimage/data/setup.py
+index 528e9c284ce..ba0e155559c 100644
+--- a/skimage/data/setup.py
+++ b/skimage/data/setup.py
+@@ -11,7 +11,11 @@ def configuration(parent_package='', top_path=None):
+     # further notice.
+     # Testing data and additional datasets should only
+     # be made available via pooch
+-    config.add_data_files(*legacy_datasets)
+    # Nix patch: add ALL images to facilitate testing of a fully-built package
+    from pathlib import Path
+    config.add_data_files(
+        *(path.name for path in Path(__file__).parent.glob("*") if path.suffix != ".py")
+    )
+     # It seems hard to create a consistent hash for README.txt since
+     # the line endings keep getting converted
+     config.add_data_files('README.txt')
--- a/pkgs/development/python-modules/scikit-image/default.nix
+++ b/pkgs/development/python-modules/scikit-image/default.nix
@ -1,6 +1,7 @@
 { lib
-, fetchPypi
+, fetchFromGitHub
 , buildPythonPackage
+, python
 , cython
 , numpy
 , scipy
@ -11,20 +12,26 @@
 , pywavelets
 , dask
 , cloudpickle
-, pytest
 , imageio
 , tifffile
+, pytestCheckHook
 }:

-buildPythonPackage rec {
+let
+  installedPackageRoot = "${builtins.placeholder "out"}/${python.sitePackages}";
+in buildPythonPackage rec {
  pname = "scikit-image";
  version = "0.18.3";

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "ecae99f93f4c5e9b1bf34959f4dc596c41f2f6b2fc407d9d9ddf85aebd3137ca";
+  src = fetchFromGitHub {
+    owner = pname;
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0a2h3bw5rkk23k4r04qc9maccg00nddssd7lfsps8nhp5agk1vyh";
  };

+  patches = [ ./add-testing-data.patch ];
+
  nativeBuildInputs = [ cython ];

  propagatedBuildInputs = [
@ -41,14 +48,51 @@ buildPythonPackage rec {
    tifffile
  ];

-  checkInputs = [ pytest ];
+  checkInputs = [ pytestCheckHook ];

-  # No tests in archive
-  doCheck = false;
+  # (1) The package has cythonized modules, whose .so libs will appear only in the wheel, i.e. in nix store;
+  # (2) To stop Python from importing the wrong directory, i.e. the one in the build dir, not the one in nix store, `skimage` dir should be removed or renamed;
+  # (3) Therefore, tests should be run on the installed package in nix store.
+
+  # See e.g. https://discourse.nixos.org/t/cant-import-cythonized-modules-at-checkphase/14207 on why the following is needed.
+  preCheck = ''
+    rm -r skimage
+  '';
+
+  disabledTestPaths = [
+    # Requires network access (actually some data is loaded via `skimage._shared.testing.fetch` in the global scope, which calls `pytest.skip` when a network is unaccessible, leading to a pytest collection error).
+    "${installedPackageRoot}/skimage/filters/rank/tests/test_rank.py"
+  ];
+  pytestFlagsArray = [ "${installedPackageRoot}" "--pyargs" "skimage" ] ++ builtins.map (testid: "--deselect=" + testid) [
+    # These tests require network access
+    "skimage/data/test_data.py::test_skin"
+    "skimage/data/tests/test_data.py::test_skin"
+    "skimage/io/tests/test_io.py::test_imread_http_url"
+    "skimage/restoration/tests/test_rolling_ball.py::test_ndim"
+  ];
+
+  # Check cythonized modules
+  pythonImportsCheck = [
+    "skimage"
+    "skimage._shared"
+    "skimage.draw"
+    "skimage.feature"
+    "skimage.restoration"
+    "skimage.filters"
+    "skimage.future.graph"
+    "skimage.graph"
+    "skimage.io"
+    "skimage.measure"
+    "skimage.morphology"
+    "skimage.transform"
+    "skimage.util"
+    "skimage.segmentation"
+  ];

  meta = {
    description = "Image processing routines for SciPy";
    homepage = "https://scikit-image.org";
    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ yl3dy ];
  };
 }
--- a/pkgs/development/tools/build-managers/bazel/bazel_4/default.nix
+++ b/pkgs/development/tools/build-managers/bazel/bazel_4/default.nix
@ -617,6 +617,8 @@ stdenv.mkDerivation rec {
      ./bazel_src/output/bazel-complete.fish
  '';

+  # Install check fails on `aarch64-darwin`
+  # https://github.com/NixOS/nixpkgs/issues/145587
  doInstallCheck = stdenv.hostPlatform.system != "aarch64-darwin";
  installCheckPhase = ''
    export TEST_TMPDIR=$(pwd)
--- a/pkgs/development/tools/misc/intel-gpu-tools/default.nix
+++ b/pkgs/development/tools/misc/intel-gpu-tools/default.nix
@ -1,37 +1,85 @@
-{ lib, stdenv, fetchurl, pkg-config, libdrm, libpciaccess, cairo, xorgproto, udev
-, libX11, libXext, libXv, libXrandr, glib, bison, libunwind, python3, kmod
-, procps, utilmacros, gtk-doc, openssl, peg, elfutils
+{ lib
+, stdenv
+, fetchurl
+, pkg-config
+, libdrm
+, libpciaccess
+, cairo
+, xorgproto
+, udev
+, libX11
+, libXext
+, libXv
+, libXrandr
+, glib
+, bison
+, libunwind
+, python3
+, kmod
+, procps
+, utilmacros
+, gtk-doc
+, docbook_xsl
+, openssl
+, peg
+, elfutils
+, meson
+, ninja
+, valgrind
+, xmlrpc_c
+, gsl
+, alsa-lib
+, curl
+, json_c
+, liboping
+, flex
+, docutils
 }:

 stdenv.mkDerivation rec {
  pname = "intel-gpu-tools";
-  version = "1.25";
+  version = "1.26";

  src = fetchurl {
    url = "https://xorg.freedesktop.org/archive/individual/app/igt-gpu-tools-${version}.tar.xz";
-    sha256 = "04fx7xclhick3k7fyk9c4mn8mxzf1253j1r0hrvj9sl40j7lsia0";
+    sha256 = "1dwvxh1yplsh1a7h3gpp40g91v12cfxy6yy99s1v9yr2kwxikm1n";
  };

-  nativeBuildInputs = [ pkg-config utilmacros ];
-  buildInputs = [ libdrm libpciaccess cairo xorgproto udev libX11 kmod
-    libXext libXv libXrandr glib bison libunwind python3 procps
-    gtk-doc openssl peg elfutils ];
+  nativeBuildInputs = [ pkg-config utilmacros meson ninja flex bison gtk-doc docutils docbook_xsl ];
+  buildInputs = [
+    libdrm
+    libpciaccess
+    cairo
+    xorgproto
+    udev
+    libX11
+    kmod
+    libXext
+    libXv
+    libXrandr
+    glib
+    libunwind
+    python3
+    procps
+    openssl
+    peg
+    elfutils
+    valgrind
+    xmlrpc_c
+    gsl
+    alsa-lib
+    curl
+    json_c
+    liboping
+  ];

  NIX_CFLAGS_COMPILE = [ "-Wno-error=array-bounds" ];

  preConfigure = ''
-    ./autogen.sh
+    patchShebangs tests man
  '';

-  preBuild = ''
-    patchShebangs tests
-
-    patchShebangs debugger/system_routine/pre_cpp.py
-    substituteInPlace tools/Makefile.am --replace '$(CAIRO_CFLAGS)' '$(CAIRO_CFLAGS) $(GLIB_CFLAGS)'
-    substituteInPlace tests/Makefile.am --replace '$(CAIRO_CFLAGS)' '$(CAIRO_CFLAGS) $(GLIB_CFLAGS)'
-  '';
-
-  enableParallelBuilding = true;
+  hardeningDisable = [ "bindnow" ];

  meta = with lib; {
    homepage = "https://01.org/linuxgraphics/";
--- a/pkgs/development/tools/omnisharp-roslyn/create-deps.sh
+++ b/pkgs/development/tools/omnisharp-roslyn/create-deps.sh
@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p msbuild -p jq -p xmlstarlet -p curl
+#!nix-shell -I nixpkgs=../../../../.. -i bash -p msbuild dotnet-sdk_3 jq xmlstarlet curl
 set -euo pipefail

 cat << EOL
@ -20,7 +20,6 @@ mapfile -t repos < <(

 msbuild -t:restore -p:Configuration=Release -p:RestorePackagesPath="$tmpdir" \
        -p:RestoreNoCache=true -p:RestoreForce=true \
-        -p:NuGetPackageVersion=5.9.1-rc.8 \
        src/OmniSharp.Stdio.Driver/OmniSharp.Stdio.Driver.csproj >&2

 cd "$tmpdir"
--- a/pkgs/development/tools/omnisharp-roslyn/default.nix
+++ b/pkgs/development/tools/omnisharp-roslyn/default.nix
@ -68,26 +68,23 @@ let
 in stdenv.mkDerivation rec {

  pname = "omnisharp-roslyn";
-  version = "1.37.12";
+  version = "1.37.15";

  src = fetchFromGitHub {
    owner = "OmniSharp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0gyy49v3pslr0l0q6h8hzah4s0iwkhkyckyrj3g2cg08w20b10gw";
+    sha256 = "070wqs667si3f78fy6w4rrfm8qncnabg0yckjhll0yv1pzbj9q42";
  };

  nativeBuildInputs = [ makeWrapper msbuild ];

-  # NuGetPackageVersion is overridden to be to be compatible with msbuild 16.10,
-  # it needs to be kept in sync with ./create-deps.sh
  buildPhase = ''
    runHook preBuild

    HOME=$(pwd)/fake-home msbuild -r \
      -p:Configuration=Release \
      -p:RestoreConfigFile=${nuget-config} \
-      -p:NuGetPackageVersion=5.9.1-rc.8 \
      src/OmniSharp.Stdio.Driver/OmniSharp.Stdio.Driver.csproj

    runHook postBuild
--- a/pkgs/development/tools/omnisharp-roslyn/deps.nix
+++ b/pkgs/development/tools/omnisharp-roslyn/deps.nix
@ -49,10 +49,10 @@
  }
  {
    name = "mcmaster.extensions.commandlineutils";
-    version = "2.2.4";
+    version = "3.1.0";
    src = fetchurl {
-      url = "https://api.nuget.org/v3-flatcontainer/mcmaster.extensions.commandlineutils/2.2.4/mcmaster.extensions.commandlineutils.2.2.4.nupkg";
-      sha256 = "0hy45iacm9zlrj6p2j2i2gkbs4k52mncnlnjvwgh6b6523p9msfy";
+      url = "https://api.nuget.org/v3-flatcontainer/mcmaster.extensions.commandlineutils/3.1.0/mcmaster.extensions.commandlineutils.3.1.0.nupkg";
+      sha256 = "075n1mfsxwz514r94l8i3ax0wp43c3xb4f9w25a96h6xxnj0k2hd";
    };
  }
  {
@ -87,6 +87,14 @@
      sha256 = "196swfxaz7l26hiyfv1mix0y80amhlq48krc4g5p9894wx1az3c3";
    };
  }
+  {
+    name = "microsoft.aspnetcore.app.ref";
+    version = "3.1.10";
+    src = fetchurl {
+      url = "https://api.nuget.org/v3-flatcontainer/microsoft.aspnetcore.app.ref/3.1.10/microsoft.aspnetcore.app.ref.3.1.10.nupkg";
+      sha256 = "0xn4zh7shvijqlr03fqsmps6gz856isd9bg9rk4z2c4599ggal77";
+    };
+  }
  {
    name = "microsoft.bcl.asyncinterfaces";
    version = "1.1.0";
@ -177,82 +185,82 @@
  }
  {
    name = "microsoft.codeanalysis.common";
-    version = "4.0.0-2.21322.50";
+    version = "4.0.0-4.21427.11";
    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.common/4.0.0-2.21322.50/microsoft.codeanalysis.common.4.0.0-2.21322.50.nupkg";
-      sha256 = "1j9yl7m0lr03fjklzjyiac1lrgs8541frqmi4xlldn8a2sx3h97x";
+      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.common/4.0.0-4.21427.11/microsoft.codeanalysis.common.4.0.0-4.21427.11.nupkg";
+      sha256 = "15q6a2z3ms2vyrfk4y7biniygy0brr3ddb8mn700zg4sl84vphcz";
    };
  }
  {
    name = "microsoft.codeanalysis.csharp";
-    version = "4.0.0-2.21322.50";
+    version = "4.0.0-4.21427.11";
    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.csharp/4.0.0-2.21322.50/microsoft.codeanalysis.csharp.4.0.0-2.21322.50.nupkg";
-      sha256 = "1mmcl4rj3n1q7zh1n9b9ph3lvm8i51sdm87q3sgiczv2pxrihzs6";
+      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.csharp/4.0.0-4.21427.11/microsoft.codeanalysis.csharp.4.0.0-4.21427.11.nupkg";
+      sha256 = "0x3l774higkpbbk4f1naf57c039g8qvvdvb3963m7g54qn4zhvdh";
    };
  }
  {
    name = "microsoft.codeanalysis.csharp.features";
-    version = "4.0.0-2.21322.50";
+    version = "4.0.0-4.21427.11";
    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.csharp.features/4.0.0-2.21322.50/microsoft.codeanalysis.csharp.features.4.0.0-2.21322.50.nupkg";
-      sha256 = "11pzbswlznz71m248c1p4fi4i3zzvpc4a71px9j2lhnm57zy2lvy";
+      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.csharp.features/4.0.0-4.21427.11/microsoft.codeanalysis.csharp.features.4.0.0-4.21427.11.nupkg";
+      sha256 = "0w0wrssv0ix4z9609a34k6a5kc4p85gy76p676fdg6hyf6pzd78m";
    };
  }
  {
    name = "microsoft.codeanalysis.csharp.scripting";
-    version = "4.0.0-2.21322.50";
+    version = "4.0.0-4.21427.11";
    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.csharp.scripting/4.0.0-2.21322.50/microsoft.codeanalysis.csharp.scripting.4.0.0-2.21322.50.nupkg";
-      sha256 = "0piiyg1l27cy6s4ii80phrdsyhl8zvwbj9aljqkg53gki520x19p";
+      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.csharp.scripting/4.0.0-4.21427.11/microsoft.codeanalysis.csharp.scripting.4.0.0-4.21427.11.nupkg";
+      sha256 = "0lmfbkxqp8p52wg2lsyxpavabk318s6ci02cxzgmxydc2pd9r70v";
    };
  }
  {
    name = "microsoft.codeanalysis.csharp.workspaces";
-    version = "4.0.0-2.21322.50";
+    version = "4.0.0-4.21427.11";
    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.csharp.workspaces/4.0.0-2.21322.50/microsoft.codeanalysis.csharp.workspaces.4.0.0-2.21322.50.nupkg";
-      sha256 = "0q6jkgjh1dylmjx8a79ighgbai1jr2fhls9m7khi87anzc3wdcl2";
+      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.csharp.workspaces/4.0.0-4.21427.11/microsoft.codeanalysis.csharp.workspaces.4.0.0-4.21427.11.nupkg";
+      sha256 = "0j5c9v4nfahvnasz895czk1cp46b2d98px1gdar2ik9c5630vxwi";
    };
  }
  {
    name = "microsoft.codeanalysis.externalaccess.omnisharp";
-    version = "4.0.0-2.21322.50";
+    version = "4.0.0-4.21427.11";
    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.externalaccess.omnisharp/4.0.0-2.21322.50/microsoft.codeanalysis.externalaccess.omnisharp.4.0.0-2.21322.50.nupkg";
-      sha256 = "1rv5qsj8lsfqxdzd6zazrzwzaxwmj6szd9hv2ckbb4lypkn8ifs8";
+      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.externalaccess.omnisharp/4.0.0-4.21427.11/microsoft.codeanalysis.externalaccess.omnisharp.4.0.0-4.21427.11.nupkg";
+      sha256 = "0qy8xiv1j8awmbbgy16b2y9rhymxhx8kcmfylhxi1ryqql4mrpg2";
    };
  }
  {
    name = "microsoft.codeanalysis.externalaccess.omnisharp.csharp";
-    version = "4.0.0-2.21322.50";
+    version = "4.0.0-4.21427.11";
    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.externalaccess.omnisharp.csharp/4.0.0-2.21322.50/microsoft.codeanalysis.externalaccess.omnisharp.csharp.4.0.0-2.21322.50.nupkg";
-      sha256 = "0ygp7hnm6mn9khh6z573avhvbcx5459fmyz4z657dx9p2v1f0fs0";
+      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.externalaccess.omnisharp.csharp/4.0.0-4.21427.11/microsoft.codeanalysis.externalaccess.omnisharp.csharp.4.0.0-4.21427.11.nupkg";
+      sha256 = "0mp1gkfdrdjcryqdj76ilpmjh0w8z4h313djjplcawwk76369mnc";
    };
  }
  {
    name = "microsoft.codeanalysis.features";
-    version = "4.0.0-2.21322.50";
+    version = "4.0.0-4.21427.11";
    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.features/4.0.0-2.21322.50/microsoft.codeanalysis.features.4.0.0-2.21322.50.nupkg";
-      sha256 = "1grkql2wcqsqlmqnfchw6wxynwpz4x9wgqd00zpc1g04z9lqimq6";
+      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.features/4.0.0-4.21427.11/microsoft.codeanalysis.features.4.0.0-4.21427.11.nupkg";
+      sha256 = "03vclmmxch3jrjamr9lg899s9wsfxw9yf53p9yfwvcr8wml4cwpz";
    };
  }
  {
    name = "microsoft.codeanalysis.scripting.common";
-    version = "4.0.0-2.21322.50";
+    version = "4.0.0-4.21427.11";
    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.scripting.common/4.0.0-2.21322.50/microsoft.codeanalysis.scripting.common.4.0.0-2.21322.50.nupkg";
-      sha256 = "1c14bg99ywxdvlp5zc08ijc030rxmpb3171kz2z6f5kr02vf296x";
+      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.scripting.common/4.0.0-4.21427.11/microsoft.codeanalysis.scripting.common.4.0.0-4.21427.11.nupkg";
+      sha256 = "15fkbw651v9lliqdmg1k61dqzasrssahyhrhwg24m111rgh86fbn";
    };
  }
  {
    name = "microsoft.codeanalysis.workspaces.common";
-    version = "4.0.0-2.21322.50";
+    version = "4.0.0-4.21427.11";
    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.workspaces.common/4.0.0-2.21322.50/microsoft.codeanalysis.workspaces.common.4.0.0-2.21322.50.nupkg";
-      sha256 = "1c0m5pg156x8zh50x7rp25p8cn09gbv50wpbz2p1nc5ff5dyavf5";
+      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.workspaces.common/4.0.0-4.21427.11/microsoft.codeanalysis.workspaces.common.4.0.0-4.21427.11.nupkg";
+      sha256 = "0k4qjkkg4mllizialzm463ssm3faqcqjnw19kbcnrzm5cd72i7cy";
    };
  }
  {
@ -544,35 +552,11 @@
    };
  }
  {
-    name = "microsoft.netcore.app";
-    version = "2.1.0";
+    name = "microsoft.netcore.app.ref";
+    version = "3.1.0";
    src = fetchurl {
-      url = "https://api.nuget.org/v3-flatcontainer/microsoft.netcore.app/2.1.0/microsoft.netcore.app.2.1.0.nupkg";
-      sha256 = "1qgw6njwz30l5cwkvgf2fbsjqkc9vy0w3939c24iabmvjnzjr6a4";
-    };
-  }
-  {
-    name = "microsoft.netcore.dotnetapphost";
-    version = "2.1.0";
-    src = fetchurl {
-      url = "https://api.nuget.org/v3-flatcontainer/microsoft.netcore.dotnetapphost/2.1.0/microsoft.netcore.dotnetapphost.2.1.0.nupkg";
-      sha256 = "10hnhkix2av0c7djp2q88pw407m8gk3im4r06x762a3cs6f2jprd";
-    };
-  }
-  {
-    name = "microsoft.netcore.dotnethostpolicy";
-    version = "2.1.0";
-    src = fetchurl {
-      url = "https://api.nuget.org/v3-flatcontainer/microsoft.netcore.dotnethostpolicy/2.1.0/microsoft.netcore.dotnethostpolicy.2.1.0.nupkg";
-      sha256 = "1xh8ij7zyfkrk20rgpwqs00mxdy2qiwr7qar2xk397zk2bh2d90n";
-    };
-  }
-  {
-    name = "microsoft.netcore.dotnethostresolver";
-    version = "2.1.0";
-    src = fetchurl {
-      url = "https://api.nuget.org/v3-flatcontainer/microsoft.netcore.dotnethostresolver/2.1.0/microsoft.netcore.dotnethostresolver.2.1.0.nupkg";
-      sha256 = "1384k3cg4sjcn3hyalcm43fhmlfj5pnywpzd9zpgc4jsr2c16x76";
+      url = "https://api.nuget.org/v3-flatcontainer/microsoft.netcore.app.ref/3.1.0/microsoft.netcore.app.ref.3.1.0.nupkg";
+      sha256 = "08svsiilx9spvjamcnjswv0dlpdrgryhr3asdz7cvnl914gjzq4y";
    };
  }
  {
@ -599,14 +583,6 @@
      sha256 = "1fk2fk2639i7nzy58m9dvpdnzql4vb8yl8vr19r2fp8lmj9w2jr0";
    };
  }
-  {
-    name = "microsoft.netcore.platforms";
-    version = "2.1.0";
-    src = fetchurl {
-      url = "https://api.nuget.org/v3-flatcontainer/microsoft.netcore.platforms/2.1.0/microsoft.netcore.platforms.2.1.0.nupkg";
-      sha256 = "0nmdnkmwyxj8cp746hs9an57zspqlmqdm55b00i7yk8a22s6akxz";
-    };
-  }
  {
    name = "microsoft.netcore.platforms";
    version = "2.1.2";
@ -639,14 +615,6 @@
      sha256 = "193xwf33fbm0ni3idxzbr5fdq3i2dlfgihsac9jj7whj0gd902nh";
    };
  }
-  {
-    name = "microsoft.netcore.targets";
-    version = "2.1.0";
-    src = fetchurl {
-      url = "https://api.nuget.org/v3-flatcontainer/microsoft.netcore.targets/2.1.0/microsoft.netcore.targets.2.1.0.nupkg";
-      sha256 = "1dav8x5551nwdqfigxf9zfsml5l9lakg86x38s9dvps81xs5d9zq";
-    };
-  }
  {
    name = "microsoft.netframework.referenceassemblies";
    version = "1.0.0";
@ -705,10 +673,10 @@
  }
  {
    name = "microsoft.visualstudio.debugger.contracts";
-    version = "17.2.0-beta.21262.1";
+    version = "17.2.0-beta.21417.1";
    src = fetchurl {
-      url = "https://api.nuget.org/v3-flatcontainer/microsoft.visualstudio.debugger.contracts/17.2.0-beta.21262.1/microsoft.visualstudio.debugger.contracts.17.2.0-beta.21262.1.nupkg";
-      sha256 = "148gb4k28fch1rhh6kr82dajl7qnvjxvkxvc8igy7zra70nvbx74";
+      url = "https://pkgs.dev.azure.com/azure-public/3ccf6661-f8ce-4e8a-bb2e-eff943ddd3c7/_packaging/78665e4c-b767-412b-9804-2b1ef7a48b8a/nuget/v3/flat2/microsoft.visualstudio.debugger.contracts/17.2.0-beta.21417.1/microsoft.visualstudio.debugger.contracts.17.2.0-beta.21417.1.nupkg";
+      sha256 = "14v8d0hp6p1jn4i6b12r6vx4cvxycpb37a0zh0amz0qkg4afr12d";
    };
  }
  {
@ -783,6 +751,14 @@
      sha256 = "0i4y782yrqqyx85pg597m20gm0v126w0j9ddk5z7xb3crx4z9f2s";
    };
  }
+  {
+    name = "microsoft.win32.systemevents";
+    version = "4.7.0";
+    src = fetchurl {
+      url = "https://api.nuget.org/v3-flatcontainer/microsoft.win32.systemevents/4.7.0/microsoft.win32.systemevents.4.7.0.nupkg";
+      sha256 = "0pjll2a62hc576hd4wgyasva0lp733yllmk54n37svz5ac7nfz0q";
+    };
+  }
  {
    name = "nerdbank.streams";
    version = "2.6.81";
@ -831,6 +807,14 @@
      sha256 = "0mcy0i7pnfpqm4pcaiyzzji4g0c8i3a5gjz28rrr28110np8304r";
    };
  }
+  {
+    name = "nuget.common";
+    version = "5.10.0";
+    src = fetchurl {
+      url = "https://api.nuget.org/v3-flatcontainer/nuget.common/5.10.0/nuget.common.5.10.0.nupkg";
+      sha256 = "0qy6blgppgvxpfcricmvva3qzddk18dza5vy851jrbqshvf9g7kx";
+    };
+  }
  {
    name = "nuget.common";
    version = "5.2.0";
@ -840,11 +824,11 @@
    };
  }
  {
-    name = "nuget.common";
-    version = "5.9.1-rc.8";
+    name = "nuget.configuration";
+    version = "5.10.0";
    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/nuget.common/5.9.1-rc.8/nuget.common.5.9.1-rc.8.nupkg";
-      sha256 = "056b1h4fvik6z2qc2s6qzz0s4acbipc50af14fbr7hd9h2fxya4c";
+      url = "https://api.nuget.org/v3-flatcontainer/nuget.configuration/5.10.0/nuget.configuration.5.10.0.nupkg";
+      sha256 = "0xb1n94lrwa6k83i9xcsq68202086p2gj74gzlbhlvb8c2pw6lbb";
    };
  }
  {
@ -856,11 +840,11 @@
    };
  }
  {
-    name = "nuget.configuration";
-    version = "5.9.1-rc.8";
+    name = "nuget.dependencyresolver.core";
+    version = "5.10.0";
    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/nuget.configuration/5.9.1-rc.8/nuget.configuration.5.9.1-rc.8.nupkg";
-      sha256 = "0x8vigf0sfp6kf1i98xcr4k84vci596x16hmajdm0zgv3p1w2kvk";
+      url = "https://api.nuget.org/v3-flatcontainer/nuget.dependencyresolver.core/5.10.0/nuget.dependencyresolver.core.5.10.0.nupkg";
+      sha256 = "0dhhclm281ihpfsjzxw34l6zlw49nwzyjiynkmsbcj9icfkp3y4r";
    };
  }
  {
@ -871,14 +855,6 @@
      sha256 = "156yjfsk9pzqviiwy69lxfqf61yyj4hn4vdgfcbqvw4d567i150r";
    };
  }
-  {
-    name = "nuget.dependencyresolver.core";
-    version = "5.9.1-rc.8";
-    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/nuget.dependencyresolver.core/5.9.1-rc.8/nuget.dependencyresolver.core.5.9.1-rc.8.nupkg";
-      sha256 = "1q9a97s1z3a6fb4p82ag2lqnzl53895prbqwlbvckdw9c3rpz3gc";
-    };
-  }
  {
    name = "nuget.frameworks";
    version = "5.0.0";
@ -887,6 +863,14 @@
      sha256 = "18ijvmj13cwjdrrm52c8fpq021531zaz4mj4b4zapxaqzzxf2qjr";
    };
  }
+  {
+    name = "nuget.frameworks";
+    version = "5.10.0";
+    src = fetchurl {
+      url = "https://api.nuget.org/v3-flatcontainer/nuget.frameworks/5.10.0/nuget.frameworks.5.10.0.nupkg";
+      sha256 = "0gb6n8rg2jpjp52icgpb3wjdfs3qllh5vbcz8hbcix3l7dncy3v2";
+    };
+  }
  {
    name = "nuget.frameworks";
    version = "5.2.0";
@ -896,11 +880,11 @@
    };
  }
  {
-    name = "nuget.frameworks";
-    version = "5.9.1-rc.8";
+    name = "nuget.librarymodel";
+    version = "5.10.0";
    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/nuget.frameworks/5.9.1-rc.8/nuget.frameworks.5.9.1-rc.8.nupkg";
-      sha256 = "1n3mp9ns79yq4dwgj7h2av3b485mzgsw0qlj8z7p47krwlzp5hiv";
+      url = "https://api.nuget.org/v3-flatcontainer/nuget.librarymodel/5.10.0/nuget.librarymodel.5.10.0.nupkg";
+      sha256 = "0b6mmq2mqfr06ypc772dmcd8bz55gkyfrgn0j3nrgkcdww4fzf9q";
    };
  }
  {
@ -912,11 +896,11 @@
    };
  }
  {
-    name = "nuget.librarymodel";
-    version = "5.9.1-rc.8";
+    name = "nuget.packaging";
+    version = "5.10.0";
    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/nuget.librarymodel/5.9.1-rc.8/nuget.librarymodel.5.9.1-rc.8.nupkg";
-      sha256 = "0sy8422c94wcg8ka85lnawq26mpixl79avk9m6y44lshrpga5v4v";
+      url = "https://api.nuget.org/v3-flatcontainer/nuget.packaging/5.10.0/nuget.packaging.5.10.0.nupkg";
+      sha256 = "11g0v061axhp0nisclq5cm2mc92d69z92giz9l40ih478c5nishw";
    };
  }
  {
@ -928,19 +912,19 @@
    };
  }
  {
-    name = "nuget.packaging";
-    version = "5.9.1-rc.8";
+    name = "nuget.packaging.core";
+    version = "5.10.0";
    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/nuget.packaging/5.9.1-rc.8/nuget.packaging.5.9.1-rc.8.nupkg";
-      sha256 = "0x9c3v741nn6m2xgidna88fa4xj5avhv6asj73hqv4pzpdprlrhv";
+      url = "https://api.nuget.org/v3-flatcontainer/nuget.packaging.core/5.10.0/nuget.packaging.core.5.10.0.nupkg";
+      sha256 = "1frxwwl583qwsj84rjgvd7il6icgxzxxps6yng75qx8ppf99dsr6";
    };
  }
  {
-    name = "nuget.packaging.core";
-    version = "5.9.1-rc.8";
+    name = "nuget.projectmodel";
+    version = "5.10.0";
    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/nuget.packaging.core/5.9.1-rc.8/nuget.packaging.core.5.9.1-rc.8.nupkg";
-      sha256 = "0vsaixmla4zh277xpn5ngbmi2f52hb26aqzr0z9l4a3mlpi4l5nx";
+      url = "https://api.nuget.org/v3-flatcontainer/nuget.projectmodel/5.10.0/nuget.projectmodel.5.10.0.nupkg";
+      sha256 = "1cqg319n986wciskrqsfawfhqp1d7a7i2qjd0qplpckyw8msng2i";
    };
  }
  {
@ -952,11 +936,11 @@
    };
  }
  {
-    name = "nuget.projectmodel";
-    version = "5.9.1-rc.8";
+    name = "nuget.protocol";
+    version = "5.10.0";
    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/nuget.projectmodel/5.9.1-rc.8/nuget.projectmodel.5.9.1-rc.8.nupkg";
-      sha256 = "1xjh7isw467nkc7dkfj3wlw69vi2cns66z152jrzjdmxmia3i3pv";
+      url = "https://api.nuget.org/v3-flatcontainer/nuget.protocol/5.10.0/nuget.protocol.5.10.0.nupkg";
+      sha256 = "0cs9qp169zx6g2w5bzrlhxv0q1i8mb8dxlb2nkiq7pkvah86rxkc";
    };
  }
  {
@ -968,11 +952,11 @@
    };
  }
  {
-    name = "nuget.protocol";
-    version = "5.9.1-rc.8";
+    name = "nuget.versioning";
+    version = "5.10.0";
    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/nuget.protocol/5.9.1-rc.8/nuget.protocol.5.9.1-rc.8.nupkg";
-      sha256 = "1rnrxzaciqhhgwd4by0dhkvfrm1h161vvmkvlcwaz2589sqq2dzq";
+      url = "https://api.nuget.org/v3-flatcontainer/nuget.versioning/5.10.0/nuget.versioning.5.10.0.nupkg";
+      sha256 = "10vvw6vjpx0c26rlxh7dnpyp4prahn25717ccd8bzkjmyzhm90cs";
    };
  }
  {
@ -983,14 +967,6 @@
      sha256 = "08ay8bhddj9yiq6h9lk814l65fpx5gh1iprkl7pcp78g57a6k45k";
    };
  }
-  {
-    name = "nuget.versioning";
-    version = "5.9.1-rc.8";
-    src = fetchurl {
-      url = "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/nuget.versioning/5.9.1-rc.8/nuget.versioning.5.9.1-rc.8.nupkg";
-      sha256 = "1vv7z122ilsk2rsvjm6j3hpifb45g8wa1mgnq1kwi9k8b2dbb6vv";
-    };
-  }
  {
    name = "omnisharp.extensions.jsonrpc";
    version = "0.19.0";
@ -1407,6 +1383,22 @@
      sha256 = "1m3bx6c2s958qligl67q7grkwfz3w53hpy7nc97mh6f7j5k168c4";
    };
  }
+  {
+    name = "system.drawing.common";
+    version = "4.7.0";
+    src = fetchurl {
+      url = "https://api.nuget.org/v3-flatcontainer/system.drawing.common/4.7.0/system.drawing.common.4.7.0.nupkg";
+      sha256 = "0yfw7cpl54mgfcylvlpvrl0c8r1b0zca6p7r3rcwkvqy23xqcyhg";
+    };
+  }
+  {
+    name = "system.formats.asn1";
+    version = "5.0.0";
+    src = fetchurl {
+      url = "https://api.nuget.org/v3-flatcontainer/system.formats.asn1/5.0.0/system.formats.asn1.5.0.0.nupkg";
+      sha256 = "1axc8z0839yvqi2cb63l73l6d9j6wd20lsbdymwddz9hvrsgfwpn";
+    };
+  }
  {
    name = "system.globalization";
    version = "4.0.11";
@ -2231,14 +2223,6 @@
      sha256 = "1nx773nsx6z5whv8kaa1wjh037id2f1cxhb69pvgv12hd2b6qs56";
    };
  }
-  {
-    name = "system.valuetuple";
-    version = "4.4.0";
-    src = fetchurl {
-      url = "https://api.nuget.org/v3-flatcontainer/system.valuetuple/4.4.0/system.valuetuple.4.4.0.nupkg";
-      sha256 = "1wydfgszs00yxga57sam66vzv9fshk2pw7gim57saplsnkfliaif";
-    };
-  }
  {
    name = "system.valuetuple";
    version = "4.5.0";
@ -2247,6 +2231,14 @@
      sha256 = "00k8ja51d0f9wrq4vv5z2jhq8hy31kac2rg0rv06prylcybzl8cy";
    };
  }
+  {
+    name = "system.windows.extensions";
+    version = "4.7.0";
+    src = fetchurl {
+      url = "https://api.nuget.org/v3-flatcontainer/system.windows.extensions/4.7.0/system.windows.extensions.4.7.0.nupkg";
+      sha256 = "11dmyx3j0jafjx5r9mkj1v4w2a4rzrdn8fgwm2d1g7fs1ayqcvy9";
+    };
+  }
  {
    name = "system.xml.readerwriter";
    version = "4.3.0";
--- a/pkgs/games/stockfish/default.nix
+++ b/pkgs/games/stockfish/default.nix
@ -11,23 +11,23 @@ let
           if stdenv.isAarch64 then "armv8" else
           "unknown";

-    nnueFile = "nn-3475407dc199.nnue";
+    nnueFile = "nn-13406b1dcbe0.nnue";
    nnue = fetchurl {
      name = nnueFile;
      url = "https://tests.stockfishchess.org/api/nn/${nnueFile}";
-      sha256 = "sha256-NHVAfcGZc+pERnZ4Y0zOAj1iDkGXcMERzIk3/maJ7Ic=";
+      sha256 = "sha256-E0BrHcvgo238XgfaUdjbOLekXX2kMHjsJadiTCuDI28=";
    };
 in

 stdenv.mkDerivation rec {
  pname = "stockfish";
-  version = "14";
+  version = "14.1";

  src = fetchFromGitHub {
    owner = "official-stockfish";
    repo = "Stockfish";
    rev = "sf_${version}";
-    sha256 = "sha256-fX0Tr1yqjmNRSxmisFRKUY1E5//qF3zAfJ8innAeyxA=";
+    sha256 = "sha256-bb62yezHKXu0J7NKavX8xhHghaUjUFYNG5U6dh/D+Co=";
  };

  # This addresses a linker issue with Darwin
@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
      '';
    maintainers = with maintainers; [ luispedro siraben ];
    platforms = ["x86_64-linux" "i686-linux" "x86_64-darwin" "aarch64-linux"];
-    license = licenses.gpl2;
+    license = licenses.gpl3Only;
  };

 }
--- a/pkgs/servers/hqplayerd/default.nix
+++ b/pkgs/servers/hqplayerd/default.nix
@ -45,11 +45,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "hqplayerd";
-  version = "4.27.0-70";
+  version = "4.27.2-72";

  src = fetchurl {
    url = "https://www.signalyst.eu/bins/${pname}/fc34/${pname}-${version}sse42.fc34.x86_64.rpm";
-    sha256 = "sha256-12EMKkMMMcQZwgvK0YjuHknv2JLqU3REcJUTPUmYZ6A=";
+    sha256 = "sha256-oCZS68n9R6Hm6lltcL6zQhPaU9FRqtB59DrstRNjnH8=";
  };

  unpackPhase = ''
--- a/pkgs/servers/http/ran/default.nix
+++ b/pkgs/servers/http/ran/default.nix
@ -42,6 +42,5 @@ buildGoModule rec {
    description = "Ran is a simple web server for serving static files";
    license = licenses.mit;
    maintainers = with maintainers; [ tomberek ];
-    platforms = platforms.unix;
  };
 }
--- a/pkgs/servers/mail/mailman/postorius.nix
+++ b/pkgs/servers/mail/mailman/postorius.nix
@ -6,11 +6,11 @@ buildPythonPackage rec {
  pname = "postorius";
  # Note: Mailman core must be on the latest version before upgrading Postorious.
  # See: https://gitlab.com/mailman/postorius/-/issues/516#note_544571309
-  version = "1.3.4";
+  version = "1.3.5";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-L2ApUGQNvR0UVvodVM+wMzjYLZkegI4fT4yUiU/cibU=";
+    sha256 = "0f23c6542bf0f6e6364d678c094ee5804acfe59ecbcc0e944bc4c13834e24e80";
  };

  propagatedBuildInputs = [ django-mailman3 readme_renderer ];
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@ -51,8 +51,8 @@ in {
  };

  nextcloud22 = generic {
-    version = "22.2.0";
-    sha256 = "07ryvynws65k42n6ca20nni1vqr90fsrd2dpx2bvh09mwhyblg97";
+    version = "22.2.1";
+    sha256 = "sha256-0BtQt7siUYGiEVGkUYmd0gjfccq4kIhCVaOTR9frvys=";
  };
  # tip: get she sha with:
  # curl 'https://download.nextcloud.com/server/releases/nextcloud-${version}.tar.bz2.sha256'
--- a/pkgs/servers/reproxy/default.nix
+++ b/pkgs/servers/reproxy/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "reproxy";
-  version = "0.8.0";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "umputun";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-zwQZr6BbvJ2Ol5pCLkZ49j0j5KWTK0N8BybvTr8PPeg=";
+    hash = "sha256-z10KfDwIwitiR6ei1xV9//zhH7DLTow1giEYyjh8FIg=";
  };

  postPatch = ''
--- a/pkgs/servers/roon-server/default.nix
+++ b/pkgs/servers/roon-server/default.nix
@ -14,7 +14,7 @@
 }:
 stdenv.mkDerivation rec {
  pname = "roon-server";
-  version = "1.8-846";
+  version = "1.8-850";

  src =
    let
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
    in
    fetchurl {
      url = "http://download.roonlabs.com/builds/RoonServer_linuxx64_${urlVersion}.tar.bz2";
-      sha256 = "sha256-BoHvODaAcK5b4/syOm3vpOTpq9ETovpWKUqG+UGr2e0=";
+      sha256 = "sha256-NSNaL0ERYTSYn9ETjWcQiuI4hY+w/lWVOz3n9lt6O+4=";
    };

  buildInputs = [
--- a/pkgs/tools/archivers/unar/default.nix
+++ b/pkgs/tools/archivers/unar/default.nix
@ -1,4 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, installShellFiles, gnustep, bzip2, zlib, icu, openssl, wavpack }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, installShellFiles
+, gnustep
+, bzip2
+, zlib
+, icu
+, openssl
+, wavpack
+, xcbuildHook
+, Foundation
+, AppKit
+}:

 stdenv.mkDerivation rec {
  pname = "unar";
@ -12,35 +25,54 @@ stdenv.mkDerivation rec {
    sha256 = "0p846q1l66k3rnd512sncp26zpv411b8ahi145sghfcsz9w8abc4";
  };

-  postPatch = ''
-    for f in Makefile.linux ../UniversalDetector/Makefile.linux ; do
-      substituteInPlace $f \
-        --replace "= gcc" "=${stdenv.cc.targetPrefix}cc" \
-        --replace "= g++" "=${stdenv.cc.targetPrefix}c++" \
-        --replace "-DGNU_RUNTIME=1" "" \
-        --replace "-fgnu-runtime" "-fobjc-nonfragile-abi"
-    done
+  postPatch =
+    if stdenv.isDarwin then ''
+      substituteInPlace "./XADMaster.xcodeproj/project.pbxproj" \
+        --replace "libstdc++.6.dylib" "libc++.1.dylib"
+    '' else ''
+      for f in Makefile.linux ../UniversalDetector/Makefile.linux ; do
+        substituteInPlace $f \
+          --replace "= gcc" "=${stdenv.cc.targetPrefix}cc" \
+          --replace "= g++" "=${stdenv.cc.targetPrefix}c++" \
+          --replace "-DGNU_RUNTIME=1" "" \
+          --replace "-fgnu-runtime" "-fobjc-nonfragile-abi"
+      done

-    # we need to build inside this directory as well, so we have to make it writeable
-    chmod +w ../UniversalDetector -R
-  '';
+      # we need to build inside this directory as well, so we have to make it writeable
+      chmod +w ../UniversalDetector -R
+    '';

-  buildInputs = [ gnustep.base bzip2 icu openssl wavpack zlib ];
+  buildInputs = [ bzip2 icu openssl wavpack zlib ] ++
+    lib.optionals stdenv.isLinux [ gnustep.base ] ++
+    lib.optionals stdenv.isDarwin [ Foundation AppKit ];

-  nativeBuildInputs = [ gnustep.make installShellFiles ];
+  nativeBuildInputs = [ installShellFiles ] ++
+    lib.optionals stdenv.isLinux [ gnustep.make ] ++
+    lib.optionals stdenv.isDarwin [ xcbuildHook ];
+
+  xcbuildFlags = lib.optionals stdenv.isDarwin [
+    "-target unar"
+    "-target lsar"
+    "-configuration Release"
+    "MACOSX_DEPLOYMENT_TARGET=10.12"
+    # Fix "ld: file not found: /nix/store/*-clang-7.1.0/lib/arc/libarclite_macosx." error
+    # Disabling ARC may leak memory, however since this program is generally not used for
+    # long periods of time, it shouldn't be an issue
+    "CLANG_LINK_OBJC_RUNTIME=NO"
+  ];
+
+  makefile = lib.optionalString (!stdenv.isDarwin) "Makefile.linux";

  enableParallelBuilding = true;

  dontConfigure = true;

-  makefile = "Makefile.linux";
-
  sourceRoot = "./source/XADMaster";

  installPhase = ''
    runHook preInstall

-    install -Dm555 -t $out/bin lsar unar
+    install -Dm555 -t $out/bin ${lib.optionalString stdenv.isDarwin "Products/Release/"}{lsar,unar}
    for f in lsar unar; do
      installManPage ./Extra/$f.?
      installShellCompletion --bash --name $f ./Extra/$f.bash_completion
@ -60,7 +92,7 @@ stdenv.mkDerivation rec {
      ADF, DMS, LZX, PowerPacker, LBR, Squeeze, Crunch, and other old formats.
    '';
    license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ peterhoeg ];
-    platforms = platforms.linux;
+    maintainers = with maintainers; [ peterhoeg thiagokokada ];
+    platforms = platforms.unix;
  };
 }
--- a/pkgs/tools/filesystems/ceph/default.nix
+++ b/pkgs/tools/filesystems/ceph/default.nix
@ -239,12 +239,14 @@ in rec {
  };

  ceph-client = runCommand "ceph-client-${version}" {
-      meta = getMeta "Tools needed to mount Ceph's RADOS Block Devices";
+      meta = getMeta "Tools needed to mount Ceph's RADOS Block Devices/Cephfs";
    } ''
-      mkdir -p $out/{bin,etc,${sitePackages},share/bash-completion/completions}
+      mkdir -p $out/{bin,sbin,etc,${sitePackages},share/bash-completion/completions}
      cp -r ${ceph}/bin/{ceph,.ceph-wrapped,rados,rbd,rbdmap} $out/bin
      cp -r ${ceph}/bin/ceph-{authtool,conf,dencoder,rbdnamer,syn} $out/bin
      cp -r ${ceph}/bin/rbd-replay* $out/bin
+      cp -r ${ceph}/sbin/mount.ceph $out/sbin
+      cp -r ${ceph}/sbin/mount.fuse.ceph $out/sbin
      cp -r ${ceph}/${sitePackages} $out/${sitePackages}
      cp -r ${ceph}/etc/bash_completion.d $out/share/bash-completion/completions
      # wrapPythonPrograms modifies .ceph-wrapped, so lets just update its paths
--- a/pkgs/tools/misc/ostree/default.nix
+++ b/pkgs/tools/misc/ostree/default.nix
@ -41,13 +41,13 @@ let
  ]));
 in stdenv.mkDerivation rec {
  pname = "ostree";
-  version = "2021.3";
+  version = "2021.4";

  outputs = [ "out" "dev" "man" "installedTests" ];

  src = fetchurl {
    url = "https://github.com/ostreedev/ostree/releases/download/v${version}/libostree-${version}.tar.xz";
-    sha256 = "sha256-D6Wjnww+WMIEATPkIpyyhmDGG5eM1KKj0vbpfvTI0LM=";
+    sha256 = "sha256-21zgGhYGrzRm7HcjZwD1OmPOIOSYSlSdDquj9mo9k2E=";
  };

  patches = [
--- a/pkgs/tools/networking/dd-agent/datadog-agent.nix
+++ b/pkgs/tools/networking/dd-agent/datadog-agent.nix
@ -10,15 +10,15 @@ let

 in buildGoModule rec {
  pname = "datadog-agent";
-  version = "7.30.2";
+  version = "7.31.0";

  src = fetchFromGitHub {
    inherit owner repo;
    rev = version;
-    sha256 = "17ahrxhb87sj7f04wg44xv4k9wrlvf04j92ac5936a6maygp01rd";
+    sha256 = "sha256-APwR3/bvCHNnJWxRPSLLe4lHYv39wfw3WhGDEkxAku8=";
  };

-  vendorSha256 = "06ryy501vibc6n14qwg94394c76l060525y6qg261qb748mbi8qi";
+  vendorSha256 = "sha256-CNQJvnNnB29duALEXPguEJsoRHdieAiPFbwXa89jxUk=";

  subPackages = [
    "cmd/agent"
--- a/pkgs/tools/security/knockknock/default.nix
+++ b/pkgs/tools/security/knockknock/default.nix
@ -1,14 +1,13 @@
 { lib, fetchFromGitHub, python2Packages, hping }:
-let
-  rev  = "bf14bbff";
-in python2Packages.buildPythonApplication rec {
-  pname = "knockknock-r";
-  version = rev;
+
+python2Packages.buildPythonApplication rec {
+  pname = "knockknock";
+  version = "unstable-2012-09-17";

  src = fetchFromGitHub {
-    inherit rev;
    owner  = "moxie0";
    repo   = "knockknock";
+    rev    = "bf14bbffc5f1d2105cd1d955dabca26b3faa0db4";
    sha256 = "1chpfs3w2vkjrgay69pbdr116z1jldv53fi768a1i05fdqhy1px4";
  };

@ -25,10 +24,10 @@ in python2Packages.buildPythonApplication rec {

  meta = with lib; {
    description = "Simple, secure port knocking daemon and client written in Python";
-    homepage    = "http://www.thoughtcrime.org/software/knockknock/";
-    license     = licenses.gpl3;
+    homepage    = "https://github.com/moxie0/knockknock";
+    license     = licenses.gpl3Plus;
    maintainers = with maintainers; [ copumpkin ];
-    platforms   = platforms.linux;
+    platforms   = platforms.unix;
  };
 }

--- a/pkgs/tools/text/poedit/default.nix
+++ b/pkgs/tools/text/poedit/default.nix
@ -30,6 +30,7 @@ stdenv.mkDerivation rec {
    "--without-cpprest"
    "--with-boost-libdir=${boost.out}/lib"
    "CPPFLAGS=-I${nlohmann_json}/include/nlohmann/"
+    "LDFLAGS=-llucene++"
  ];

  preFixup = ''
--- a/pkgs/tools/text/xml/basex/default.nix
+++ b/pkgs/tools/text/xml/basex/default.nix
@ -1,18 +1,18 @@
-{ lib, stdenv, fetchurl, unzip, jre, coreutils, makeDesktopItem }:
+{ lib, stdenv, fetchurl, unzip, jre, coreutils, makeDesktopItem, copyDesktopItems }:

 stdenv.mkDerivation rec {
  pname = "basex";
-  version = "9.4.3";
+  version = "9.6.3";

  src = fetchurl {
    url = "http://files.basex.org/releases/${version}/BaseX${builtins.replaceStrings ["."] [""] version}.zip";
-    hash = "sha256-IZhRg2JcYQXQKU/lYZpLLcsSdjZZO+toY5yvk+RKUCY=";
+    hash = "sha256-OlIAyGUQKrl+Zu79p6cahHpx59zLozGkUDAEvykGN6Y=";
  };

-  nativeBuildInputs = [ unzip ];
+  nativeBuildInputs = [ unzip copyDesktopItems ];
  buildInputs = [ jre ];

-  desktopItem = makeDesktopItem {
+  desktopItems = lib.optional (!stdenv.isDarwin) (makeDesktopItem {
    name = "basex";
    exec = "basexgui %f";
    icon = "${./basex.svg}"; # icon copied from Ubuntu basex package
@ -21,22 +21,21 @@ stdenv.mkDerivation rec {
    genericName = "XML database tool";
    categories = "Development;Utility;Database";
    mimeType = "text/xml";
-  };
+  });

  dontBuild = true;

  installPhase = ''
+    runHook preInstall
+
    # Remove Windows batch files (unclutter $out/bin)
    rm ./bin/*.bat

-    mkdir -p "$out/share/basex" "$out/share/applications"
+    mkdir -p "$out/share/basex"

    cp -R bin etc lib webapp src BaseX.jar "$out"
    cp -R readme.txt webapp "$out/share/basex"

-    # Install desktop file
-    cp "$desktopItem"/share/applications/* "$out/share/applications/"
-
    # Use substitutions instead of wrapper scripts
    for file in "$out"/bin/*; do
        sed -i -e "s|/usr/bin/env bash|${stdenv.shell}|" \
@ -47,6 +46,8 @@ stdenv.mkDerivation rec {
               -e "s|echo|${coreutils}/bin/echo|" \
            "$file"
    done
+
+    runHook postInstall
  '';

  meta = with lib; {
@ -60,7 +61,7 @@ stdenv.mkDerivation rec {
    '';
    homepage = "https://basex.org/";
    license = licenses.bsd3;
-    platforms = platforms.linux;
+    platforms = platforms.unix;
    maintainers = [ maintainers.bjornfor ];
  };
 }
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -10678,7 +10678,10 @@ with pkgs;
    inherit (chickenPackages_4) eggDerivation fetchegg;
  };

-  unar = callPackage ../tools/archivers/unar { stdenv = clangStdenv; };
+  unar = callPackage ../tools/archivers/unar {
+    inherit (darwin.apple_sdk.frameworks) Foundation AppKit;
+    stdenv = clangStdenv;
+  };

  unp = callPackage ../tools/archivers/unp { };

@ -20234,9 +20237,7 @@ with pkgs;

  lucene = callPackage ../development/libraries/java/lucene { };

-  lucenepp = callPackage ../development/libraries/lucene++ {
-    boost = boost155;
-  };
+  lucenepp = callPackage ../development/libraries/lucene++ { };

  mockobjects = callPackage ../development/libraries/java/mockobjects { };

--- a/pkgs/top-level/nim-packages.nix
+++ b/pkgs/top-level/nim-packages.nix
@ -48,22 +48,41 @@ lib.makeScope newScope (self:

    pixie = callPackage ../development/nim-packages/pixie { };

+    python = callPackage ../development/nim-packages/python { };
+
    redis = callPackage ../development/nim-packages/redis { };

    redpool = callPackage ../development/nim-packages/redpool { };

    regex = callPackage ../development/nim-packages/regex { };

+    rocksdb = callPackage ../development/nim-packages/rocksdb {
+      inherit (pkgs) rocksdb;
+    };
+
    sass = callPackage ../development/nim-packages/sass { };

    sdl2 = callPackage ../development/nim-packages/sdl2 { };

    segmentation = callPackage ../development/nim-packages/segmentation { };

+    snappy =
+      callPackage ../development/nim-packages/snappy { inherit (pkgs) snappy; };
+
+    spry = callPackage ../development/nim-packages/spry { };
+
+    spryvm = callPackage ../development/nim-packages/spryvm { };
+
+    stew = callPackage ../development/nim-packages/stew { };
+
    supersnappy = callPackage ../development/nim-packages/supersnappy { };

+    tempfile = callPackage ../development/nim-packages/tempfile { };
+
    typography = callPackage ../development/nim-packages/typography { };

+    ui = callPackage ../development/nim-packages/ui { inherit (pkgs) libui; };
+
    unicodedb = callPackage ../development/nim-packages/unicodedb { };

    unicodeplus = callPackage ../development/nim-packages/unicodeplus { };
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@ -3501,10 +3501,10 @@ let

  CompressRawBzip2 = buildPerlPackage {
    pname = "Compress-Raw-Bzip2";
-    version = "2.096";
+    version = "2.101";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Bzip2-2.096.tar.gz";
-      sha256 = "1glcjnbqksaviwyrprh9i4dybsb12kzfy0bx932l0xya9riyfr55";
+      url = "mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Bzip2-2.101.tar.gz";
+      sha256 = "1n5q01akpsw1skn59c3nivwjfqcn00wzdj8gx4q0wac8sd7i76qc";
    };

    # Don't build a private copy of bzip2.
@ -3540,11 +3540,11 @@ let

  CompressRawZlib = buildPerlPackage {
    pname = "Compress-Raw-Zlib";
-    version = "2.096";
+    version = "2.101";

    src = fetchurl {
-      url = "mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Zlib-2.096.tar.gz";
-      sha256 = "04jrqvqsa2c655idw7skv5rhb9vx9997h4n9if5p99srq4hblk6d";
+      url = "mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Zlib-2.101.tar.gz";
+      sha256 = "1cmb39dw928jssa3fzk4pxb7sw8q1zyx3yikgq01nz17x0ara6wx";
    };

    preConfigure = ''
@ -10999,10 +10999,10 @@ let

  IOCompress = buildPerlPackage {
    pname = "IO-Compress";
-    version = "2.096";
+    version = "2.102";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/P/PM/PMQS/IO-Compress-2.096.tar.gz";
-      sha256 = "9d219fd5df4b490b5d2f847921e3cb1c3392758fa0bae9b05a8992b3620ba572";
+      url = "mirror://cpan/authors/id/P/PM/PMQS/IO-Compress-2.102.tar.gz";
+      sha256 = "193jvi4800cbcac5n1swj9zgwwqck9c47g0g592ldr7fbfd7zynn";
    };
    propagatedBuildInputs = [ CompressRawBzip2 CompressRawZlib ];
    meta = {