Merge master into staging-next

2024-12-25 20:34:52 +03:00 · 2020-11-06 12:51:56 +01:00 · 2020-11-06 12:51:56 +01:00 · 99fb79ae84
commit 99fb79ae84
parent c7176d55ac da04a8e397
115 changed files with 3226 additions and 2507 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@ -206,6 +206,12 @@
 /nixos/tests/cri-o.nix                       @NixOS/podman @zowoq
 /nixos/tests/podman.nix                      @NixOS/podman @zowoq

+# Docker tools
+/pkgs/build-support/docker                   @roberth
+/nixos/tests/docker-tools-overlay.nix        @roberth
+/nixos/tests/docker-tools.nix                @roberth
+/doc/builders/images/dockertools.xml         @roberth
+
 # Blockchains
 /pkgs/applications/blockchains  @mmahut

--- a/doc/languages-frameworks/java.xml
+++ b/doc/languages-frameworks/java.xml
@ -32,7 +32,7 @@ nativeBuildInputs = [ jdk ];
 </para>

 <para>
-  If your Java package provides a program, you need to generate a wrapper script to run it using the OpenJRE. You can use <literal>makeWrapper</literal> for this:
+  If your Java package provides a program, you need to generate a wrapper script to run it using a JRE. You can use <literal>makeWrapper</literal> for this:
 <programlisting>
 nativeBuildInputs = [ makeWrapper ];

@ -43,7 +43,21 @@ installPhase =
      --add-flags "-cp $out/share/java/foo.jar org.foo.Main"
  '';
 </programlisting>
-  Note the use of <literal>jre</literal>, which is the part of the OpenJDK package that contains the Java Runtime Environment. By using <literal>${jre}/bin/java</literal> instead of <literal>${jdk}/bin/java</literal>, you prevent your package from depending on the JDK at runtime.
+Since the introduction of the Java Platform Module System in Java 9, Java distributions typically no longer ship with a general-purpose JRE: instead, they allow generating a JRE with only the modules required for your application(s). Because we can't predict what modules will be needed on a general-purpose system, the default <package>jre</package> package is the full JDK. When building a minimal system/image, you can override the <literal>modules</literal> parameter on <literal>jre_minimal</literal> to build a JRE with only the modules relevant for you:
+<programlisting>
+let
+  my_jre = pkgs.jre_minimal.override {
+    modules = [
+      # The modules used by 'something' and 'other' combined:
+      "java.base"
+      "java.logging"
+    ];
+  };
+  something = (pkgs.something.override { jre = my_jre; });
+  other = (pkgs.other.override { jre = my_jre; });
+in
+  ...
+</programlisting>
 </para>

 <para>
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@ -16,9 +16,9 @@ cargo
 into the `environment.systemPackages` or bring them into
 scope with `nix-shell -p rustc cargo`.

-For daily builds (beta and nightly) use either rustup from
-nixpkgs or use the [Rust nightlies
-overlay](#using-the-rust-nightlies-overlay).
+For other versions such as daily builds (beta and nightly),
+use either `rustup` from nixpkgs (which will manage the rust installation in your home directory),
+or use Mozilla's [Rust nightlies overlay](#using-the-rust-nightlies-overlay).

 ## Compiling Rust applications with Cargo

@ -478,8 +478,15 @@ Mozilla provides an overlay for nixpkgs to bring a nightly version of Rust into
 This overlay can _also_ be used to install recent unstable or stable versions
 of Rust, if desired.

-To use this overlay, clone
-[nixpkgs-mozilla](https://github.com/mozilla/nixpkgs-mozilla),
+### Rust overlay installation
+
+You can use this overlay by either changing your local nixpkgs configuration,
+or by adding the overlay declaratively in a nix expression,  e.g. in `configuration.nix`.
+For more information see [#sec-overlays-install](the manual on installing overlays).
+
+#### Imperative rust overlay installation
+
+Clone [nixpkgs-mozilla](https://github.com/mozilla/nixpkgs-mozilla),
 and create a symbolic link to the file
 [rust-overlay.nix](https://github.com/mozilla/nixpkgs-mozilla/blob/master/rust-overlay.nix)
 in the `~/.config/nixpkgs/overlays` directory.
@ -488,7 +495,34 @@ in the `~/.config/nixpkgs/overlays` directory.
    $ mkdir -p ~/.config/nixpkgs/overlays
    $ ln -s $(pwd)/nixpkgs-mozilla/rust-overlay.nix ~/.config/nixpkgs/overlays/rust-overlay.nix

-The latest version can be installed with the following command:
+### Declarative rust overlay installation
+
+Add the following to your `configuration.nix`, `home-configuration.nix`, `shell.nix`, or similar:
+
+```
+  nixpkgs = {
+    overlays = [
+      (import (builtins.fetchTarball https://github.com/mozilla/nixpkgs-mozilla/archive/master.tar.gz))
+      # Further overlays go here
+    ];
+  };
+```
+
+Note that this will fetch the latest overlay version when rebuilding your system.
+
+### Rust overlay usage
+
+The overlay contains attribute sets corresponding to different versions of the rust toolchain, such as:
+
+* `latest.rustChannels.stable`
+* `latest.rustChannels.nightly`
+* a function `rustChannelOf`, called as `(rustChannelOf { date = "2018-04-11"; channel = "nightly"; })`, or...
+* `(nixpkgs.rustChannelOf { rustToolchain = ./rust-toolchain; })` if you have a local `rust-toolchain` file (see https://github.com/mozilla/nixpkgs-mozilla#using-in-nix-expressions for an example)
+
+Each of these contain packages such as `rust`, which contains your usual rust development tools with the respective toolchain chosen.
+For example, you might want to add `latest.rustChannels.stable.rust` to the list of packages in your configuration.
+
+Imperatively, the latest stable version can be installed with the following command:

    $ nix-env -Ai nixos.latest.rustChannels.stable.rust

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -4007,6 +4007,12 @@
    githubId = 2502736;
    name = "James Hillyerd";
  };
+  jiehong = {
+    email = "nixos@majiehong.com";
+    github = "Jiehong";
+    githubId = 1061229;
+    name = "Jiehong Ma";
+  };
  jirkamarsik = {
    email = "jiri.marsik89@gmail.com";
    github = "jirkamarsik";
@ -4816,6 +4822,12 @@
    githubId = 20250323;
    name = "Lucio Delelis";
  };
+  ldenefle = {
+    email = "ldenefle@gmail.com";
+    github = "ldenefle";
+    githubId = 20558127;
+    name = "Lucas Denefle";
+  };
  ldesgoui = {
    email = "ldesgoui@gmail.com";
    github = "ldesgoui";
@ -6439,6 +6451,12 @@
    githubId = 167209;
    name = "Masanori Ogino";
  };
+  omgbebebe = {
+    email = "omgbebebe@gmail.com";
+    github = "omgbebebe";
+    githubId = 588167;
+    name = "Sergey Bubnov";
+  };
  omnipotententity = {
    email = "omnipotententity@gmail.com";
    github = "omnipotententity";
--- a/nixos/doc/manual/administration/service-mgmt.xml
+++ b/nixos/doc/manual/administration/service-mgmt.xml
@ -6,7 +6,7 @@
 <title>Service Management</title>
 <para>
  In NixOS, all system services are started and monitored using the systemd
-  program. Systemd is the “init” process of the system (i.e. PID 1), the
+  program. systemd is the “init” process of the system (i.e. PID 1), the
  parent of all other processes. It manages a set of so-called “units”,
  which can be things like system services (programs), but also mount points,
  swap files, devices, targets (groups of units) and more. Units can have
@ -16,10 +16,17 @@
  dependencies of this unit cause all system services to be started, file
  systems to be mounted, swap files to be activated, and so on.
 </para>
+ <section xml:id="sect-nixos-systemd-general">
+  <title>Interacting with a running systemd</title>
   <para>
    The command <command>systemctl</command> is the main way to interact with
-  <command>systemd</command>. Without any arguments, it shows the status of
-  active units:
+    <command>systemd</command>. The following paragraphs demonstrate ways to
+    interact with any OS running systemd as init system. NixOS is of no
+    exception. The <link xlink:href="#sect-nixos-systemd-nixos">next section
+    </link> explains NixOS specific things worth knowing.
+   </para>
+   <para>
+    Without any arguments, <literal>systmctl</literal> the status of active units:
 <screen>
 <prompt>$ </prompt>systemctl
 -.mount          loaded active mounted   /
@ -66,7 +73,68 @@ Jan 07 15:55:57 hagbard systemd[1]: Started PostgreSQL Server.
   starting or stopping (or has failed). Starting a unit will cause the
   dependencies of that unit to be started as well (if necessary).
  </para>
-<!-- - cgroups: each service and user session is a cgroup
+  <!-- TODO: document cgroups, draft:
+   each service and user session is a cgroup

- cgroup resource management -->
+   - cgroup resource management -->
+ </section>
+ <section xml:id="sect-nixos-systemd-nixos">
+  <title>systemd in NixOS</title>
+  <para>
+   Packages in Nixpkgs sometimes provide systemd units with them, usually in
+   e.g <literal>#pkg-out#/lib/systemd/</literal>. Putting such a package in
+   <literal>environment.systemPackages</literal> doesn't make the service
+   available to users or the system.
+  </para>
+  <para>
+   In order to enable a systemd <emphasis>system</emphasis> service with
+   provided upstream package, use (e.g):
+<programlisting>
+<xref linkend="opt-systemd.packages"/> = [ pkgs.packagekit ];
+</programlisting>
+  </para>
+  <para>
+   Usually NixOS modules written by the community do the above, plus take care of
+   other details. If a module was written for a service you are interested in,
+   you'd probably need only to use
+   <literal>services.#name#.enable = true;</literal>. These services are defined
+   in Nixpkgs'
+   <link xlink:href="https://github.com/NixOS/nixpkgs/tree/master/nixos/modules">
+   <literal>nixos/modules/</literal> directory </link>. In case the service is
+   simple enough, the above method should work, and start the service on boot.
+  </para>
+  <para>
+   <emphasis>User</emphasis> systemd services on the other hand, should be
+   treated differently. Given a package that has a systemd unit file at
+   <literal>#pkg-out#/lib/systemd/user/</literal>, using
+   <xref linkend="opt-systemd.packages"/> will make you able to start the service via
+   <literal>systemctl --user start</literal>, but it won't start automatically on login.
+   <!-- TODO: Document why systemd.packages doesn't work for user services or fix this.
+   https://github.com/NixOS/nixpkgs/blob/2cd6594a8710a801038af2b72348658f732ce84a/nixos/modules/system/boot/systemd-lib.nix#L177-L198
+
+   This has been talked over at https://discourse.nixos.org/t/how-to-enable-upstream-systemd-user-services-declaratively/7649/5
+   -->
+   However, You can imperatively enable it by adding the package's attribute to
+   <link linkend="opt-environment.systemPackages">
+   <literal>systemd.packages</literal></link> and then do this (e.g):
+<screen>
+<prompt>$ </prompt>mkdir -p ~/.config/systemd/user/default.target.wants
+<prompt>$ </prompt>ln -s /run/current-system/sw/lib/systemd/user/syncthing.service ~/.config/systemd/user/default.target.wants/
+<prompt>$ </prompt>systemctl --user daemon-reload
+<prompt>$ </prompt>systemctl --user enable syncthing.service
+</screen>
+   If you are interested in a timer file, use <literal>timers.target.wants</literal>
+   instead of <literal>default.target.wants</literal> in the 1st and 2nd command.
+  </para>
+  <para>
+   Using <literal>systemctl --user enable syncthing.service</literal> instead of
+   the above, will work, but it'll use the absolute path of
+   <literal>syncthing.service</literal> for the symlink, and this path is in
+   <literal>/nix/store/.../lib/systemd/user/</literal>. Hence
+   <link xlink:href="#sec-nix-gc">garbage collection</link> will remove that file
+   and you will wind up with a broken symlink in your systemd configuration, which
+   in turn will not make the service / timer start on login.
+  </para>
+ </section>
 </chapter>
+
--- a/nixos/modules/services/hardware/bluetooth.nix
+++ b/nixos/modules/services/hardware/bluetooth.nix
@ -87,6 +87,8 @@ in {
      bluetooth = {
        wantedBy = [ "bluetooth.target" ];
        aliases  = [ "dbus-org.bluez.service" ];
+        # restarting can leave people without a mouse/keyboard
+        unitConfig.X-RestartIfChanged = false;
      };
    };

--- a/nixos/modules/services/networking/tailscale.nix
+++ b/nixos/modules/services/networking/tailscale.nix
@ -18,30 +18,10 @@ in {

  config = mkIf cfg.enable {
    environment.systemPackages = [ pkgs.tailscale ]; # for the CLI
-    systemd.services.tailscale = {
-      description = "Tailscale client daemon";
-
-      after = [ "network-pre.target" ];
-      wants = [ "network-pre.target" ];
+    systemd.packages = [ pkgs.tailscale ];
+    systemd.services.tailscaled = {
      wantedBy = [ "multi-user.target" ];
-
-      startLimitIntervalSec = 0;
-
-      serviceConfig = {
-        ExecStart =
-          "${pkgs.tailscale}/bin/tailscaled --port ${toString cfg.port}";
-
-        RuntimeDirectory = "tailscale";
-        RuntimeDirectoryMode = 755;
-
-        StateDirectory = "tailscale";
-        StateDirectoryMode = 750;
-
-        CacheDirectory = "tailscale";
-        CacheDirectoryMode = 750;
-
-        Restart = "on-failure";
-      };
+      serviceConfig.Environment = "PORT=${toString cfg.port}";
    };
  };
 }
--- a/nixos/modules/system/boot/kernel.nix
+++ b/nixos/modules/system/boot/kernel.nix
@ -227,7 +227,7 @@ in
            "xhci_pci"
            "usbhid"
            "hid_generic" "hid_lenovo" "hid_apple" "hid_roccat"
-            "hid_logitech_hidpp" "hid_logitech_dj"
+            "hid_logitech_hidpp" "hid_logitech_dj" "hid_microsoft"

          ] ++ optionals (pkgs.stdenv.isi686 || pkgs.stdenv.isx86_64) [
            # Misc. x86 keyboard stuff.
--- a/nixos/modules/system/boot/resolved.nix
+++ b/nixos/modules/system/boot/resolved.nix
@ -136,7 +136,7 @@ in
      }
    ];

-    users.users.resolved.group = "systemd-resolve";
+    users.users.systemd-resolve.group = "systemd-resolve";

    # add resolve to nss hosts database if enabled and nscd enabled
    # system.nssModules is configured in nixos/modules/system/boot/systemd.nix
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -255,6 +255,7 @@ in
  novacomd = handleTestOn ["x86_64-linux"] ./novacomd.nix {};
  nsd = handleTest ./nsd.nix {};
  nzbget = handleTest ./nzbget.nix {};
+  oh-my-zsh = handleTest ./oh-my-zsh.nix {};
  openarena = handleTest ./openarena.nix {};
  openldap = handleTest ./openldap.nix {};
  opensmtpd = handleTest ./opensmtpd.nix {};
@ -313,6 +314,7 @@ in
  samba = handleTest ./samba.nix {};
  sanoid = handleTest ./sanoid.nix {};
  sbt = handleTest ./sbt.nix {};
+  scala = handleTest ./scala.nix {};
  sddm = handleTest ./sddm.nix {};
  service-runner = handleTest ./service-runner.nix {};
  shadowsocks = handleTest ./shadowsocks {};
--- a/nixos/tests/oh-my-zsh.nix
+++ b/nixos/tests/oh-my-zsh.nix
@ -0,0 +1,18 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "oh-my-zsh";
+
+  machine = { pkgs, ... }:
+
+    {
+      programs.zsh = {
+        enable = true;
+        ohMyZsh.enable = true;
+      };
+    };
+
+  testScript = ''
+    start_all()
+    machine.succeed("touch ~/.zshrc")
+    machine.succeed("zsh -c 'source /etc/zshrc && echo $ZSH | grep oh-my-zsh-${pkgs.oh-my-zsh.version}'")
+  '';
+})
--- a/nixos/tests/scala.nix
+++ b/nixos/tests/scala.nix
@ -0,0 +1,33 @@
+{ system ? builtins.currentSystem,
+  config ? {},
+  pkgs ? import ../.. { inherit system config; }
+}:
+
+with pkgs.lib;
+
+let
+  common = name: package: (import ./make-test-python.nix ({
+    inherit name;
+    meta = with pkgs.stdenv.lib.maintainers; {
+      maintainers = [ nequissimus ];
+    };
+
+    nodes = {
+      scala = { ... }: {
+        environment.systemPackages = [ package ];
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      scala.succeed("scalac -version 2>&1 | grep '^Scala compiler version ${package.version}'")
+    '';
+  }) { inherit system; });
+
+in with pkgs; {
+  scala_2_10  = common "scala_2_10"  scala_2_10;
+  scala_2_11  = common "scala_2_11"  scala_2_11;
+  scala_2_12  = common "scala_2_12"  scala_2_12;
+  scala_2_13  = common "scala_2_13"  scala_2_13;
+}
--- a/pkgs/applications/audio/ardour/default.nix
+++ b/pkgs/applications/audio/ardour/default.nix
@ -12,17 +12,14 @@
 , fftw
 , fftwSinglePrec
 , flac
-, fluidsynth
 , glibc
 , glibmm
 , graphviz
 , gtkmm2
-, hidapi
 , itstool
 , libarchive
 , libjack2
 , liblo
-, libltc
 , libogg
 , libpulseaudio
 , librdf_raptor
@ -42,11 +39,11 @@
 , perl
 , pkg-config
 , python3
-, qm-dsp
 , readline
 , rubberband
 , serd
 , sord
+, soundtouch
 , sratom
 , suil
 , taglib
@ -55,13 +52,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "ardour";
-  version = "6.2";
+  version = "6.3";

  # don't fetch releases from the GitHub mirror, they are broken
  src = fetchgit {
    url = "git://git.ardour.org/ardour/ardour.git";
    rev = version;
-    sha256 = "17jxbqavricy01x4ymq6d302djsqfnv84m7dm4fd8cpka0dqjp1y";
+    sha256 = "050p1adgyirr790a3xp878pq3axqwzcmrk3drgm9z6v753h0xhcd";
  };

  patches = [
@ -91,15 +88,12 @@ stdenv.mkDerivation rec {
    fftw
    fftwSinglePrec
    flac
-    fluidsynth
    glibmm
    gtkmm2
-    hidapi
    itstool
    libarchive
    libjack2
    liblo
-    libltc
    libogg
    libpulseaudio
    librdf_raptor
@ -118,11 +112,11 @@ stdenv.mkDerivation rec {
    pango
    perl
    python3
-    qm-dsp
    readline
    rubberband
    serd
    sord
+    soundtouch
    sratom
    suil
    taglib
@ -136,11 +130,11 @@ stdenv.mkDerivation rec {
    "--no-phone-home"
    "--optimize"
    "--ptformat"
-    "--qm-dsp-include=${qm-dsp}/include/qm-dsp"
    "--run-tests"
    "--test"
-    "--use-external-libs"
  ];
+  # removed because it fixes https://tracker.ardour.org/view.php?id=8161 and https://tracker.ardour.org/view.php?id=8437
+  # "--use-external-libs"

  # Ardour's wscript requires git revision and date to be available.
  # Since they are not, let's generate the file manually.
--- a/pkgs/applications/audio/pulseaudio-ctl/default.nix
+++ b/pkgs/applications/audio/pulseaudio-ctl/default.nix
@ -7,13 +7,13 @@ let

 in stdenv.mkDerivation rec {
  name = "${pname}-${version}";
-  version = "1.67";
+  version = "1.68";

  src = fetchFromGitHub {
    owner = "graysky2";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1mf5r7x6aiqmx9mz7gpckrqvvzxnr5gs2q1k4m42rjk6ldkpdb46";
+    sha256 = "0wrzfanwy18wyawpg8rfvfgjh3lwngqwmfpi4ww3530rfmi84cf0";
  };

  postPatch = ''
--- a/pkgs/applications/blockchains/polkadot/default.nix
+++ b/pkgs/applications/blockchains/polkadot/default.nix
@ -7,18 +7,16 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "polkadot";
-  version = "0.8.25";
+  version = "0.8.26";

  src = fetchFromGitHub {
    owner = "paritytech";
    repo = "polkadot";
    rev = "v${version}";
-    sha256 = "1jdklmysr25rlwgx7pz0jw66j1w60h98kqghzjhr90zhynzh39lz";
+    sha256 = "1bvma6k3gsjqh8w76k4kf52sjg8wxn1b7a409kmnmmvmd9j6z5ia";
  };

-  cargoSha256 = "08yfafrspkd1g1mhlfwngbknkxjkyymbcga8n2rdsk7mz0hm0vgy";
-
-  cargoPatches = [ ./substrate-wasm-builder-runner.patch ];
+  cargoSha256 = "0pacmmvvjgzmaxgg47qbfhqwl02jxj3i6vnmkjbj9npzqfmqf72d";

  nativeBuildInputs = [ clang ];

--- a/pkgs/applications/blockchains/polkadot/substrate-wasm-builder-runner.patch
+++ b/pkgs/applications/blockchains/polkadot/substrate-wasm-builder-runner.patch
@ -1,25 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index 5e7c4a14..bb67aada 100644
--- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -8642,8 +8642,7 @@ dependencies = [
- [[package]]
- name = "substrate-wasm-builder-runner"
- version = "1.0.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2a965994514ab35d3893e9260245f2947fd1981cdd4fffd2c6e6d1a9ce02e6a"
-+source = "git+https://github.com/paritytech/substrate#647ad15565d7c35ecf00b73b12cccad9858780b9"
- 
- [[package]]
- name = "subtle"
-diff --git a/Cargo.toml b/Cargo.toml
-index 78047a1a..2d571f8e 100644
--- a/Cargo.toml
-+++ b/Cargo.toml
-@@ -112,3 +112,6 @@ polkadot = { path = "/usr/bin/polkadot" }
- 
- [package.metadata.rpm.files]
- "../scripts/packaging/polkadot.service" = { path = "/usr/lib/systemd/system/polkadot.service", mode = "644" }
-+
-+[patch.crates-io]
-+substrate-wasm-builder-runner = { git = "https://github.com/paritytech/substrate", branch = "master" }
--- a/pkgs/applications/editors/neovim/gnvim/wrapper.nix
+++ b/pkgs/applications/editors/neovim/gnvim/wrapper.nix
@ -23,9 +23,7 @@ stdenv.mkDerivation {
    cp -r '${gnvim-unwrapped}/share/applications' "$out/share/applications"
    # Sed needs a writable directory to do inplace modifications
    chmod u+rw "$out/share/applications"
-    for file in $out/share/applications/*.desktop; do
-      sed -e "s|Exec=.\\+gnvim\\>|Exec=$out/bin/gnvim|" -i "$file"
-    done
+    sed -e "s|Exec=.\\+gnvim\\>|Exec=gnvim|" -i $out/share/applications/*.desktop
  '';

  preferLocalBuild = true;
--- a/pkgs/applications/editors/neovim/wrapper.nix
+++ b/pkgs/applications/editors/neovim/wrapper.nix
@ -43,7 +43,6 @@ let
      postBuild = lib.optionalString stdenv.isLinux ''
        rm $out/share/applications/nvim.desktop
        substitute ${neovim}/share/applications/nvim.desktop $out/share/applications/nvim.desktop \
-          --replace 'TryExec=nvim' "TryExec=$out/bin/nvim" \
          --replace 'Name=Neovim' 'Name=WrappedNeovim'
      ''
      + optionalString withPython2 ''
--- a/pkgs/applications/editors/vim/macvim.nix
+++ b/pkgs/applications/editors/vim/macvim.nix
@ -94,6 +94,19 @@ stdenv.mkDerivation {
  + ''
    unset LD
  ''
+  # When building with nix-daemon, we need to pass -derivedDataPath or else it tries to use
+  # a folder rooted in /var/empty and fails. Unfortunately we can't just pass -derivedDataPath
+  # by itself as this flag requires the use of -scheme or -xctestrun (not sure why), but MacVim
+  # by default just runs `xcodebuild -project src/MacVim/MacVim.xcodeproj`, relying on the default
+  # behavior to build the first target in the project. Experimentally, there seems to be a scheme
+  # called MacVim, so we'll explicitly select that. We also need to specify the configuration too
+  # as the scheme seems to have the wrong default.
+  + ''
+    configureFlagsArray+=(
+      XCODEFLAGS="-scheme MacVim -derivedDataPath $NIX_BUILD_TOP/derivedData"
+      --with-xcodecfg="Release"
+    )
+  ''
  ;

  # Because we're building with system clang, this means we're building against Xcode's SDK and
--- a/pkgs/applications/graphics/photoflare/default.nix
+++ b/pkgs/applications/graphics/photoflare/default.nix
@ -0,0 +1,31 @@
+{ mkDerivation, stdenv, graphicsmagick, fetchFromGitHub, qmake, qtbase, qttools
+}:
+
+mkDerivation rec {
+  pname = "photoflare";
+  version = "1.6.5";
+
+  src = fetchFromGitHub {
+    owner = "PhotoFlare";
+    repo = "photoflare";
+    rev = "v${version}";
+    sha256 = "0a394324h7ds567z3i3pw6kkii78n4qwdn129kgkkm996yh03q89";
+  };
+
+  nativeBuildInputs = [ qmake qttools ];
+  buildInputs = [ qtbase graphicsmagick ];
+
+  qmakeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  NIX_CFLAGS_COMPILE = "-I${graphicsmagick}/include/GraphicsMagick";
+
+  enableParallelBuilding = true;
+
+  meta = with stdenv.lib; {
+    description = "A cross-platform image editor with a powerful features and a very friendly graphical user interface";
+    homepage = "https://photoflare.io";
+    maintainers = [ maintainers.omgbebebe ];
+    license = licenses.gpl3;
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/applications/graphics/yed/default.nix
+++ b/pkgs/applications/graphics/yed/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchzip, makeWrapper, unzip, jre }:
+{ stdenv, fetchzip, makeWrapper, unzip, jre, wrapGAppsHook }:

 stdenv.mkDerivation rec {
  pname = "yEd";
@ -9,16 +9,25 @@ stdenv.mkDerivation rec {
    sha256 = "0sd73s700f3gqq5zq1psrqjg6ff2gv49f8vd37v6bv65vdxqxryq";
  };

-  nativeBuildInputs = [ makeWrapper unzip ];
+  nativeBuildInputs = [ makeWrapper unzip wrapGAppsHook ];
+  # For wrapGAppsHook setup hook
+  buildInputs = [ jre.gtk3 ];

-  installPhase = ''
+  dontConfigure = true;
+  dontBuild = true;
+  dontInstall = true;
+
+  preFixup = ''
    mkdir -p $out/yed
    cp -r * $out/yed
    mkdir -p $out/bin

+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
    makeWrapper ${jre}/bin/java $out/bin/yed \
+      ''${makeWrapperArgs[@]} \
      --add-flags "-jar $out/yed/yed.jar --"
  '';
+  dontWrapGApps = true;

  meta = with stdenv.lib; {
    license = licenses.unfree;
--- a/pkgs/applications/misc/charm/default.nix
+++ b/pkgs/applications/misc/charm/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "charm";
-  version = "0.8.3";
+  version = "0.8.4";

  src = fetchFromGitHub {
    owner = "charmbracelet";
    repo = "charm";
    rev = "v${version}";
-    sha256 = "1nbix7fi6g9jadak5zyx7fdz7d6367aly6fnrs0v98zsl1kxyvx3";
+    sha256 = "0wsh83kchqakvx7kgs2s31rzsvnfr47jk6pbmqzjv1kqmnlhc3rh";
  };

-  vendorSha256 = "0lhml6m0j9ksn09j7z4d9pix5aszhndpyqajycwj3apvi3ic90il";
+  vendorSha256 = "1lg4bbdzgnw50v6m6p7clibwm8m82kdr1jizgbmhfmzy15d5sfll";

  doCheck = false;

--- a/pkgs/applications/misc/kupfer/default.nix
+++ b/pkgs/applications/misc/kupfer/default.nix
@ -16,6 +16,8 @@ buildPythonApplication rec {
  pname = "kupfer";
  version = "319";

+  format = "other";
+
  src = fetchurl {
    url = "https://github.com/kupferlauncher/kupfer/releases/download/v${version}/kupfer-v${version}.tar.xz";
    sha256 = "0c9xjx13r8ckfr4az116bhxsd3pk78v04c3lz6lqhraak0rp4d92";
@ -33,13 +35,9 @@ buildPythonApplication rec {
  # see https://github.com/NixOS/nixpkgs/issues/56943 for details
  strictDeps = false;

-  postInstall = let
-    pythonPath = (stdenv.lib.concatMapStringsSep ":"
-      (m: "${m}/lib/${python.libPrefix}/site-packages")
-      propagatedBuildInputs);
-  in ''
+  postInstall = ''
    gappsWrapperArgs+=(
-      "--prefix" "PYTHONPATH" : "${pythonPath}"
+      "--prefix" "PYTHONPATH" : "${makePythonPath propagatedBuildInputs}"
      "--set" "PYTHONNOUSERSITE" "1"
    )
  '';
--- a/pkgs/applications/misc/tiv/default.nix
+++ b/pkgs/applications/misc/tiv/default.nix
@ -0,0 +1,27 @@
+{ stdenv, fetchFromGitHub, imagemagick }:
+
+stdenv.mkDerivation rec {
+  pname = "tiv";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "stefanhaustein";
+    repo = "TerminalImageViewer";
+    rev = "v${version}";
+    sha256 = "17zqbwj2imk6ygyc142mw6v4fh7h4rd5vzn5wxr9gs0g8qdc6ixn";
+  };
+
+  buildInputs = [ imagemagick ];
+
+  makeFlags = [ "prefix=$(out)" ];
+
+  preConfigure = "cd src/main/cpp";
+
+  meta = with stdenv.lib; {
+    homepage = "https://github.com/stefanhaustein/TerminalImageViewer";
+    description = "Small C++ program to display images in a (modern) terminal using RGB ANSI codes and unicode block graphics characters";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ magnetophon ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/networking/Sylk/default.nix
+++ b/pkgs/applications/networking/Sylk/default.nix
@ -2,7 +2,7 @@

 let
  pname = "Sylk";
-  version = "2.9.1";
+  version = "2.9.2";
 in

 appimageTools.wrapType2 rec {
@ -10,7 +10,7 @@ appimageTools.wrapType2 rec {

  src = fetchurl {
    url = "http://download.ag-projects.com/Sylk/Sylk-${version}-x86_64.AppImage";
-    hash = "sha256-Y1FR1tYZTxhMFn6NL578otitmOsngMJBPK/9cpCqE/Q=";
+    hash = "sha256-pfzTeKxY2fs98mgvhzaI/uBbYYkxfnQ+6jQ+gTSeEkA=";
  };

  profile = ''
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/browser.nix
@ -13,7 +13,7 @@ mkChromiumDerivation (base: rec {

  installPhase = ''
    mkdir -p "$libExecPath"
-    cp -v "$buildPath/"*.pak "$buildPath/"*.bin "$libExecPath/"
+    cp -v "$buildPath/"*.so "$buildPath/"*.pak "$buildPath/"*.bin "$libExecPath/"
    cp -v "$buildPath/icudtl.dat" "$libExecPath/"
    cp -vLR "$buildPath/locales" "$buildPath/resources" "$libExecPath/"
    cp -v "$buildPath/chrome" "$libExecPath/$packageName"
@ -78,17 +78,10 @@ mkChromiumDerivation (base: rec {
    '';
    homepage = "https://github.com/Eloston/ungoogled-chromium";
    maintainers = with maintainers; [ squalus ];
-    # Overview of the maintainer roles:
-    # nixos-unstable:
-    # - TODO: Need a new maintainer for x86_64 [0]
-    # - @thefloweringash: aarch64
-    # - @primeos: Provisional maintainer (x86_64)
-    # Stable channel:
-    # - TODO (need someone to test backports [0])
-    # [0]: https://github.com/NixOS/nixpkgs/issues/78450
    license = if enableWideVine then licenses.unfree else licenses.bsd3;
    platforms = platforms.linux;
    hydraPlatforms = if channel == "stable" then ["aarch64-linux" "x86_64-linux"] else [];
-    timeout = 172800; # 48 hours
+    timeout = 172800; # 48 hours (increased from the Hydra default of 10h)
+    broken = channel == "dev"; # Blocked on https://bugs.chromium.org/p/chromium/issues/detail?id=1141896
  };
 })
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/common.nix
@ -5,7 +5,7 @@
 , libevent, expat, libjpeg, snappy
 , libpng, libcap
 , xdg_utils, yasm, nasm, minizip, libwebp
-, libusb1, pciutils, nss, re2, zlib
+, libusb1, pciutils, nss, re2

 , python2Packages, perl, pkgconfig
 , nspr, systemd, kerberos
@ -13,10 +13,9 @@
 , bison, gperf
 , glib, gtk3, dbus-glib
 , glibc
-, xorg
 , libXScrnSaver, libXcursor, libXtst, libGLU, libGL
 , protobuf, speechd, libXdamage, cups
-, ffmpeg_3, libxslt, libxml2, at-spi2-core
+, ffmpeg, libxslt, libxml2, at-spi2-core
 , jre8
 , pipewire_0_2

@ -49,8 +48,6 @@ buildFun:

 with stdenv.lib;

-# see http://www.linuxfromscratch.org/blfs/view/cvs/xsoft/chromium.html
-
 let
  jre = jre8; # TODO: remove override https://github.com/NixOS/nixpkgs/pull/89731

@ -66,7 +63,7 @@ let
  mkGnFlags =
    let
      # Serialize Nix types into GN types according to this document:
-      # https://chromium.googlesource.com/chromium/src/+/master/tools/gn/docs/language.md
+      # https://source.chromium.org/gn/gn/+/master:docs/language.md
      mkGnString = value: "\"${escape ["\"" "$" "\\"] value}\"";
      sanitize = value:
        if value == true then "true"
@ -78,14 +75,17 @@ let
      toFlag = key: value: "${key}=${sanitize value}";
    in attrs: concatStringsSep " " (attrValues (mapAttrs toFlag attrs));

+  # https://source.chromium.org/chromium/chromium/src/+/master:build/linux/unbundle/replace_gn_files.py
  gnSystemLibraries = [
-    "flac" "libwebp" "libxslt" "opus" "snappy" "libpng"
-    # "zlib" # version 77 reports unresolved dependency on //third_party/zlib:zlib_config
-    # "libjpeg" # fails with multiple undefined references to chromium_jpeg_*
-    # "re2" # fails with linker errors
-    # "ffmpeg" # https://crbug.com/731766
-    # "harfbuzz-ng" # in versions over 63 harfbuzz and freetype are being built together
-                    # so we can't build with one from system and other from source
+    "ffmpeg"
+    "flac"
+    "libjpeg"
+    "libpng"
+    "libwebp"
+    "libxslt"
+    "opus"
+    "snappy"
+    "zlib"
  ];

  opusWithCustomModes = libopus.override {
@ -97,11 +97,9 @@ let
    libevent expat libjpeg snappy
    libpng libcap
    xdg_utils minizip libwebp
-    libusb1 re2 zlib
-    ffmpeg_3 libxslt libxml2
+    libusb1 re2
+    ffmpeg libxslt libxml2
    nasm
-    # harfbuzz # in versions over 63 harfbuzz and freetype are being built together
-               # so we can't build with one from system and other from source
  ];

  # build paths and release info
@ -135,10 +133,10 @@ let
    };

    nativeBuildInputs = [
+      llvmPackages.lldClang.bintools
      ninja which python2Packages.python perl pkgconfig
      python2Packages.ply python2Packages.jinja2 nodejs
      gnutar python2Packages.setuptools
-      (xorg.xcbproto.override { python = python2Packages.python; })
    ];

    buildInputs = defaultDependencies ++ [
@ -157,34 +155,35 @@ let
      ++ optional pulseSupport libpulseaudio
      ++ optionals useOzone [ libdrm wayland mesa_drivers libxkbcommon ];

-    patches = optionals (versionRange "68" "86") [
-      ./patches/nix_plugin_paths_68.patch
-    ] ++ [
-      ./patches/remove-webp-include-69.patch
-      ./patches/no-build-timestamps.patch
-      ./patches/widevine-79.patch
-      ./patches/dont-use-ANGLE-by-default.patch
-      # Unfortunately, chromium regularly breaks on major updates and
-      # then needs various patches backported in order to be compiled with GCC.
-      # Good sources for such patches and other hints:
-      # - https://gitweb.gentoo.org/repo/gentoo.git/plain/www-client/chromium/
-      # - https://git.archlinux.org/svntogit/packages.git/tree/trunk?h=packages/chromium
-      # - https://github.com/chromium/chromium/search?q=GCC&s=committer-date&type=Commits
-      #
-      # ++ optionals (channel == "dev") [ ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" ) ]
+    patches = [
+      ./patches/no-build-timestamps.patch # Optional patch to use SOURCE_DATE_EPOCH in compute_build_timestamp.py (should be upstreamed)
+      ./patches/widevine-79.patch # For bundling Widevine (DRM), might be replaceable via bundle_widevine_cdm=true in gnFlags
      # ++ optional (versionRange "68" "72") ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" )
-    ] ++ optionals (useVaapi && versionRange "68" "86") [ # Improvements for the VA-API build:
-      ./patches/enable-vdpau-support-for-nvidia.patch # https://aur.archlinux.org/cgit/aur.git/tree/vdpau-support.patch?h=chromium-vaapi
-      ./patches/enable-video-acceleration-on-linux.patch # Can be controlled at runtime (i.e. without rebuilding Chromium)
+    ] ++ optionals (useVaapi && versionRange "86" "87") [
+      # Check for enable-accelerated-video-decode on Linux:
+      (githubPatch "54deb9811ca9bd2327def5c05ba6987b8c7a0897" "11jvxjlkzz1hm0pvfyr88j7z3zbwzplyl5idkx92l2lzv4459c8d")
    ];

-    postPatch = optionalString (!versionRange "0" "86") ''
+    postPatch = ''
+      # remove unused third-party
+      for lib in ${toString gnSystemLibraries}; do
+        if [ -d "third_party/$lib" ]; then
+          find "third_party/$lib" -type f \
+            \! -path "third_party/$lib/chromium/*" \
+            \! -path "third_party/$lib/google/*" \
+            \! -path "third_party/harfbuzz-ng/utils/hb_scoped.h" \
+            \! -regex '.*\.\(gn\|gni\|isolate\)' \
+            -delete
+        fi
+      done
+
      # Required for patchShebangs (unsupported interpreter directive, basename: invalid option -- '*', etc.):
-      substituteInPlace native_client/SConstruct \
-        --replace "#! -*- python -*-" ""
+      substituteInPlace native_client/SConstruct --replace "#! -*- python -*-" ""
+      if [ -e third_party/harfbuzz-ng/src/src/update-unicode-tables.make ]; then
        substituteInPlace third_party/harfbuzz-ng/src/src/update-unicode-tables.make \
          --replace "/usr/bin/env -S make -f" "/usr/bin/make -f"
-    '' + ''
+      fi
+
      # We want to be able to specify where the sandbox is via CHROME_DEVEL_SANDBOX
      substituteInPlace sandbox/linux/suid/client/setuid_sandbox_host.cc \
        --replace \
@ -202,11 +201,6 @@ let
          '/usr/share/locale/' \
          '${glibc}/share/locale/'

-      substituteInPlace ui/gfx/x/BUILD.gn \
-        --replace \
-          '/usr/share/xcb' \
-          '${xorg.xcbproto}/share/xcb/'
-
      sed -i -e 's@"\(#!\)\?.*xdg-@"\1${xdg_utils}/bin/xdg-@' \
        chrome/browser/shell_integration_linux.cc

@ -216,42 +210,20 @@ let
      sed -i -e '/libpci_loader.*Load/s!"\(libpci\.so\)!"${pciutils}/lib/\1!' \
        gpu/config/gpu_info_collector_linux.cc

-      sed -i -re 's/([^:])\<(isnan *\()/\1std::\2/g' \
-        chrome/browser/ui/webui/engagement/site_engagement_ui.cc
-
-      sed -i -e '/#include/ {
-        i #include <algorithm>
-        :l; n; bl
-      }' gpu/config/gpu_control_list.cc
-
      # Allow to put extensions into the system-path.
      sed -i -e 's,/usr,/run/current-system/sw,' chrome/common/chrome_paths.cc

      patchShebangs .
      # use our own nodejs
      mkdir -p third_party/node/linux/node-linux-x64/bin
-      ln -s $(which node) third_party/node/linux/node-linux-x64/bin/node
+      ln -s "$(command -v node)" third_party/node/linux/node-linux-x64/bin/node
+
+      # Allow building against system libraries in official builds
+      sed -i 's/OFFICIAL_BUILD/GOOGLE_CHROME_BUILD/' tools/generate_shim_headers/generate_shim_headers.py

-      # remove unused third-party
-      # in third_party/crashpad third_party/zlib contains just a header-adapter
-      for lib in ${toString gnSystemLibraries}; do
-        find -type f -path "*third_party/$lib/*"     \
-            \! -path "*third_party/crashpad/crashpad/third_party/zlib/*"  \
-            \! -path "*third_party/$lib/chromium/*"  \
-            \! -path "*third_party/$lib/google/*"    \
-            \! -path "*base/third_party/icu/*"       \
-            \! -path "*base/third_party/libevent/*"  \
-            \! -regex '.*\.\(gn\|gni\|isolate\|py\)' \
-            -delete
-      done
    '' + optionalString stdenv.isAarch64 ''
      substituteInPlace build/toolchain/linux/BUILD.gn \
        --replace 'toolprefix = "aarch64-linux-gnu-"' 'toolprefix = ""'
-    '' + optionalString stdenv.cc.isClang ''
-      mkdir -p third_party/llvm-build/Release+Asserts/bin
-      ln -s ${stdenv.cc}/bin/clang              third_party/llvm-build/Release+Asserts/bin/clang
-      ln -s ${stdenv.cc}/bin/clang++            third_party/llvm-build/Release+Asserts/bin/clang++
-      ln -s ${llvmPackages.llvm}/bin/llvm-ar    third_party/llvm-build/Release+Asserts/bin/llvm-ar
    '' + optionalString ungoogled ''
      ${ungoogler}/utils/prune_binaries.py . ${ungoogler}/pruning.list || echo "some errors"
      ${ungoogler}/utils/patches.py . ${ungoogler}/patches
@ -259,9 +231,9 @@ let
    '';

    gnFlags = mkGnFlags ({
-      use_lld = false;
-      use_gold = true;
-      gold_path = "${stdenv.cc}/bin";
+      custom_toolchain = "//build/toolchain/linux/unbundle:default";
+      host_toolchain = "//build/toolchain/linux/unbundle:default";
+      is_official_build = true;
      is_debug = false;

      proprietary_codecs = false;
@ -283,6 +255,7 @@ let
      is_clang = stdenv.cc.isClang;
      clang_use_chrome_plugins = false;
      blink_symbol_level = 0;
+      symbol_level = 0;
      fieldtrial_testing_like_official_build = true;

      # Google API keys, see:
@ -336,8 +309,7 @@ let

      # This is to ensure expansion of $out.
      libExecPath="${libExecPath}"
-      python build/linux/unbundle/replace_gn_files.py \
-        --system-libraries ${toString gnSystemLibraries}
+      python build/linux/unbundle/replace_gn_files.py --system-libraries ${toString gnSystemLibraries}
      ${gnChromium}/bin/gn gen --args=${escapeShellArg gnFlags} out/Release | tee gn-gen-outputs.txt

      # Fail if `gn gen` contains a WARNING.
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/default.nix
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/default.nix
@ -1,5 +1,5 @@
 { newScope, config, stdenv, fetchurl, makeWrapper
-, llvmPackages_10, llvmPackages_11, ed, gnugrep, coreutils, xdg_utils
+, llvmPackages_11, ed, gnugrep, coreutils, xdg_utils
 , glib, gtk3, gnome3, gsettings-desktop-schemas, gn, fetchgit
 , libva ? null
 , pipewire_0_2
@ -14,8 +14,7 @@
 , proprietaryCodecs ? true
 , enablePepperFlash ? false
 , enableWideVine ? false
-, useVaapi ? false # Deprecated, use enableVaapi instead!
-, enableVaapi ? false # Disabled by default due to unofficial support and issues on radeon
+, enableVaapi ? false # Disabled by default due to unofficial support
 , ungoogled ? true
 , useOzone ? false
 , cupsSupport ? true
@ -24,7 +23,7 @@
 }:

 let
-  llvmPackages = llvmPackages_10;
+  llvmPackages = llvmPackages_11;
  stdenv = llvmPackages.stdenv;

  callPackage = newScope chromium;
@ -39,16 +38,6 @@ let
              cupsSupport pulseSupport useOzone;
      inherit ungoogled;
      # TODO: Remove after we can update gn for the stable channel (backward incompatible changes):
-      gnChromium = gn.overrideAttrs (oldAttrs: {
-        version = "2020-05-19";
-        src = fetchgit {
-          url = "https://gn.googlesource.com/gn";
-          rev = "d0a6f072070988e7b038496c4e7d6c562b649732";
-          sha256 = "0197msabskgfbxvhzq73gc3wlr3n9cr4bzrhy5z5irbvy05lxk17";
-        };
-      });
-    } // lib.optionalAttrs (lib.versionAtLeast upstream-info.version "86") {
-      llvmPackages = llvmPackages_11;
      gnChromium = gn.overrideAttrs (oldAttrs: {
        version = "2020-07-20";
        src = fetchgit {
@ -58,8 +47,8 @@ let
        };
      });
    } // lib.optionalAttrs (lib.versionAtLeast upstream-info.version "87") {
-      llvmPackages = llvmPackages_11;
      useOzone = true; # YAY: https://chromium-review.googlesource.com/c/chromium/src/+/2382834 \o/
+      useVaapi = !stdenv.isAarch64; # TODO: Might be best to not set use_vaapi anymore (default is fine)
      gnChromium = gn.overrideAttrs (oldAttrs: {
        version = "2020-08-17";
        src = fetchgit {
@ -162,13 +151,6 @@ let
      ''
    else browser;

-  optionalVaapiFlags = if useVaapi # TODO: Remove after 20.09:
-    then throw ''
-      Chromium's useVaapi was replaced by enableVaapi and you don't need to pass
-      "--ignore-gpu-blacklist" anymore (also no rebuilds are required anymore).
-    '' else lib.optionalString
-      (!enableVaapi)
-      "--add-flags --disable-accelerated-video-decode --add-flags --disable-accelerated-video-encode";
 in stdenv.mkDerivation {
  name = "ungoogled-chromium${suffix}-${version}";
  inherit version;
@ -195,7 +177,7 @@ in stdenv.mkDerivation {

    eval makeWrapper "${browserBinary}" "$out/bin/chromium" \
      --add-flags ${escapeShellArg (escapeShellArg commandLineArgs)} \
-      ${optionalVaapiFlags} \
+      ${lib.optionalString enableVaapi "--add-flags --enable-accelerated-video-decode"} \
      ${concatMapStringsSep " " getWrapperFlags chromium.plugins.enabled}

    ed -v -s "$out/bin/chromium" << EOF
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/patches/dont-use-ANGLE-by-default.patch
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/dont-use-ANGLE-by-default.patch
@ -1,26 +0,0 @@
-A field trial currently enables the passthrough command decoder, which causes
-gl_factory.cc to try kGLImplementationEGLANGLE first, which causes Chromium to fail
-to load libGLESv2.so on NixOS.  It somehow does not try kGLImplementationDesktopGL,
-and so there is no GL support at all.
-
-Revert to using the validating command decoder, which prevents gl_factory.cc
-from touching allowed_impls, allowing it to successfully use kGLImplementationDesktopGL.
-
-diff --git a/ui/gl/gl_utils.cc b/ui/gl/gl_utils.cc
-index 697cbed5fe2d..8419bdb21a2f 100644
--- a/ui/gl/gl_utils.cc
-+++ b/ui/gl/gl_utils.cc
-@@ -71,9 +71,10 @@ bool UsePassthroughCommandDecoder(const base::CommandLine* command_line) {
-   } else if (switch_value == kCmdDecoderValidatingName) {
-     return false;
-   } else {
-    // Unrecognized or missing switch, use the default.
-    return base::FeatureList::IsEnabled(
-        features::kDefaultPassthroughCommandDecoder);
-+    // Ignore the field trial that enables it; disable it until
-+    // gl_factory.cc kGLImplementationEGLANGLE issues are sorted
-+    // out on NixOS.
-+    return false;
-   }
- }
- }
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/patches/enable-vdpau-support-for-nvidia.patch
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/enable-vdpau-support-for-nvidia.patch
@ -1,65 +0,0 @@
--- a/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
-+++ b/media/gpu/vaapi/vaapi_video_decode_accelerator.cc
-@@ -641,6 +641,7 @@ void VaapiVideoDecodeAccelerator::AssignPictureBuffers(
-   // |vpp_vaapi_wrapper_| for VaapiPicture to DownloadFromSurface() the VA's
-   // internal decoded frame.
-   if (buffer_allocation_mode_ != BufferAllocationMode::kNone &&
-+      buffer_allocation_mode_ != BufferAllocationMode::kWrapVdpau &&
-       !vpp_vaapi_wrapper_) {
-     vpp_vaapi_wrapper_ = VaapiWrapper::Create(
-         VaapiWrapper::kVideoProcess, VAProfileNone,
-@@ -665,7 +666,8 @@ void VaapiVideoDecodeAccelerator::AssignPictureBuffers(
-     PictureBuffer buffer = buffers[i];
-     buffer.set_size(requested_pic_size_);
-     std::unique_ptr<VaapiPicture> picture = vaapi_picture_factory_->Create(
-        (buffer_allocation_mode_ == BufferAllocationMode::kNone)
-+        ((buffer_allocation_mode_ == BufferAllocationMode::kNone) ||
-+         (buffer_allocation_mode_ == BufferAllocationMode::kWrapVdpau))
-             ? vaapi_wrapper_
-             : vpp_vaapi_wrapper_,
-         make_context_current_cb_, bind_image_cb_, buffer);
-@@ -1093,6 +1095,12 @@ VaapiVideoDecodeAccelerator::GetSupportedProfiles() {
-
- VaapiVideoDecodeAccelerator::BufferAllocationMode
- VaapiVideoDecodeAccelerator::DecideBufferAllocationMode() {
-+  // NVIDIA blobs use VDPAU
-+  if (VaapiWrapper::GetImplementationType() == VAImplementation::kNVIDIAVDPAU) {
-+    LOG(INFO) << "VA-API driver on VDPAU backend";
-+    return BufferAllocationMode::kWrapVdpau;
-+  }
-+
-   // TODO(crbug.com/912295): Enable a better BufferAllocationMode for IMPORT
-   // |output_mode_| as well.
-   if (output_mode_ == VideoDecodeAccelerator::Config::OutputMode::IMPORT)
--- a/media/gpu/vaapi/vaapi_video_decode_accelerator.h
-+++ b/media/gpu/vaapi/vaapi_video_decode_accelerator.h
-@@ -204,6 +204,7 @@ class MEDIA_GPU_EXPORT VaapiVideoDecodeAccelerator
-     // Using |client_|s provided PictureBuffers and as many internally
-     // allocated.
-     kNormal,
-+    kWrapVdpau,
-   };
-
-   // Decides the concrete buffer allocation mode, depending on the hardware
--- a/media/gpu/vaapi/vaapi_wrapper.cc
-+++ b/media/gpu/vaapi/vaapi_wrapper.cc
-@@ -131,6 +131,9 @@ media::VAImplementation VendorStringToImplementationType(
-   } else if (base::StartsWith(va_vendor_string, "Intel iHD driver",
-                               base::CompareCase::SENSITIVE)) {
-     return media::VAImplementation::kIntelIHD;
-+  } else if (base::StartsWith(va_vendor_string, "Splitted-Desktop Systems VDPAU",
-+                              base::CompareCase::SENSITIVE)) {
-+    return media::VAImplementation::kNVIDIAVDPAU;
-   }
-   return media::VAImplementation::kOther;
- }
--- a/media/gpu/vaapi/vaapi_wrapper.h
-+++ b/media/gpu/vaapi/vaapi_wrapper.h
-@@ -79,6 +79,7 @@ enum class VAImplementation {
-   kIntelIHD,
-   kOther,
-   kInvalid,
-+  kNVIDIAVDPAU,
- };
-
- // This class handles VA-API calls and ensures proper locking of VA-API calls
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/patches/enable-video-acceleration-on-linux.patch
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/enable-video-acceleration-on-linux.patch
@ -1,48 +0,0 @@
-From b2144fd28e09cd52e7a88a62a9d9b54cf9922f9f Mon Sep 17 00:00:00 2001
-From: Michael Weiss <dev.primeos@gmail.com>
-Date: Tue, 14 Apr 2020 14:16:10 +0200
-Subject: [PATCH] Enable accelerated video decode on Linux
-
-This will enable accelerated video decode on Linux by default (i.e.
-without "--ignore-gpu-blacklist"), but on NixOS we'll provide
-"--disable-accelerated-video-decode" and
-"--disable-accelerated-video-encode" by default to avoid regressions
-(e.g. VA-API doesn't work properly for some radeon drivers).
-
-Video acceleration can then be enabled via:
-chromium.override { enableVaapi = true; }
-without rebuilding Chromium.
---
- gpu/config/software_rendering_list.json | 16 ----------------
- 1 file changed, 16 deletions(-)
-
-diff --git a/gpu/config/software_rendering_list.json b/gpu/config/software_rendering_list.json
-index 22712bdbf38f..a06dd19a50e4 100644
--- a/gpu/config/software_rendering_list.json
-+++ b/gpu/config/software_rendering_list.json
-@@ -336,22 +336,6 @@
-       ]
-     },
-     {
-      "id": 48,
-      "description": "Accelerated video decode is unavailable on Linux",
-      "cr_bugs": [137247, 1032907],
-      "os": {
-        "type": "linux"
-      },
-      "exceptions": [
-        {
-          "machine_model_name": ["Chromecast"]
-        }
-      ],
-      "features": [
-        "accelerated_video_decode"
-      ]
-    },
-    {
-       "id": 50,
-       "description": "Disable VMware software renderer on older Mesa",
-       "cr_bugs": [145531, 332596, 571899, 629434],
-- 
-2.11.0
-
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/patches/nix_plugin_paths_68.patch
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/nix_plugin_paths_68.patch
@ -1,61 +0,0 @@
-diff --git a/chrome/common/chrome_paths.cc b/chrome/common/chrome_paths.cc
-index f4e119d..d9775bd 100644
--- a/chrome/common/chrome_paths.cc
-+++ b/chrome/common/chrome_paths.cc
-@@ -68,21 +68,14 @@ static base::LazyInstance<base::FilePath>
-     g_invalid_specified_user_data_dir = LAZY_INSTANCE_INITIALIZER;
- 
- // Gets the path for internal plugins.
-bool GetInternalPluginsDirectory(base::FilePath* result) {
-#if defined(OS_MACOSX)
-  // If called from Chrome, get internal plugins from a subdirectory of the
-  // framework.
-  if (base::mac::AmIBundled()) {
-    *result = chrome::GetFrameworkBundlePath();
-    DCHECK(!result->empty());
-    *result = result->Append("Internet Plug-Ins");
-    return true;
-  }
-  // In tests, just look in the module directory (below).
-#endif
-
-  // The rest of the world expects plugins in the module directory.
-  return base::PathService::Get(base::DIR_MODULE, result);
-+bool GetInternalPluginsDirectory(base::FilePath* result,
-+                                 const std::string& ident) {
-+  std::string full_env = std::string("NIX_CHROMIUM_PLUGIN_PATH_") + ident;
-+  const char* value = getenv(full_env.c_str());
-+  if (value == NULL)
-+      return base::PathService::Get(base::DIR_MODULE, result);
-+  else
-+      *result = base::FilePath(value);
- }
- 
- // Gets the path for bundled implementations of components. Note that these
-@@ -272,7 +265,7 @@ bool PathProvider(int key, base::FilePath* result) {
-       create_dir = true;
-       break;
-     case chrome::DIR_INTERNAL_PLUGINS:
-      if (!GetInternalPluginsDirectory(&cur))
-+      if (!GetInternalPluginsDirectory(&cur, "ALL"))
-         return false;
-       break;
-     case chrome::DIR_COMPONENTS:
-@@ -280,7 +273,7 @@ bool PathProvider(int key, base::FilePath* result) {
-         return false;
-       break;
-     case chrome::DIR_PEPPER_FLASH_PLUGIN:
-      if (!GetInternalPluginsDirectory(&cur))
-+      if (!GetInternalPluginsDirectory(&cur, "PEPPERFLASH"))
-         return false;
-       cur = cur.Append(kPepperFlashBaseDirectory);
-       break;
-@@ -358,7 +351,7 @@ bool PathProvider(int key, base::FilePath* result) {
-         cur = cur.DirName();
-       }
- #else
-      if (!GetInternalPluginsDirectory(&cur))
-+      if (!GetInternalPluginsDirectory(&cur, "PNACL"))
-         return false;
- #endif
-       cur = cur.Append(FILE_PATH_LITERAL("pnacl"));
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/patches/remove-webp-include-69.patch
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/patches/remove-webp-include-69.patch
@ -1,11 +0,0 @@
--- a/third_party/blink/renderer/platform/image-encoders/image_encoder.cc
-+++ b/third_party/blink/renderer/platform/image-encoders/image_encoder.cc
-@@ -13,7 +13,7 @@
-
- #include "jpeglib.h"  // for JPEG_MAX_DIMENSION
-
-#include "third_party/libwebp/src/webp/encode.h"  // for WEBP_MAX_DIMENSION
-+#define WEBP_MAX_DIMENSION 16383
-
- namespace blink {
-
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled-src.nix
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/ungoogled-src.nix
@ -1,6 +1,6 @@
 {
-  "85.0.4183.102" = {
-    rev = "85.0.4183.102-1";
-    sha256 = "1mdx4a5zcs3an9yx1jxx4amq8p9rcj0hv76r8y7nz6cpsfgd9n3y";
+  "86.0.4240.111" = {
+    rev = "86.0.4240.111-1";
+    sha256 = "0fkk0lxbvik8q8d5njxmwiam64qz5g74hlb56w24nh5mh1jm59a8";
  };
 }
--- a/pkgs/applications/networking/browsers/ungoogled-chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/ungoogled-chromium/upstream-info.json
@ -1,17 +1,17 @@
 {
  "stable": {
-    "version": "85.0.4183.102",
-    "sha256": "032yh1mfwins7a62zw8kwwq8xw1n52a0a93lqz7qlyjaf9sd8s4a",
-    "sha256bin64": "1i8xaxxnmg80vsia8hxnq58qi9k5nnbrl80d6d23g9lb7dbc9cpm"
+    "version": "86.0.4240.111",
+    "sha256": "05y7lwr89awkhvgmwkx3br9j4ap2aypg2wsc0nz8mi7kxc1dnyzj",
+    "sha256bin64": "10aqiiydw4i3jxnw8xxdgkgcqbfqc67n1fbrg40y54kg0v5dz8l6"
  },
  "beta": {
-    "version": "86.0.4240.30",
-    "sha256": "1isj0zngb72k1hhn3h0s8mccg1cdmppz1mjmg19f2h306farzmzl",
-    "sha256bin64": "10d8im2adqqnkd6265gngv6xlm5qsz6r13z6cbbchsss0ssr8fxa"
+    "version": "87.0.4280.27",
+    "sha256": "0w0asxj7jlsw69cssfia8km4q9cx1c2mliks2rmhf4jk0hsghasm",
+    "sha256bin64": "1lsx4mhy8nachfb8c9f3mrx5nqw2bi046dqirb4lnv7y80jjjs1k"
  },
  "dev": {
-    "version": "87.0.4252.0",
-    "sha256": "1lxlsdni63zh79hxvpwgmnfn67kgfzhz3yg9bkxghqchqykkz92y",
-    "sha256bin64": "130hf7b35wcxpw05ddbqq89x10c0kays1vb9qg6xhq3zx2mk6ijw"
+    "version": "88.0.4298.4",
+    "sha256": "0ka11gmpkyrmifajaxm66c16hrj3xakdvhjqg04slyp2sv0nlhrl",
+    "sha256bin64": "0768y31jqbl1znp7yp6mvl5j12xl1nwjkh2l8zdga81q0wz52hh6"
  }
 }
--- a/pkgs/applications/networking/cluster/starboard/default.nix
+++ b/pkgs/applications/networking/cluster/starboard/default.nix
@ -2,16 +2,18 @@

 buildGoModule rec {
  pname = "starboard";
-  version = "0.5.0";
+  version = "0.6.0";

  src = fetchFromGitHub {
    owner = "aquasecurity";
    repo = pname;
    rev = "v${version}";
-    sha256 = "12vfxnny3giirdf1xhacy24dvy5zm7iil6h019s0l63876vingnc";
+    sha256 = "00d3cnd3n6laa6rphw5w9xk8slpp4a603vzhixzg01sghq26gy22";
  };

-  vendorSha256 = "0hj7h58j0v98plrqfldq59d084j76aiy82mfm8zi0vcqg6gxf4pb";
+  vendorSha256 = "0y816r75rp1a4rp7j0a8wzrfi2mdf4ji1vz2vaj5s7x9ik6rc13r";
+
+  subPackages = [ "cmd/starboard" ];

  doCheck = false;

--- a/pkgs/applications/networking/instant-messengers/slack/default.nix
+++ b/pkgs/applications/networking/instant-messengers/slack/default.nix
@ -39,9 +39,16 @@ let
  throwSystem = throw "Unsupported system: ${system}";

  pname = "slack";
+
+  x86_64-darwin-version = "4.10.3";
+  x86_64-darwin-sha256 = "0r77l57vr603xamich4h4gbdd5vdcj0sjs6yjpymfx9s0f98v8bb";
+
+  x86_64-linux-version = "4.10.3";
+  x86_64-linux-sha256 = "1gnjj2iyk8cwjajg8h9qpmzx10j4qjxjzciq8csg45qfzwkr3drf";
+
  version = {
-    x86_64-darwin = "4.10.3";
-    x86_64-linux = "4.10.3";
+    x86_64-darwin = x86_64-darwin-version;
+    x86_64-linux = x86_64-linux-version;
  }.${system} or throwSystem;

  src = let
@ -49,11 +56,11 @@ let
  in {
    x86_64-darwin = fetchurl {
      url = "${base}/releases/macos/${version}/prod/x64/Slack-${version}-macOS.dmg";
-      sha256 = "0r77l57vr603xamich4h4gbdd5vdcj0sjs6yjpymfx9s0f98v8bb";
+      sha256 = x86_64-darwin-sha256;
    };
    x86_64-linux = fetchurl {
      url = "${base}/linux_releases/slack-desktop-${version}-amd64.deb";
-      sha256 = "1gnjj2iyk8cwjajg8h9qpmzx10j4qjxjzciq8csg45qfzwkr3drf";
+      sha256 = x86_64-linux-sha256;
    };
  }.${system} or throwSystem;

@ -68,6 +75,8 @@ let
  linux = stdenv.mkDerivation rec {
    inherit pname version src meta;

+    passthru.updateScript = ./update.sh;
+
    rpath = stdenv.lib.makeLibraryPath [
      alsaLib
      at-spi2-atk
@ -152,6 +161,8 @@ let
  darwin = stdenv.mkDerivation {
    inherit pname version src meta;

+    passthru.updateScript = ./update.sh;
+
    nativeBuildInputs = [ undmg ];

    sourceRoot = "Slack.app";
--- a/pkgs/applications/networking/instant-messengers/slack/update.sh
+++ b/pkgs/applications/networking/instant-messengers/slack/update.sh
@ -0,0 +1,41 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p curl gnused
+
+set -eou pipefail
+
+latest_linux_version=$(curl --silent https://slack.com/downloads/linux | sed -n 's/.*Version \([0-9\.]\+\).*/\1/p')
+latest_mac_version=$(curl --silent https://slack.com/downloads/mac | sed -n 's/.*Version \([0-9\.]\+\).*/\1/p')
+
+# Double check that the latest mac and linux versions are in sync.
+if [[ "$latest_linux_version" != "$latest_mac_version" ]]; then
+  echo "the latest linux ($latest_linux_version) and mac ($latest_mac_version) versions are not the same"
+  exit 1
+fi
+
+nixpkgs="$(git rev-parse --show-toplevel)"
+slack_nix="$nixpkgs/pkgs/applications/networking/instant-messengers/slack/default.nix"
+nixpkgs_linux_version=$(cat "$slack_nix" | sed -n 's/.*x86_64-linux-version = \"\([0-9\.]\+\)\";.*/\1/p')
+nixpkgs_mac_version=$(cat "$slack_nix" | sed -n 's/.*x86_64-darwin-version = \"\([0-9\.]\+\)\";.*/\1/p')
+
+if [[ "$nixpkgs_linux_version" == "$latest_linux_version" && "$nixpkgs_mac_version" == "$latest_mac_version" ]]; then
+  echo "nixpkgs versions are all up to date!"
+  exit 0
+fi
+
+linux_url="https://downloads.slack-edge.com/linux_releases/slack-desktop-${latest_linux_version}-amd64.deb"
+mac_url="https://downloads.slack-edge.com/releases/macos/${latest_mac_version}/prod/x64/Slack-${latest_mac_version}-macOS.dmg"
+linux_sha256=$(nix-prefetch-url ${linux_url})
+mac_sha256=$(nix-prefetch-url ${mac_url})
+
+sed -i "s/x86_64-linux-version = \".*\"/x86_64-linux-version = \"${latest_linux_version}\"/" "$slack_nix"
+sed -i "s/x86_64-darwin-version = \".*\"/x86_64-darwin-version = \"${latest_mac_version}\"/" "$slack_nix"
+sed -i "s/x86_64-linux-sha256 = \".*\"/x86_64-linux-sha256 = \"${linux_sha256}\"/" "$slack_nix"
+sed -i "s/x86_64-darwin-sha256 = \".*\"/x86_64-darwin-sha256 = \"${mac_sha256}\"/" "$slack_nix"
+
+if ! nix-build -A slack "$nixpkgs"; then
+  echo "The updated slack failed to build."
+  exit 1
+fi
+
+echo "Successfully updated"
+echo "slack: $nixpkgs_linux_version -> $latest_linux_version"
--- a/pkgs/applications/networking/instant-messengers/teams/default.nix
+++ b/pkgs/applications/networking/instant-messengers/teams/default.nix
@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
    mv share $out/share

    substituteInPlace $out/share/applications/teams.desktop \
-      --replace /usr/bin/ $out/bin/
+      --replace /usr/bin/ ""

    ln -s $out/opt/teams/teams $out/bin/

--- a/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/tdesktop/default.nix
@ -22,12 +22,12 @@ let

 in mkDerivation rec {
  pname = "telegram-desktop";
-  version = "2.4.6";
+  version = "2.4.7";

  # Telegram-Desktop with submodules
  src = fetchurl {
    url = "https://github.com/telegramdesktop/tdesktop/releases/download/v${version}/tdesktop-${version}-full.tar.gz";
-    sha256 = "190k9ik678br5k892gj26bx4rbj5rn5ks4qgf2nrlgww0z59fvrc";
+    sha256 = "1j2v29952l0am357pqvvgzm2zghmwhlr833kgp85hssxpr9xy4vv";
  };

  postPatch = ''
--- a/pkgs/applications/networking/mailreaders/bubblemail/default.nix
+++ b/pkgs/applications/networking/mailreaders/bubblemail/default.nix
@ -0,0 +1,76 @@
+{ lib
+, fetchFromGitLab
+, gettext
+, gtk3
+, python3Packages
+, gdk-pixbuf
+, libnotify
+, gst_all_1
+, libsecret
+, wrapGAppsHook
+, gsettings-desktop-schemas
+, gnome-online-accounts
+, glib
+, gobject-introspection
+, folks
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "bubblemail";
+  version = "1.3";
+
+  src = fetchFromGitLab {
+    domain = "framagit.org";
+    owner = "razer";
+    repo = "bubblemail";
+    rev = "v${version}";
+    sha256 = "FEIdEoZBlM28F5kSMoln7KACwetb8hp+qix1P+DIE8k=";
+  };
+
+  buildInputs = [
+    gtk3
+    gdk-pixbuf
+    glib
+    libnotify
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    gst_all_1.gst-plugins-bad
+    libsecret
+    gnome-online-accounts
+    folks
+  ];
+
+  nativeBuildInputs = [
+    gettext
+    wrapGAppsHook
+    python3Packages.pillow
+    # For setup-hook
+    gobject-introspection
+  ];
+
+  propagatedBuildInputs = with python3Packages; [
+    gsettings-desktop-schemas
+    pygobject3
+    dbus-python
+    pyxdg
+  ];
+
+  # See https://nixos.org/nixpkgs/manual/#ssec-gnome-common-issues-double-wrapped
+  dontWrapGApps = true;
+
+  # https://github.com/NixOS/nixpkgs/issues/56943
+  strictDeps = false;
+
+  preFixup = ''
+    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
+  meta = with lib; {
+    description = "An extensible mail notification service.";
+    homepage = "http://bubblemail.free.fr/";
+    license = licenses.gpl2Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ doronbehar ];
+  };
+}
--- a/pkgs/applications/networking/nextdns/default.nix
+++ b/pkgs/applications/networking/nextdns/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "nextdns";
-  version = "1.8.3";
+  version = "1.8.8";

  src = fetchFromGitHub {
    owner = "nextdns";
    repo = "nextdns";
    rev = "v${version}";
-    sha256 = "1bl6ky258hnai4v7d0gskn6nf5sdsc3xlwl959iwzqhpp0j3q9xg";
+    sha256 = "17grlia9vxjly7hnwdgw8xfrynibj9h839kxs3wbdgp86b4lf5xf";
  };

  vendorSha256 = "09whpzsn16znyrknfm5zlhla253r69j6d751czza4c83m4r36swj";
--- a/pkgs/applications/networking/syncplay/default.nix
+++ b/pkgs/applications/networking/syncplay/default.nix
@ -2,7 +2,7 @@

 buildPythonApplication rec {
  pname = "syncplay";
-  version = "1.6.5";
+  version = "1.6.6";

  format = "other";

@ -10,7 +10,7 @@ buildPythonApplication rec {
    owner = "Syncplay";
    repo = "syncplay";
    rev = "v${version}";
-    sha256 = "107dgsrjv95ww6gj77q89dirl604b2ljlpjg79gffm9c4gkmjj2m";
+    sha256 = "1wkxdp7dv5y1100awy949higvs5035ylfyl83qrp4lnimy3imw09";
  };

  propagatedBuildInputs = [ pyside2 shiboken2 twisted certifi ] ++ twisted.extras.tls;
--- a/pkgs/applications/office/todoman/default.nix
+++ b/pkgs/applications/office/todoman/default.nix
@ -1,4 +1,9 @@
-{ stdenv, python3, glibcLocales, installShellFiles, jq }:
+{ stdenv
+, python3
+, glibcLocales
+, installShellFiles
+, jq
+}:

 let
  inherit (python3.pkgs) buildPythonApplication fetchPypi;
@ -12,22 +17,36 @@ buildPythonApplication rec {
    sha256 = "1aq7f63bhs9dnwzp15nfr07f2ki6s3lnqfap3b09rhchn6lfznwb";
  };

-    LOCALE_ARCHIVE = stdenv.lib.optionalString stdenv.isLinux
-      "${glibcLocales}/lib/locale/locale-archive";
-    LANG = "en_US.UTF-8";
-    LC_TYPE = "en_US.UTF-8";
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+  propagatedBuildInputs = with python3.pkgs; [
+    atomicwrites
+    click
+    click-log
+    click-repl
+    configobj
+    humanize
+    icalendar
+    parsedatetime
+    python-dateutil
+    pyxdg
+    tabulate
+    urwid
+  ];

-  nativeBuildInputs = [ installShellFiles ];
-  buildInputs = [ glibcLocales ];
-  propagatedBuildInputs = with python3.pkgs;
-    [ atomicwrites click click-log click-repl configobj humanize icalendar parsedatetime
-      python-dateutil pyxdg tabulate urwid ];
+  checkInputs = with python3.pkgs; [
+    flake8
+    flake8-import-order
+    freezegun
+    hypothesis
+    pytest
+    pytestrunner
+    pytestcov
+    glibcLocales
+  ];

-  checkInputs = with python3.pkgs;
-    [ flake8 flake8-import-order freezegun hypothesis pytest pytestrunner pytestcov ];
-
-  makeWrapperArgs = [ "--set LOCALE_ARCHIVE ${glibcLocales}/lib/locale/locale-archive"
-                      "--set CHARSET en_us.UTF-8" ];
+  LC_ALL = "en_US.UTF-8";

  postInstall = ''
    installShellCompletion --bash contrib/completion/bash/_todo
--- a/pkgs/applications/radio/limesuite/default.nix
+++ b/pkgs/applications/radio/limesuite/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "limesuite";
-  version = "20.07.2";
+  version = "20.10.0";

  src = fetchFromGitHub {
    owner = "myriadrf";
    repo = "LimeSuite";
    rev = "v${version}";
-    sha256 = "0v0w0f5ff1gwpfy13x1q1jsx9xfg4s3ccg05ikpnkzj4yg6sjps1";
+    sha256 = "04wzfhzqmxjsa6bgcr4zd518fln9rbwnbabf48kha84d70vzkdlx";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/applications/version-management/git-and-tools/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/default.nix
@ -74,6 +74,8 @@ let
  # support for bugzilla
  git-bz = callPackage ./git-bz { };

+  git-chglog = callPackage ./git-chglog { };
+
  git-cinnabar = callPackage ./git-cinnabar { };

  git-codeowners = callPackage ./git-codeowners { };
--- a/pkgs/applications/version-management/git-and-tools/git-chglog/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/git-chglog/default.nix
@ -0,0 +1,22 @@
+{ lib, buildGoPackage, fetchFromGitHub }:
+
+buildGoPackage rec {
+  pname = "git-chglog";
+  version = "0.9.1";
+
+  goPackagePath = "github.com/git-chglog/git-chglog";
+
+  src = fetchFromGitHub {
+    owner = "git-chglog";
+    repo = "git-chglog";
+    rev = version;
+    sha256 = "08x7w1jlvxxvwnz6pvkjmfd3nqayd8n15r9jbqi2amrp31z0gq0p";
+  };
+
+  meta = with lib; {
+    description = "CHANGELOG generator implemented in Go (Golang)";
+    license = licenses.mit;
+    maintainers = with maintainers; [ ldenefle ];
+  };
+}
+
--- a/pkgs/applications/version-management/git-lfs/default.nix
+++ b/pkgs/applications/version-management/git-lfs/default.nix
@ -2,13 +2,13 @@

 buildGoPackage rec {
  pname = "git-lfs";
-  version = "2.12.0";
+  version = "2.12.1";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "git-lfs";
    repo = "git-lfs";
-    sha256 = "0pyvlcy6jxh0vzpsmywlbzwwdyj3jkcclnqb6sg786mmwrnqzj88";
+    sha256 = "1x8s1w8yqhj5nm20knr2gkb59rwzx220nf099lgd62cajzsdpjx5";
  };

  goPackagePath = "github.com/git-lfs/git-lfs";
--- a/pkgs/applications/video/k9copy/default.nix
+++ b/pkgs/applications/video/k9copy/default.nix
@ -1,63 +0,0 @@
-{ stdenv, fetchurl
-, cmake
-, dvdauthor, xineLib, libmpeg2, libav, libdvdread, libdvdnav, dvdplusrwtools
-, phonon, qtx11extras
-, extra-cmake-modules, kio, kiconthemes, ki18n, kdesu, kdoctools, solid
-}:
-
-stdenv.mkDerivation rec {
-  version = "3.0.3";
-  pname = "k9copy";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/k9copy-reloaded/${pname}-${version}.tar.gz";
-    sha256 = "0dp06rwihks50c57bbv04d6bj2qc88isl91971r4lii2xp0qn7sg";
-  };
-
-  patches = [
-    ./gcc6.patch
-  ];
-
-  cmakeFlags = [
-    "-DQT5_BUILD=ON"
-    "-DCMAKE_MINIMUM_REQUIRED_VERSION=3.0"
-  ];
-
-  # Hack to disable documentation
-  preConfigure = ''
-   substituteInPlace ./CMakeLists.txt \
-     --replace "add_subdirectory(doc)" ""
-  '';
-
-  buildInputs = [
-    cmake
-    dvdauthor
-    xineLib
-    libmpeg2
-    libav
-    libdvdread
-    libdvdnav
-    dvdplusrwtools
-    #automoc4
-    phonon
-    extra-cmake-modules
-    kio
-    solid
-    qtx11extras
-    kiconthemes
-    ki18n
-    kdesu
-  ];
-  nativeBuildInputs = [ kdoctools ];
-
-  meta = {
-    description = "DVD backup and DVD authoring program";
-    homepage = "http://k9copy-reloaded.sourceforge.net/";
-    license = stdenv.lib.licenses.gpl2;
-    maintainers = with stdenv.lib.maintainers; [ flosse ];
-    platforms = stdenv.lib.platforms.unix;
-    # TODO: The software is deprecated and the build is broken, see:
-    # https://github.com/NixOS/nixpkgs/pull/63260#issuecomment-503506487
-    broken = true;
-  };
-}
--- a/pkgs/applications/video/k9copy/gcc6.patch
+++ b/pkgs/applications/video/k9copy/gcc6.patch
@ -1,26 +0,0 @@
-diff --git c/src/backup/k9dvdbackup.cpp i/src/backup/k9dvdbackup.cpp
-index f5e4859..82fa392 100755
--- c/src/backup/k9dvdbackup.cpp
-+++ i/src/backup/k9dvdbackup.cpp
-@@ -907,7 +907,7 @@ k9Vobu * k9DVDBackup::remapOffset(uint32_t _sector,uint32_t *_offset,int _dir) {
- 
- 
-         if ((vobu1 !=NULL) && (vobu2!=NULL)) {
-            *_offset = abs(vobu1->newSector - vobu2->newSector)  | maskOffset1 ;
-+            *_offset = (vobu1->newSector - vobu2->newSector)  | maskOffset1 ;
-             *_offset |= maskOffset2;
-             return vobu2;
-         }
-diff --git c/src/backup/k9execcopy.cpp i/src/backup/k9execcopy.cpp
-index d59222c..35de923 100644
--- c/src/backup/k9execcopy.cpp
-+++ i/src/backup/k9execcopy.cpp
-@@ -306,7 +306,7 @@ void k9ExecCopy::createMkv(k9DVDTitle *_title,const QString &_filename,QMultiMap
- 
- #if QT_VERSION >= 0x050000
-     m_progressDialog=new QProgressDialog(k9Dialogs::getMainWidget() );
-    m_progressDialog->setCancelButton(false);
-+    m_progressDialog->setCancelButton(0);
- 
- #else
-     m_progressDialog=new KProgressDialog(k9Dialogs::getMainWidget() );
--- a/pkgs/applications/virtualization/singularity/default.nix
+++ b/pkgs/applications/virtualization/singularity/default.nix
@ -18,11 +18,11 @@ with lib;

 buildGoPackage rec {
  pname = "singularity";
-  version = "3.6.3";
+  version = "3.6.4";

  src = fetchurl {
    url = "https://github.com/hpcng/singularity/releases/download/v${version}/singularity-${version}.tar.gz";
-    sha256 = "1zd29s8lggv4x5xracgzywayg1skl9qc2bqh1zdxh1wrg9sqbadi";
+    sha256 = "17z7v7pjq1ibl64ir4h183sp58v2x7iv6dn6imnnhkdvss0kl8vi";
  };

  goPackagePath = "github.com/sylabs/singularity";
--- a/pkgs/data/fonts/ttf-tw-moe/default.nix
+++ b/pkgs/data/fonts/ttf-tw-moe/default.nix
@ -0,0 +1,27 @@
+{ stdenv, fetchzip }:
+
+fetchzip {
+  name = "ttf-tw-moe";
+
+  url = "https://github.com/Jiehong/TW-fonts/archive/b30ae75e9dc299afd61e31cfd43f7a0a157dfb1f.zip";
+
+  postFetch = ''
+    mkdir -p $out/share/fonts
+    unzip -j $downloadedFile TW-fonts-b30ae75e9dc299afd61e31cfd43f7a0a157dfb1f/\*.ttf -d $out/share/fonts/truetype
+  '';
+
+  sha256 = "0khgxih9z6pqf7pdp21xjp24wb9ygsrdcmzpjb7vr9x8n78i1fbs";
+
+  meta = with stdenv.lib; {
+    homepage = "http://www.moe.gov.tw/";
+    description = "Set of KAI and SONG fonts from the Ministry of Education of Taiwan";
+    longDescription = ''
+      Installs 2 TTF fonts: MOESongUN and TW-MOE-Std-Kai.
+      Both are provided by the Ministry of Education of Taiwan; each character's shape
+      closely follows the official recommendation, and can be used as for teaching purposes.
+    '';
+    license = licenses.cc-by-nd-30;
+    maintainers = [ maintainers.jiehong ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/development/compilers/go/1.14.nix
+++ b/pkgs/development/compilers/go/1.14.nix
@ -36,11 +36,11 @@ in

 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.14.10";
+  version = "1.14.11";

  src = fetchurl {
    url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "0rfnjl582cm5klv8c2qyyvn26807zn89m5mk282gkc7awfkrjxmk";
+    sha256 = "05hgnyda5bpm29gnx1956syq54jmpk4k9cf976vypw8ckg9g6w8q";
  };

  # perl is used for testing go vet
--- a/pkgs/development/compilers/go/1.15.nix
+++ b/pkgs/development/compilers/go/1.15.nix
@ -36,11 +36,11 @@ in

 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.15.3";
+  version = "1.15.4";

  src = fetchurl {
    url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "1228nv4vyzbqv768dl0bimsic47x9yyqld61qbgqqk75f0jn0sl9";
+    sha256 = "0rr3gp99bmdzg381x5fdwa15brllihn57175l0c82sqqljlscg86";
  };

  # perl is used for testing go vet
--- a/pkgs/development/compilers/openjdk/default.nix
+++ b/pkgs/development/compilers/openjdk/default.nix
@ -31,6 +31,10 @@ let
      gtk3 gnome_vfs GConf glib
    ];

+    passthru = {
+      inherit gtk3;
+    };
+
    patches = [
      ./fix-java-home-jdk10.patch
      ./read-truststore-from-env-jdk10.patch
--- a/pkgs/development/compilers/openjdk/jre.nix
+++ b/pkgs/development/compilers/openjdk/jre.nix
@ -0,0 +1,19 @@
+{ jdk
+, runCommand
+, patchelf
+, lib
+, modules ? [ "java.base" ]
+}:
+
+let
+  jre = runCommand "${jdk.name}-jre" {
+    nativeBuildInputs = [ patchelf ];
+    buildInputs = [ jdk ];
+    passthru = {
+      home = "${jre}";
+    };
+  }   ''
+      jlink --module-path ${jdk}/lib/openjdk/jmods --add-modules ${lib.concatStringsSep "," modules} --output $out
+      patchelf --shrink-rpath $out/bin/* $out/lib/jexec $out/lib/jspawnhelper $out/lib/*.so $out/lib/*/*.so
+  '';
+in jre
--- a/pkgs/development/compilers/scala/2.10.nix
+++ b/pkgs/development/compilers/scala/2.10.nix
@ -1,43 +0,0 @@
-{ stdenv, fetchurl, makeWrapper, jre, gnugrep, coreutils }:
-
-stdenv.mkDerivation rec {
-  name = "scala-2.10.7";
-
-  src = fetchurl {
-    url = "https://www.scala-lang.org/files/archive/${name}.tgz";
-    sha256 = "04gi55lzgrhsb78qw8jmnccqim92rw6898knw0a7gfzn2sci30wj";
-  };
-
-  propagatedBuildInputs = [ jre ] ;
-  buildInputs = [ makeWrapper ] ;
-
-  installPhase = ''
-    mkdir -p $out
-    rm bin/*.bat
-    mv * $out
-
-    for p in $(ls $out/bin/) ; do
-      wrapProgram $out/bin/$p \
-        --prefix PATH ":" ${coreutils}/bin \
-        --prefix PATH ":" ${gnugrep}/bin \
-        --prefix PATH ":" ${jre}/bin \
-        --set JAVA_HOME ${jre}
-    done
-  '';
-
-  meta = {
-    description = "A general purpose programming language";
-    longDescription = ''
-      Scala is a general purpose programming language designed to express
-      common programming patterns in a concise, elegant, and type-safe way.
-      It smoothly integrates features of object-oriented and functional
-      languages, enabling Java and other programmers to be more productive.
-      Code sizes are typically reduced by a factor of two to three when
-      compared to an equivalent Java application.
-    '';
-    homepage = "https://www.scala-lang.org/";
-    license = stdenv.lib.licenses.bsd3;
-    platforms = stdenv.lib.platforms.all;
-    branch = "2.10";
-  };
-}
--- a/pkgs/development/compilers/scala/2.11.nix
+++ b/pkgs/development/compilers/scala/2.11.nix
@ -1,48 +0,0 @@
-{ stdenv, fetchurl, makeWrapper, jre, gnugrep, coreutils }:
-
-stdenv.mkDerivation rec {
-  name = "scala-2.11.12";
-
-  src = fetchurl {
-    url = "https://www.scala-lang.org/files/archive/${name}.tgz";
-    sha256 = "1a4nc4qp9dm4rps47j92hlmxxqskv67qbdmjqc5zd94wd4rps7di";
-  };
-
-  propagatedBuildInputs = [ jre ] ;
-  buildInputs = [ makeWrapper ] ;
-
-  installPhase = ''
-    mkdir -p $out
-    rm "bin/"*.bat
-    mv * $out
-
-    # put docs in correct subdirectory
-    mkdir -p $out/share/doc
-    mv $out/doc $out/share/doc/${name}
-    mv $out/man $out/share/man
-
-    for p in $(ls $out/bin/) ; do
-      wrapProgram $out/bin/$p \
-        --prefix PATH ":" ${coreutils}/bin \
-        --prefix PATH ":" ${gnugrep}/bin \
-        --prefix PATH ":" ${jre}/bin \
-        --set JAVA_HOME ${jre}
-    done
-  '';
-
-  meta = {
-    description = "General purpose programming language";
-    longDescription = ''
-      Scala is a general purpose programming language designed to express
-      common programming patterns in a concise, elegant, and type-safe way.
-      It smoothly integrates features of object-oriented and functional
-      languages, enabling Java and other programmers to be more productive.
-      Code sizes are typically reduced by a factor of two to three when
-      compared to an equivalent Java application.
-    '';
-    homepage = "https://www.scala-lang.org/";
-    license = stdenv.lib.licenses.bsd3;
-    platforms = stdenv.lib.platforms.all;
-    branch = "2.11";
-  };
-}
--- a/pkgs/development/compilers/scala/2.12.nix
+++ b/pkgs/development/compilers/scala/2.12.nix
@ -1,47 +0,0 @@
-{ stdenv, fetchurl, makeWrapper, jre, gnugrep, coreutils }:
-
-stdenv.mkDerivation rec {
-  name = "scala-2.12.12";
-
-  src = fetchurl {
-    url = "https://www.scala-lang.org/files/archive/${name}.tgz";
-    sha256 = "0avyaa7y8w7494339krcpqhc2p8y5pjk4pz7mqmzdzwy7hgws81m";
-  };
-
-  propagatedBuildInputs = [ jre ] ;
-  buildInputs = [ makeWrapper ] ;
-
-  installPhase = ''
-    mkdir -p $out
-    rm "bin/"*.bat
-    mv * $out
-
-    # put docs in correct subdirectory
-    mkdir -p $out/share/doc
-    mv $out/doc $out/share/doc/scala
-    mv $out/{LICENSE,NOTICE} $out/share/doc/scala
-
-    for p in $(ls $out/bin/) ; do
-      wrapProgram $out/bin/$p \
-        --prefix PATH ":" ${coreutils}/bin \
-        --prefix PATH ":" ${gnugrep}/bin \
-        --prefix PATH ":" ${jre}/bin \
-        --set JAVA_HOME ${jre}
-    done
-  '';
-
-  meta = {
-    description = "General purpose programming language";
-    longDescription = ''
-      Scala is a general purpose programming language designed to express
-      common programming patterns in a concise, elegant, and type-safe way.
-      It smoothly integrates features of object-oriented and functional
-      languages, enabling Java and other programmers to be more productive.
-      Code sizes are typically reduced by a factor of two to three when
-      compared to an equivalent Java application.
-    '';
-    homepage = "https://www.scala-lang.org/";
-    license = stdenv.lib.licenses.bsd3;
-    platforms = stdenv.lib.platforms.all;
-  };
-}
--- a/pkgs/development/compilers/scala/2.13.nix
+++ b/pkgs/development/compilers/scala/2.13.nix
@ -1,47 +0,0 @@
-{ stdenv, fetchurl, makeWrapper, jre, gnugrep, coreutils }:
-
-stdenv.mkDerivation rec {
-  name = "scala-2.13.3";
-
-  src = fetchurl {
-    url = "https://www.scala-lang.org/files/archive/${name}.tgz";
-    sha256 = "0zv9w9f6g2cfydsvp8mqcfgv2v3487xp4ca1qndg6v7jrhdp7wy9";
-  };
-
-  propagatedBuildInputs = [ jre ] ;
-  buildInputs = [ makeWrapper ] ;
-
-  installPhase = ''
-    mkdir -p $out
-    rm "bin/"*.bat
-    mv * $out
-
-    # put docs in correct subdirectory
-    mkdir -p $out/share/doc
-    mv $out/doc $out/share/doc/scala
-    mv $out/{LICENSE,NOTICE} $out/share/doc/scala
-
-    for p in $(ls $out/bin/) ; do
-      wrapProgram $out/bin/$p \
-        --prefix PATH ":" ${coreutils}/bin \
-        --prefix PATH ":" ${gnugrep}/bin \
-        --prefix PATH ":" ${jre}/bin \
-        --set JAVA_HOME ${jre}
-    done
-  '';
-
-  meta = {
-    description = "General purpose programming language";
-    longDescription = ''
-      Scala is a general purpose programming language designed to express
-      common programming patterns in a concise, elegant, and type-safe way.
-      It smoothly integrates features of object-oriented and functional
-      languages, enabling Java and other programmers to be more productive.
-      Code sizes are typically reduced by a factor of two to three when
-      compared to an equivalent Java application.
-    '';
-    homepage = "https://www.scala-lang.org/";
-    license = stdenv.lib.licenses.bsd3;
-    platforms = stdenv.lib.platforms.all;
-  };
-}
--- a/pkgs/development/compilers/scala/2.x.nix
+++ b/pkgs/development/compilers/scala/2.x.nix
@ -0,0 +1,117 @@
+{ stdenv, lib, fetchurl, makeWrapper, jre, gnugrep, coreutils, nixosTests
+, writeScript, common-updater-scripts, git, gnused, nix, nixfmt }:
+
+with lib;
+
+let
+  repo = "git@github.com:scala/scala.git";
+
+  common = { version, sha256, test, pname }:
+    stdenv.mkDerivation rec {
+      inherit version;
+
+      name = "scala-${version}";
+
+      src = fetchurl {
+        inherit sha256;
+        url = "https://www.scala-lang.org/files/archive/scala-${version}.tgz";
+      };
+
+      propagatedBuildInputs = [ jre ];
+      buildInputs = [ makeWrapper ];
+
+      installPhase = ''
+        mkdir -p $out
+        rm bin/*.bat
+        mv * $out
+
+        # put docs in correct subdirectory
+        mkdir -p $out/share/doc
+        mv $out/doc $out/share/doc/${name}
+        mv $out/man $out/share/man
+
+        for p in $(ls $out/bin/) ; do
+          wrapProgram $out/bin/$p \
+            --prefix PATH ":" ${coreutils}/bin \
+            --prefix PATH ":" ${gnugrep}/bin \
+            --prefix PATH ":" ${jre}/bin \
+            --set JAVA_HOME ${jre}
+        done
+      '';
+
+      passthru = {
+        tests = [ test ];
+
+        updateScript = writeScript "update.sh" ''
+          #!${stdenv.shell}
+          set -o errexit
+          PATH=${
+            stdenv.lib.makeBinPath [
+              common-updater-scripts
+              coreutils
+              git
+              gnused
+              nix
+              nixfmt
+            ]
+          }
+          versionSelect='v${versions.major version}.${versions.minor version}.*'
+          oldVersion="$(nix-instantiate --eval -E "with import ./. {}; lib.getVersion ${pname}" | tr -d '"')"
+          latestTag="$(git -c 'versionsort.suffix=-' ls-remote --exit-code --refs --sort='version:refname' --tags ${repo} "$versionSelect" | tail --lines=1 | cut --delimiter='/' --fields=3 | sed 's|^v||g')"
+          if [ "$oldVersion" != "$latestTag" ]; then
+            nixpkgs="$(git rev-parse --show-toplevel)"
+            default_nix="$nixpkgs/pkgs/development/compilers/scala/2.x.nix"
+            update-source-version ${pname} "$latestTag" --version-key=version --print-changes
+            nixfmt "$default_nix"
+          else
+            echo "${pname} is already up-to-date"
+          fi
+        '';
+      };
+
+      meta = {
+        description = "A general purpose programming language";
+        longDescription = ''
+          Scala is a general purpose programming language designed to express
+          common programming patterns in a concise, elegant, and type-safe way.
+          It smoothly integrates features of object-oriented and functional
+          languages, enabling Java and other programmers to be more productive.
+          Code sizes are typically reduced by a factor of two to three when
+          compared to an equivalent Java application.
+        '';
+        homepage = "https://www.scala-lang.org/";
+        license = licenses.bsd3;
+        platforms = platforms.all;
+        branch = versions.majorMinor version;
+        maintainers = [ maintainers.nequissimus ];
+      };
+    };
+in {
+  scala_2_10 = common {
+    version = "2.10.7";
+    sha256 = "koMRmRb2u3cU4HaihAzPItWIGbNVIo7RWRrm92kp8RE=";
+    test = { inherit (nixosTests) scala_2_10; };
+    pname = "scala_2_10";
+  };
+
+  scala_2_11 = common {
+    version = "2.11.12";
+    sha256 = "sR19M2mcpPYLw7K2hY/ZU+PeK4UiyUP0zaS2dDFhlqg=";
+    test = { inherit (nixosTests) scala_2_11; };
+    pname = "scala_2_11";
+  };
+
+  scala_2_12 = common {
+    version = "2.12.12";
+    sha256 = "NSDNHzye//YrrudfMuUtHl3BIL4szzQGSeRw5I9Sfis=";
+    test = { inherit (nixosTests) scala_2_12; };
+    pname = "scala_2_12";
+  };
+
+  scala_2_13 = common {
+    version = "2.13.3";
+    sha256 = "yfNzG8zybPOaxUExcvtBZGyxn2O4ort1846JZ1ziaX8=";
+    test = { inherit (nixosTests) scala_2_13; };
+    pname = "scala_2_13";
+  };
+}
--- a/pkgs/development/compilers/solc/default.nix
+++ b/pkgs/development/compilers/solc/default.nix
@ -1,32 +1,37 @@
-{ stdenv, fetchzip, boost, cmake, ncurses, python3, coreutils
+{ gccStdenv, fetchzip, boost, cmake, ncurses, python3, coreutils
 , z3Support ? true, z3 ? null, cvc4Support ? true, cvc4 ? null
 , cln ? null, gmp ? null
 }:

+# compiling source/libsmtutil/CVC4Interface.cpp breaks on clang on Darwin,
+# general commandline tests fail at abiencoderv2_no_warning/ on clang on NixOS
+let stdenv = gccStdenv; in
+
 assert z3Support -> z3 != null && stdenv.lib.versionAtLeast z3.version "4.6.0";
 assert cvc4Support -> cvc4 != null && cln != null && gmp != null;

 let
-  jsoncppURL = "https://github.com/open-source-parsers/jsoncpp/archive/1.9.2.tar.gz";
+  jsoncppVersion = "1.9.4";
+  jsoncppUrl = "https://github.com/open-source-parsers/jsoncpp/archive/${jsoncppVersion}.tar.gz";
  jsoncpp = fetchzip {
-    url = jsoncppURL;
-    sha256 = "037d1b1qdmn3rksmn1j71j26bv4hkjv7sn7da261k853xb5899sg";
+    url = jsoncppUrl;
+    sha256 = "0qnx5y6c90fphl9mj9d20j2dfgy6s5yr5l0xnzid0vh71zrp6jwv";
  };
 in
 stdenv.mkDerivation rec {

  pname = "solc";
-  version = "0.6.8";
+  version = "0.7.4";

  # upstream suggests avoid using archive generated by github
  src = fetchzip {
    url = "https://github.com/ethereum/solidity/releases/download/v${version}/solidity_${version}.tar.gz";
-    sha256 = "1nxds6c10hjqjjk893qw2yljws57li0xigbf3ih85y8y6d587ph0";
+    sha256 = "02261l54jdbvxk612z7zsyvmchy1rx4lf27b3f616sd7r56krpkg";
  };

  postPatch = ''
    substituteInPlace cmake/jsoncpp.cmake \
-      --replace "${jsoncppURL}" ${jsoncpp}
+      --replace "${jsoncppUrl}" ${jsoncpp}
  '';

  cmakeFlags = [
--- a/pkgs/development/compilers/spasm-ng/default.nix
+++ b/pkgs/development/compilers/spasm-ng/default.nix
@ -0,0 +1,32 @@
+{ stdenv, fetchFromGitHub, gcc, gmp, openssl, zlib }:
+
+stdenv.mkDerivation rec {
+  pname = "spasm-ng";
+
+  version = "unstable-2020-08-03";
+
+  src = fetchFromGitHub {
+    owner = "alberthdev";
+    repo = "spasm-ng";
+    rev = "221898beff2442f459b80ab89c8e1035db97868e";
+    sha256 = "0xspxmp2fir604b4xsk4hi1gjv61rnq2ypppr7cj981jlhicmvjj";
+  };
+
+  nativeBuildInputs = [ gcc ];
+
+  buildInputs = [ gmp openssl zlib ];
+
+  enableParallelBuilding = true;
+
+  installPhase = ''
+    install -Dm755 spasm -t $out/bin
+  '';
+
+  meta = with stdenv.lib; {
+    homepage    = "https://github.com/alberthdev/spasm-ng";
+    description = "Z80 assembler with extra features to support development for TI calculators";
+    license     = licenses.gpl2Plus;
+    maintainers = with maintainers; [ siraben ];
+    platforms   = platforms.unix;
+  };
+}
--- a/pkgs/development/go-modules/generic/default.nix
+++ b/pkgs/development/go-modules/generic/default.nix
@ -136,10 +136,10 @@ let
      export GOSUMDB=off
      export GOPROXY=off
      cd "$modRoot"
-      if [ -n "${go-modules}" ]; then
+    '' + lib.optionalString (go-modules != "") ''
      rm -rf vendor
-          ln -s ${go-modules} vendor
-      fi
+      cp -r --reflink=auto ${go-modules} vendor
+    '' + ''

      runHook postConfigure
    '';
--- a/pkgs/development/interpreters/clojure/babashka.nix
+++ b/pkgs/development/interpreters/clojure/babashka.nix
@ -1,25 +1,25 @@
-{ stdenv, fetchurl, graalvm8-ce, glibcLocales }:
+{ stdenv, fetchurl, graalvm11-ce, glibcLocales }:

 with stdenv.lib;
 stdenv.mkDerivation rec {
  pname = "babashka";
-  version = "0.0.97";
+  version = "0.2.3";

  reflectionJson = fetchurl {
    name = "reflection.json";
    url = "https://github.com/borkdude/${pname}/releases/download/v${version}/${pname}-${version}-reflection.json";
-    sha256 = "1gd9ih9l02n1j9qkbxb36d3cb5sddwvxiw8kkicgc4xig77lsa7z";
+    sha256 = "0lbdh3v3g3j00bn99bjhjj3gk1q9ks2alpvl9bxc00xpyw86f7z8";
  };

  src = fetchurl {
    url = "https://github.com/borkdude/${pname}/releases/download/v${version}/${pname}-${version}-standalone.jar";
-    sha256 = "08py6bawfrhg90fbcnv2mq4c91g5wa1q2q6zdjy2i1b9q4x1654r";
+    sha256 = "0vh6k3dkzyk346jjzg6n4mdi65iybrmhb3js9lm73yc3ay2c5dyi";
  };

  dontUnpack = true;

  LC_ALL = "en_US.UTF-8";
-  nativeBuildInputs = [ graalvm8-ce glibcLocales ];
+  nativeBuildInputs = [ graalvm11-ce glibcLocales ];

  buildPhase = ''
    native-image \
@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
    '';
    homepage = "https://github.com/borkdude/babashka";
    license = licenses.epl10;
-    platforms = graalvm8-ce.meta.platforms;
+    platforms = graalvm11-ce.meta.platforms;
    maintainers = with maintainers; [ bandresen bhougland DerGuteMoritz jlesquembre ];
  };
 }
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@ -273,16 +273,16 @@ let
        };

  php73base = callPackage generic (_args // {
-    version = "7.3.23";
-    sha256 = "0k600imsxm3r3qdv20ryqhvfmnkmjhvm2hcnqr180l058snncrpx";
+    version = "7.3.24";
+    sha256 = "1655rj4w63n5fkvdj3kz9f5jfyjgvzw8a6j8zkzgic1p42xszdsm";

    # https://bugs.php.net/bug.php?id=76826
    extraPatches = lib.optional stdenv.isDarwin ./php73-darwin-isfinite.patch;
  });

  php74base = callPackage generic (_args // {
-    version = "7.4.11";
-    sha256 = "1idq2sk3x6msy8l2g42jv3y87h1fgb1aybxw7wpjkliv4iaz422l";
+    version = "7.4.12";
+    sha256 = "0rwrl7xgfq2bbgmy34klgfsqa7v935074ibanmic9pwy4g676vvf";
  });

  defaultPhpExtensions = { all, ... }: with all; ([
--- a/pkgs/development/interpreters/spidermonkey/78.nix
+++ b/pkgs/development/interpreters/spidermonkey/78.nix
@ -21,11 +21,11 @@

 stdenv.mkDerivation rec {
  pname = "spidermonkey";
-  version = "78.1.0";
+  version = "78.4.0";

  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}esr/source/firefox-${version}esr.source.tar.xz";
-    sha256 = "18k47dl9hbnpqw69csxjar5dhwa7r8k7j9kvcfgmwb1iv6ba601n";
+    sha256 = "1z3hj45bnd12z3g6ajv9qrgclca7fymi1sxj9l9nh9q6y6xz0g4f";
  };

  outputs = [ "out" "dev" ];
@ -52,18 +52,6 @@ stdenv.mkDerivation rec {
    zlib
  ];

-  patches = [
-    # https://mail.gnome.org/archives/distributor-list/2020-August/msg00000.html
-    (fetchpatch {
-      url = "https://github.com/ptomato/mozjs/commit/b2974f8a6558d2dc4517b49ee313a9900a853285.patch";
-      sha256 = "1bl5mbx7gmad6fmpc427263i1ychi2linpg69kxlr2w91r5m6ji3";
-    })
-    (fetchpatch {
-      url = "https://github.com/ptomato/mozjs/commit/e5a2eb99f653ae03c67e536df1d55d265a0a1605.patch";
-      sha256 = "0xhy63nw2byibmjc41yh6dwpg282nylganrs5aprn9pbqbcpsvif";
-    })
-  ];
-
  preConfigure = ''
    export CXXFLAGS="-fpermissive"
    export LIBXUL_DIST=$out
@ -101,9 +89,9 @@ stdenv.mkDerivation rec {

  # Remove unnecessary static lib
  preFixup = ''
-    moveToOutput bin/js60-config "$dev"
+    moveToOutput bin/js78-config "$dev"
    rm $out/lib/libjs_static.ajs
-    ln -s $out/bin/js60 $out/bin/js
+    ln -s $out/bin/js78 $out/bin/js
  '';

  enableParallelBuilding = true;
@ -112,7 +100,7 @@ stdenv.mkDerivation rec {
    description = "Mozilla's JavaScript engine written in C/C++";
    homepage = "https://developer.mozilla.org/en/SpiderMonkey";
    license = licenses.gpl2; # TODO: MPL/GPL/LGPL tri-license.
-    maintainers = [ maintainers.abbradar ];
+    maintainers = with maintainers; [ abbradar lostnet ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/libraries/amdvlk/default.nix
+++ b/pkgs/development/libraries/amdvlk/default.nix
@ -21,13 +21,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "amdvlk";
-  version = "2020.Q4.2";
+  version = "2020.Q4.3";

  src = fetchRepoProject {
    name = "${pname}-src";
    manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
    rev = "refs/tags/v-${version}";
-    sha256 = "qqP95+K8G9Z3Da1pUT9EGAUi83IM50qI9eZxpp7Vlqg=";
+    sha256 = "O1+w2R9Fvoc+1vegiCkBA9pE/yi/p0aK82fY4jML/2c=";
  };

  buildInputs = [
--- a/pkgs/development/libraries/libvirt/5.9.0.nix
+++ b/pkgs/development/libraries/libvirt/5.9.0.nix
@ -36,12 +36,12 @@ in stdenv.mkDerivation rec {
  nativeBuildInputs = [ makeWrapper pkgconfig rpcsvc-proto ];
  buildInputs = [
    libxml2 gnutls perl python2 readline gettext libtasn1 libgcrypt yajl
-    libxslt xhtml1 perlPackages.XMLXPath curl libpcap glib libtirpc
+    libxslt xhtml1 perlPackages.XMLXPath curl libpcap glib
  ] ++ optionals (!buildFromTarball) [
    libtool autoconf automake
  ] ++ optionals stdenv.isLinux [
    libpciaccess lvm2 utillinux systemd libnl numad zfs
-    libapparmor libcap_ng numactl attr parted
+    libapparmor libcap_ng numactl attr parted libtirpc
  ] ++ optionals (enableXen && stdenv.isLinux && stdenv.isx86_64) [
    xen
  ] ++ optionals enableIscsi [
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@ -40,7 +40,7 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "pipewire";
-  version = "0.3.13";
+  version = "0.3.15";

  outputs = [
    "out"
@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
    owner = "pipewire";
    repo = "pipewire";
    rev = version;
-    sha256 = "19j5kmb7iaivkq2agfzncfm2qms41ckqi0ddxvhpc91ihwprdc5w";
+    sha256 = "1lmsn13pbr0cigb5ri9nd3102ffbaf8nsz5c8aawf6lsz7mhkx9x";
  };

  patches = [
@ -65,13 +65,6 @@ stdenv.mkDerivation rec {
    ./alsa-profiles-use-libdir.patch
    # Move installed tests into their own output.
    ./installed-tests-path.patch
-
-    # TODO Remove this on next update
-    # Fixes rpath referencecs.
-    (fetchpatch {
-      url = "https://gitlab.freedesktop.org/pipewire/pipewire/commit/2e3556fa128b778be62a7ffad5fbe78393035825.diff";
-      sha256 = "039yysb8j1aiqml54rxnaqfmzqz1b6m8sv5w3vz52grvav3kyr1l";
-    })
  ];

  nativeBuildInputs = [
--- a/pkgs/development/libraries/qrupdate/default.nix
+++ b/pkgs/development/libraries/qrupdate/default.nix
@ -3,24 +3,34 @@
 , gfortran
 , blas
 , lapack
+, which
 }:
-stdenv.mkDerivation {
-  name = "qrupdate-1.1.2";
+
+stdenv.mkDerivation rec {
+  pname = "qrupdate";
+  version = "1.1.2";
  src = fetchurl {
-    url = "mirror://sourceforge/qrupdate/qrupdate-1.1.2.tar.gz";
+    url = "mirror://sourceforge/qrupdate/${pname}-${version}.tar.gz";
    sha256 = "024f601685phcm1pg8lhif3lpy5j9j0k6n0r46743g4fvh8wg8g2";
  };

-  configurePhase =
+  preBuild =
+    # Check that blas and lapack are compatible
+    assert (blas.isILP64 == lapack.isILP64);
+  # We don't have structuredAttrs yet implemented, and we need to use space
+  # seprated values in makeFlags, so only this works.
  ''
-      export PREFIX=$out
-      sed -i -e 's,^BLAS=.*,BLAS=-L${blas}/lib -lblas,' \
-          -e 's,^LAPACK=.*,LAPACK=-L${lapack}/lib -llapack,' \
-          Makeconf
-    ''
-    + stdenv.lib.optionalString blas.isILP64
-    ''
-      sed -i Makeconf -e '/^FFLAGS=.*/ s/$/-fdefault-integer-8/'
+    makeFlagsArray+=(
+      "LAPACK=-L${lapack}/lib -llapack"
+      "BLAS=-L${blas}/lib -lblas"
+      "PREFIX=${placeholder "out"}"
+      ${stdenv.lib.optionalString blas.isILP64
+      # Use their FFLAGS along with `-fdefault-integer-8`. If another
+      # application intends to use arpack, it should add this to it's FFLAGS as
+      # well. Otherwise (e.g): https://savannah.gnu.org/bugs/?50339
+      "FFLAGS=-fimplicit-none -O3 -funroll-loops -fdefault-integer-8"
+      }
+    )
  '';

  doCheck = true;
@ -31,12 +41,15 @@ stdenv.mkDerivation {

  installTargets = stdenv.lib.optionals stdenv.isDarwin [ "install-staticlib" "install-shlib" ];

-  buildInputs = [ gfortran blas lapack ];
+  buildInputs = [ gfortran ];
+
+  nativeBuildInputs = [ which ];

  meta = with stdenv.lib; {
    description = "Library for fast updating of qr and cholesky decompositions";
    homepage = "https://sourceforge.net/projects/qrupdate/";
-    license = licenses.gpl3;
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ doronbehar ];
    platforms = platforms.unix;
  };
 }
--- a/pkgs/development/libraries/science/math/petsc/default.nix
+++ b/pkgs/development/libraries/science/math/petsc/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "petsc";
-  version = "3.13.4";
+  version = "3.14.0";

  src = fetchurl {
    url = "http://ftp.mcs.anl.gov/pub/petsc/release-snapshots/petsc-${version}.tar.gz";
-    sha256 = "1n2paqw5c0ja392s1qhp7q2ypwav8s5drxxz2w5m2cn31vbspy1c";
+    sha256 = "1hq3igm90bnl44vyjdbkpqmqk7496pakcswzc2vq57l8d27nhdxz";
  };

  nativeBuildInputs = [ blas gfortran gfortran.cc.lib lapack python ];
--- a/pkgs/development/libraries/waffle/default.nix
+++ b/pkgs/development/libraries/waffle/default.nix
@ -0,0 +1,54 @@
+{ stdenv
+, fetchFromGitLab
+, lib
+, cmake
+, libGL
+, libglvnd
+, makeWrapper
+, pkg-config
+, wayland
+, libxcb
+, libX11
+}:
+
+stdenv.mkDerivation rec {
+  pname = "waffle";
+  version = "1.6.1";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.freedesktop.org";
+    owner = "mesa";
+    repo = "waffle";
+    rev = "v${version}";
+    sha256 = "0s8gislmhccfa04zsj1yqk97lscbbnmxirr2zm4q3p8ybmpfhpqr";
+  };
+
+  buildInputs = [
+    libGL
+    libglvnd
+    libX11
+    libxcb
+    wayland
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    makeWrapper
+    pkg-config
+  ];
+
+  cmakeFlags = [ "-Dplatforms=x11,wayland" ];
+
+  postInstall = ''
+    wrapProgram $out/bin/wflinfo \
+      --prefix LD_LIBRARY_PATH : ${stdenv.lib.makeLibraryPath [ libGL libglvnd ]}
+  '';
+
+  meta = with lib; {
+    description = "A cross-platform C library that allows one to defer selection of an OpenGL API and window system until runtime";
+    homepage = "http://www.waffle-gl.org/";
+    license = licenses.bsd2;
+    platforms = platforms.mesaPlatforms;
+    maintainers = with maintainers; [ Flakebi ];
+  };
+}
--- a/pkgs/development/ocaml-modules/apron/default.nix
+++ b/pkgs/development/ocaml-modules/apron/default.nix
@ -13,8 +13,21 @@ stdenv.mkDerivation rec {
  buildInputs = [ perl gmp mpfr ppl ocaml findlib camlidl ];
  propagatedBuildInputs = [ mlgmpidl ];

-  prefixKey = "-prefix ";
-  preBuild = "mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib/stublibs";
+  outputs = [ "out" "bin" "dev" ];
+
+  configurePhase = ''
+    runHook preConfigure
+    ./configure -prefix $out
+    mkdir -p $out/lib/ocaml/${ocaml.version}/site-lib/stublibs
+    runHook postConfigure
+  '';
+
+  postInstall = ''
+    mkdir -p $dev/lib
+    mv $out/lib/ocaml $dev/lib/
+    mkdir -p $bin
+    mv $out/bin $bin/
+  '';

  meta = {
    license = stdenv.lib.licenses.lgpl21;
--- a/pkgs/development/ocaml-modules/mirage-console/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-console/default.nix
@ -0,0 +1,24 @@
+{ lib, fetchurl, buildDunePackage
+, lwt, mirage-device, mirage-flow
+}:
+
+buildDunePackage rec {
+  pname = "mirage-console";
+  version = "3.0.2";
+
+  useDune2 = true;
+
+  src = fetchurl {
+    url = "https://github.com/mirage/mirage-console/releases/download/v${version}/mirage-console-v${version}.tbz";
+    sha256 = "1fygk7pvlmwx6vd0h4cv9935xxhi64k2dgym41wf6qfkxgpp31lm";
+  };
+
+  propagatedBuildInputs = [ lwt mirage-device mirage-flow ];
+
+  meta = {
+    description = "Implementations of Mirage console devices";
+    homepage = "https://github.com/mirage/mirage-console";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+}
--- a/pkgs/development/ocaml-modules/mirage-logs/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-logs/default.nix
@ -0,0 +1,28 @@
+{ lib, fetchurl, buildDunePackage
+, logs, lwt, mirage-clock, mirage-profile, ptime
+, alcotest
+}:
+
+buildDunePackage rec {
+  pname = "mirage-logs";
+  version = "1.2.0";
+
+  useDune2 = true;
+
+  src = fetchurl {
+    url = "https://github.com/mirage/mirage-logs/releases/download/v${version}/mirage-logs-v${version}.tbz";
+    sha256 = "0h0amzjxy067jljscib7fvw5q8k0adqa8m86affha9hq5jsh07a1";
+  };
+
+  propagatedBuildInputs = [ logs lwt mirage-clock mirage-profile ptime ];
+
+  doCheck = true;
+  checkInputs = [ alcotest ];
+
+  meta = {
+    description = "A reporter for the Logs library that writes log messages to stderr, using a Mirage `CLOCK` to add timestamps";
+    homepage = "https://github.com/mirage/mirage-logs";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+}
--- a/pkgs/development/ocaml-modules/owl-base/default.nix
+++ b/pkgs/development/ocaml-modules/owl-base/default.nix
@ -1,23 +1,19 @@
-{ stdenv, buildDunePackage, fetchFromGitHub, stdlib-shims }:
+{ lib, buildDunePackage, fetchurl }:

 buildDunePackage rec {
  pname = "owl-base";
-  version = "0.9.0";
+  version = "0.10.0";

  useDune2 = true;

-  src = fetchFromGitHub {
-    owner = "owlbarn";
-    repo = "owl";
-    rev  = version;
-    sha256 = "0xxchsymmdbwszs6barqq8x4vqz5hbap64yxq82c2la9sdxgk0vv";
+  src = fetchurl {
+    url = "https://github.com/owlbarn/owl/releases/download/${version}/owl-${version}.tbz";
+    sha256 = "148ny2cdzga1l36kcibvlz5xlyi5zvkywifxaqn8lf79n1swmlzf";
  };

-  propagatedBuildInputs = [ stdlib-shims ];
-
  minimumOCamlVersion = "4.10";

-  meta = with stdenv.lib; {
+  meta = with lib; {
    description = "Numerical computing library for Ocaml";
    homepage = "https://ocaml.xyz";
    changelog = "https://github.com/owlbarn/owl/releases";
--- a/pkgs/development/python-modules/crytic-compile/default.nix
+++ b/pkgs/development/python-modules/crytic-compile/default.nix
@ -0,0 +1,26 @@
+{ lib, buildPythonPackage, fetchFromGitHub, pythonOlder, pysha3 }:
+
+buildPythonPackage rec {
+  pname = "crytic-compile";
+  version = "0.1.9";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "crytic";
+    repo = "crytic-compile";
+    rev = version;
+    sha256 = "01mis7bqsh0l5vjl6jwibzy99djza35fxmywy56q8k4jbxwmdcna";
+  };
+
+  propagatedBuildInputs = [ pysha3 ];
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Abstraction layer for smart contract build systems";
+    homepage = "https://github.com/crytic/crytic-compile";
+    license = licenses.agpl3;
+    maintainers = with maintainers; [ SuperSandro2000 ];
+  };
+}
--- a/pkgs/development/python-modules/pyzmq/default.nix
+++ b/pkgs/development/python-modules/pyzmq/default.nix
@ -1,6 +1,6 @@
 { buildPythonPackage
 , fetchPypi
-, pytest
+, pytestCheckHook
 , tornado
 , zeromq
 , py
@ -16,23 +16,30 @@ buildPythonPackage rec {
    sha256 = "296540a065c8c21b26d63e3cea2d1d57902373b16e4256afe46422691903a438";
  };

-  checkInputs = [  pytest tornado ];
+  checkInputs = [
+    pytestCheckHook
+    tornado
+  ];
  buildInputs = [ zeromq ];
  propagatedBuildInputs = [ py ];

-  # test_socket.py seems to be hanging
-  # others fail
-  # for test_monitor: https://github.com/zeromq/pyzmq/issues/1272
-  checkPhase = ''
-    py.test $out/${python.sitePackages}/zmq/ -k "not test_socket \
-      and not test_current \
-      and not test_instance \
-      and not test_callable_check \
-      and not test_on_recv_basic \
-      and not test_on_recv_wake \
-      and not test_monitor \
-      and not test_cython"
-  '';
+  # failing tests
+  disabledTests = [
+    "test_socket" # hangs
+    "test_current"
+    "test_instance"
+    "test_callable_check"
+    "test_on_recv_basic"
+    "test_on_recv_wake"
+    "test_monitor" # https://github.com/zeromq/pyzmq/issues/1272
+    "test_cython"
+    "test_asyncio" # hangs
+    "test_mockable" # fails
+  ];
+
+  pytestFlagsArray = [
+    "$out/${python.sitePackages}/zmq/tests/" # Folder with tests
+  ];

  # Some of the tests use localhost networking.
  __darwinAllowLocalNetworking = true;
--- a/pkgs/development/python-modules/slither-analyzer/default.nix
+++ b/pkgs/development/python-modules/slither-analyzer/default.nix
@ -1,7 +1,5 @@
 { lib, buildPythonPackage, fetchPypi, makeWrapper, pythonOlder
-, prettytable
-, setuptools
-, solc
+, crytic-compile, prettytable, setuptools, solc
 }:

 buildPythonPackage rec {
@ -19,7 +17,7 @@ buildPythonPackage rec {
  };

  nativeBuildInputs = [ makeWrapper ];
-  propagatedBuildInputs = [ prettytable setuptools ];
+  propagatedBuildInputs = [ crytic-compile prettytable setuptools ];

  postFixup = ''
    wrapProgram $out/bin/slither \
--- a/pkgs/development/tools/rufo/Gemfile
+++ b/pkgs/development/tools/rufo/Gemfile
@ -0,0 +1,3 @@
+source 'https://rubygems.org'
+
+gem 'rufo'
--- a/pkgs/development/tools/rufo/Gemfile.lock
+++ b/pkgs/development/tools/rufo/Gemfile.lock
@ -0,0 +1,13 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    rufo (0.12.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  rufo
+
+BUNDLED WITH
+   2.1.4
--- a/pkgs/development/tools/rufo/default.nix
+++ b/pkgs/development/tools/rufo/default.nix
@ -0,0 +1,16 @@
+{ bundlerApp, bundlerUpdateScript, lib }:
+
+bundlerApp {
+  pname = "rufo";
+  gemdir = ./.;
+  exes = [ "rufo" ];
+
+  passthru.updateScript = bundlerUpdateScript "rufo";
+
+  meta = with lib; {
+    description = "Ruby formatter";
+    homepage = "https://github.com/ruby-formatter/rufo";
+    license = licenses.mit;
+    maintainers = with maintainers; [ andersk ];
+  };
+}
--- a/pkgs/development/tools/rufo/gemset.nix
+++ b/pkgs/development/tools/rufo/gemset.nix
@ -0,0 +1,12 @@
+{
+  rufo = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0nwasskcm0nrf7f52019x4fvxa5zckj4fcvf4cdl0qflrcwb1l9f";
+      type = "gem";
+    };
+    version = "0.12.0";
+  };
+}
--- a/pkgs/games/osu-lazer/default.nix
+++ b/pkgs/games/osu-lazer/default.nix
@ -13,13 +13,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "osu-lazer";
-  version = "2020.925.0";
+  version = "2020.1017.0";

  src = fetchFromGitHub {
    owner = "ppy";
    repo = "osu";
    rev = version;
-    sha256 = "0838i3pdc1c44jm7mp86kvw5164w8f3faci73bzkq84g20ixwj2g";
+    sha256 = "0sz3l8cxi9vlryjd7cb86dh3gcanim2pvhag3cg5sslqzrrinp2v";
  };

  patches = [ ./bypass-tamper-detection.patch ];
--- a/pkgs/games/osu-lazer/deps.nix
+++ b/pkgs/games/osu-lazer/deps.nix
@ -586,8 +586,8 @@
  })
  (fetchNuGet {
    name = "ppy.osu.Framework";
-    version = "2020.925.0";
-    sha256 = "1244fxm7x4rqi43kp6l98bsbjc2yvv7dmpbajdr9fapqm37fdbdj";
+    version = "2020.1009.0";
+    sha256 = "0mqx9wjp639k56f0cjlrk67mq7c4h4vlglvss93dnvbb20ljn54r";
  })
  (fetchNuGet {
    name = "ppy.osu.Framework.NativeLibs";
@ -596,8 +596,8 @@
  })
  (fetchNuGet {
    name = "ppy.osu.Game.Resources";
-    version = "2020.904.0";
-    sha256 = "0n0alpyxpf65mmnqidh044sh4nibsfj0m5n8hfmpjwq11wnpmbih";
+    version = "2020.1016.0";
+    sha256 = "1zsqmmlxbb2ncrlvha33cz0inbd6ijbcvxn0y0cysfkg7zb9iisy";
  })
  (fetchNuGet {
    name = "ppy.osuTK.NS20";
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@ -1,27 +1,27 @@
 {
    "4.14": {
-        "name": "linux-hardened-4.14.202.a.patch",
-        "sha256": "0ns5yq087m7i7ciq2b4skxclnlym0zm5v0vjqvzi9r375fd0gm9s",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.202.a/linux-hardened-4.14.202.a.patch"
+        "name": "linux-hardened-4.14.204.a.patch",
+        "sha256": "1vwja9mqycw3322p8a896l9mkxvzym6r9q17zfgwpqi3kvr9k74h",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.14.204.a/linux-hardened-4.14.204.a.patch"
    },
    "4.19": {
-        "name": "linux-hardened-4.19.152.a.patch",
-        "sha256": "0zc36yklzjb3sqd61m12c1988mazkrv242wbk7cn0a2b5sw7a373",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.152.a/linux-hardened-4.19.152.a.patch"
+        "name": "linux-hardened-4.19.155.a.patch",
+        "sha256": "0jrvd9yws7cym08j28r7wv3i83zlk5z0vl0l1mibak04h43mibgf",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/4.19.155.a/linux-hardened-4.19.155.a.patch"
    },
    "5.4": {
-        "name": "linux-hardened-5.4.72.a.patch",
-        "sha256": "1w4sfkx4qj9vx47z06bkf4biaiz58z2qp536g7dss26zdbx1im26",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.72.a/linux-hardened-5.4.72.a.patch"
+        "name": "linux-hardened-5.4.75.a.patch",
+        "sha256": "169m2a3wm5lsyzp7cp8nvxarhgcnan41ap7k5r7jx7x1frx2vzxm",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.4.75.a/linux-hardened-5.4.75.a.patch"
    },
    "5.8": {
-        "name": "linux-hardened-5.8.16.a.patch",
-        "sha256": "0b7bfzknz2am9pfypazqzky9bcd6659sakcdx2a7p1i3bj6zxnn1",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.8.16.a/linux-hardened-5.8.16.a.patch"
+        "name": "linux-hardened-5.8.18.a.patch",
+        "sha256": "1r2n74nbyi3dp5zql9sk504xkpil6ylbyd99zqqva4nd3qg17c99",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.8.18.a/linux-hardened-5.8.18.a.patch"
    },
    "5.9": {
-        "name": "linux-hardened-5.9.1.a.patch",
-        "sha256": "07897dgkldm2dxsriapjlg9b118sd32qmd1z8xja01xcgd3r6vp7",
-        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.9.1.a/linux-hardened-5.9.1.a.patch"
+        "name": "linux-hardened-5.9.6.a.patch",
+        "sha256": "1h25jkbp0yz2jfmbnwrldd1rcpag8mbf8dv6kc79j7qg1agafxkn",
+        "url": "https://github.com/anthraxx/linux-hardened/releases/download/5.9.6.a/linux-hardened-5.9.6.a.patch"
    }
 }
--- a/pkgs/os-specific/linux/kernel/linux-4.14.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.14.nix
@ -3,7 +3,7 @@
 with stdenv.lib;

 buildLinux (args // rec {
-  version = "4.14.203";
+  version = "4.14.204";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0c9r1s83mrn9lzgrr4wzvk4d72q70sbgf7lql6z9ivkf12v3p5mc";
+    sha256 = "1ncacsy2g80zigfx8nmr1f7v50s1y9ys1xy9jgizrnvmxjcji0wy";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-4.19.nix
+++ b/pkgs/os-specific/linux/kernel/linux-4.19.nix
@ -3,7 +3,7 @@
 with stdenv.lib;

 buildLinux (args // rec {
-  version = "4.19.154";
+  version = "4.19.155";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v4.x/linux-${version}.tar.xz";
-    sha256 = "0ik6anz6ly0dl0lp8m5mighlvzkifnk2kljwajxa56vbhj691339";
+    sha256 = "1lj81aadyskmxs3j4s923nhnk69dfj2kiwm0nxabbcjw83sliinb";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-5.4.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.4.nix
@ -3,7 +3,7 @@
 with stdenv.lib;

 buildLinux (args // rec {
-  version = "5.4.74";
+  version = "5.4.75";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "1drs2pngr5w3rmpydljirmibp30qb4hdrhqsi92knshlw6nz817c";
+    sha256 = "0w0lpiy56zqdm2vpx9ckxakna334n88pnqbv52zyfcslxgb6yinj";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/kernel/linux-5.9.nix
+++ b/pkgs/os-specific/linux/kernel/linux-5.9.nix
@ -3,7 +3,7 @@
 with stdenv.lib;

 buildLinux (args // rec {
-  version = "5.9.3";
+  version = "5.9.6";

  # modDirVersion needs to be x.y.z, will automatically add .0 if needed
  modDirVersion = if (modDirVersionArg == null) then concatStringsSep "." (take 3 (splitVersion "${version}.0")) else modDirVersionArg;
@ -13,6 +13,6 @@ buildLinux (args // rec {

  src = fetchurl {
    url = "mirror://kernel/linux/kernel/v5.x/linux-${version}.tar.xz";
-    sha256 = "0wwa6557i9l4vyswz26ixz8c2ykxnzqrsc9pwkr76nyjx7gjibni";
+    sha256 = "0w2kcng09nzk09dwkx4azdfgnwzbd2mz8lyl4j69bwx837z85hbc";
  };
 } // (args.argsOverride or {}))
--- a/pkgs/os-specific/linux/pam_mount/default.nix
+++ b/pkgs/os-specific/linux/pam_mount/default.nix
@ -1,37 +1,48 @@
-{ stdenv, fetchurl, autoconf, automake, pkgconfig, libtool, pam, libHX, libxml2, pcre, perl, openssl, cryptsetup, utillinux }:
+{ stdenv, fetchurl, autoreconfHook, pkgconfig, libtool, pam, libHX, libxml2, pcre, perl, openssl, cryptsetup, utillinux }:

 stdenv.mkDerivation rec {
-  name = "pam_mount-2.16";
+  pname = "pam_mount";
+  version = "2.16";

  src = fetchurl {
-    url = "mirror://sourceforge/pam-mount/pam_mount/2.16/${name}.tar.xz";
+    url = "mirror://sourceforge/pam-mount/pam_mount/${version}/${pname}-${version}.tar.xz";
    sha256 = "1rvi4irb7ylsbhvx1cr6islm2xxw1a4b19q6z4a9864ndkm0f0mf";
  };

-  nativeBuildInputs = [ pkgconfig ];
-  buildInputs = [ autoconf automake libtool pam libHX utillinux libxml2 pcre perl openssl cryptsetup ];
+  patches = [
+    ./insert_utillinux_path_hooks.patch
+    ./support_luks2.patch
+  ];

-  patches = [ ./insert_utillinux_path_hooks.patch ];
-
-  preConfigure = ''
-    substituteInPlace src/mtcrypt.c --replace @@NIX_UTILLINUX@@ ${utillinux}/bin
-    sh autogen.sh --prefix=$out
+  postPatch = ''
+    substituteInPlace src/mtcrypt.c \
+      --replace @@NIX_UTILLINUX@@ ${utillinux}/bin
  '';

-  makeFlags = [ "DESTDIR=$(out)" ];
+  nativeBuildInputs = [ autoreconfHook libtool pkgconfig ];
+
+  buildInputs = [ pam libHX utillinux libxml2 pcre perl openssl cryptsetup ];
+
+  enableParallelBuilding = true;
+
+  configureFlags = [
+    "--prefix=${placeholder "out"}"
+    "--localstatedir=${placeholder "out"}/var"
+    "--sbindir=${placeholder "out"}/bin"
+    "--sysconfdir=${placeholder "out"}/etc"
+    "--with-slibdir=${placeholder "out"}/lib"
+    "--with-ssbindir=${placeholder "out"}/bin"
+  ];

-  # Probably a hack, but using DESTDIR and PREFIX makes everything work!
  postInstall = ''
-    mkdir -p $out
-    cp -r $out/$out/* $out
-    rm -r $out/nix
+    rm -r $out/var
  '';

  meta = with stdenv.lib; {
-    homepage = "http://pam-mount.sourceforge.net/";
    description = "PAM module to mount volumes for a user session";
-    maintainers = [ maintainers.tstrobel ];
+    homepage = "https://pam-mount.sourceforge.net/";
    license = with licenses; [ gpl2 gpl3 lgpl21 lgpl3 ];
+    maintainers = with maintainers; [ tstrobel ];
    platforms = platforms.linux;
  };
 }
--- a/pkgs/os-specific/linux/pam_mount/support_luks2.patch
+++ b/pkgs/os-specific/linux/pam_mount/support_luks2.patch
@ -0,0 +1,47 @@
+commit d4434c05e7c0cf05d87089404cfa2deedc60811a
+Author: Ingo Franzki <ifranzki@linux.ibm.com>
+Date:   Mon Oct 29 16:47:40 2018 +0100
+
+    crypto: Add support for LUKS2
+    
+    Cryptsetup version 2.0 added support for LUKS2.
+    This patch adds support for mounting LUKS2 volumes with
+    pam_mount.
+    
+    Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
+
+diff --git a/src/crypto-dmc.c b/src/crypto-dmc.c
+index d0ab6ca..abd0358 100644
+--- a/src/crypto-dmc.c
+++ b/src/crypto-dmc.c
+@@ -21,6 +21,12 @@
+ #include "libcryptmount.h"
+ #include "pam_mount.h"
+ 
+#ifndef CRYPT_LUKS
+	#define CRYPT_LUKS	NULL /* Passing NULL to crypt_load will
+					default to LUKS(1) on older
+					libcryptsetup versions. */
+#endif
+
+ /**
+  * dmc_is_luks - check if @path points to a LUKS volume (cf. normal dm-crypt)
+  * @path:	path to the crypto container
+@@ -48,7 +54,7 @@ EXPORT_SYMBOL int ehd_is_luks(const char *path, bool blkdev)
+ 
+ 	ret = crypt_init(&cd, device);
+ 	if (ret == 0) {
+-		ret = crypt_load(cd, CRYPT_LUKS1, NULL);
+		ret = crypt_load(cd, CRYPT_LUKS, NULL);
+ 		if (ret == -EINVAL)
+ 			ret = false;
+ 		else if (ret == 0)
+@@ -106,7 +112,7 @@ static bool dmc_run(const struct ehd_mount_request *req,
+ #endif
+ 	}
+ 
+-	ret = crypt_load(cd, CRYPT_LUKS1, NULL);
+	ret = crypt_load(cd, CRYPT_LUKS, NULL);
+ 	if (ret == 0) {
+ 		ret = crypt_activate_by_passphrase(cd, mt->crypto_name,
+ 		      CRYPT_ANY_SLOT, req->key_data, req->key_size, flags);
--- a/pkgs/os-specific/linux/r8168/default.nix
+++ b/pkgs/os-specific/linux/r8168/default.nix
@ -6,7 +6,7 @@ let modDestDir = "$out/lib/modules/${kernel.modDirVersion}/kernel/drivers/net/wi
 in stdenv.mkDerivation rec {
  name = "r8168-${kernel.version}-${version}";
  # on update please verify that the source matches the realtek version
-  version = "8.047.04";
+  version = "8.048.03";

  # This is a mirror. The original website[1] doesn't allow non-interactive
  # downloads, instead emailing you a download link.
@ -17,7 +17,7 @@ in stdenv.mkDerivation rec {
    owner = "mtorromeo";
    repo = "r8168";
    rev = version;
-    sha256 = "1rni8jimwdhyx75603mdcylrdxgfwfpyprf1lf5x5cli2i4bbijg";
+    sha256 = "1l8llpcnapcaafxp7wlyny2ywh7k6q5zygwwjl9h0l6p04cghss4";
  };

  hardeningDisable = [ "pic" ];
@ -29,8 +29,8 @@ in stdenv.mkDerivation rec {
  # based on the ArchLinux pkgbuild: https://git.archlinux.org/svntogit/community.git/tree/trunk/PKGBUILD?h=packages/r8168
  preBuild = ''
    makeFlagsArray+=("-C${kernel.dev}/lib/modules/${kernel.modDirVersion}/build")
-    makeFlagsArray+=("SUBDIRS=$PWD/src")
-    makeFlagsArray+=("EXTRA_CFLAGS=-DCONFIG_R8168_NAPI -DCONFIG_R8168_VLAN")
+    makeFlagsArray+=("M=$PWD/src")
+    makeFlagsArray+=("EXTRA_CFLAGS=-DCONFIG_R8168_NAPI -DCONFIG_R8168_VLAN -DCONFIG_ASPM -DENABLE_S5WOL -DENABLE_EEE")
    makeFlagsArray+=("modules")
  '';

--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@ -202,9 +202,9 @@ in {
    # incompatibleKernelVersion = "4.19";

    # this package should point to a version / git revision compatible with the latest kernel release
-    version = "2.0.0-rc4";
+    version = "2.0.0-rc5";

-    sha256 = "12ydycmmzqm70p6hgmmg7q93j8n1xlkk3j56vvqh1zmazr3sr6r0";
+    sha256 = "0vnldx95c36yy18v1hfr8r4cmmh3hw4n6pwz30drkwgywakjwnsd";
    isUnstable = true;
  };
 }
--- a/pkgs/servers/keycloak/default.nix
+++ b/pkgs/servers/keycloak/default.nix
@ -18,11 +18,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname   = "keycloak";
-  version = "11.0.2";
+  version = "11.0.3";

  src = fetchzip {
    url    = "https://downloads.jboss.org/keycloak/${version}/keycloak-${version}.zip";
-    sha256 = "0ayg6cl6mff64qs36djnfs3is4x0pzhk7zwb27cbln77q3icc0j0";
+    sha256 = "15fw49rhnjky108hh71dkdlafd0ajr1n13vhivqcw6c18zvyan35";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/servers/monitoring/prometheus/default.nix
+++ b/pkgs/servers/monitoring/prometheus/default.nix
@ -1,13 +1,13 @@
 { lib, go, buildGoPackage, fetchFromGitHub, mkYarnPackage, nixosTests }:

 let
-  version = "2.20.1";
+  version = "2.22.1";

  src = fetchFromGitHub {
    rev = "v${version}";
    owner = "prometheus";
    repo = "prometheus";
-    sha256 = "0svhx08pbz55nhn6g9pn79zbhyvr394k5w3ny1mq3wp382h62r5j";
+    sha256 = "0wilx675b0a8ww7bj36hzcaip0zqzndkzan04rjsjigz5bw6kba0";
  };

  webui = mkYarnPackage {
--- a/pkgs/servers/monitoring/prometheus/webui-package.json
+++ b/pkgs/servers/monitoring/prometheus/webui-package.json
@ -8,33 +8,33 @@
    "@fortawesome/react-fontawesome": "^0.1.4",
    "@reach/router": "^1.2.1",
    "@testing-library/react-hooks": "^3.1.1",
-    "@types/jest": "^24.0.20",
-    "@types/jquery": "^3.3.29",
+    "@types/jest": "^26.0.10",
+    "@types/jquery": "^3.5.1",
    "@types/node": "^12.11.1",
    "@types/reach__router": "^1.2.6",
    "@types/react": "^16.8.2",
    "@types/react-copy-to-clipboard": "^4.3.0",
    "@types/react-dom": "^16.8.0",
-    "@types/react-resize-detector": "^4.0.2",
+    "@types/react-resize-detector": "^4.2.0",
    "@types/sanitize-html": "^1.20.2",
    "bootstrap": "^4.2.1",
    "css.escape": "^1.5.1",
-    "downshift": "^3.2.2",
+    "downshift": "^3.4.8",
    "enzyme-to-json": "^3.4.3",
    "fuzzy": "^0.1.3",
    "i": "^0.3.6",
-    "jest-fetch-mock": "^2.1.2",
-    "jquery": "^3.5",
+    "jest-fetch-mock": "^3.0.3",
+    "jquery": "^3.5.1",
    "jquery.flot.tooltip": "^0.9.0",
-    "jsdom": "^15.2.0",
+    "jsdom": "^16.4.0",
    "moment": "^2.24.0",
    "moment-timezone": "^0.5.23",
    "popper.js": "^1.14.3",
    "react": "^16.7.0",
    "react-copy-to-clipboard": "^5.0.1",
    "react-dom": "^16.7.0",
-    "react-resize-detector": "^4.2.1",
-    "react-scripts": "3.4.0",
+    "react-resize-detector": "^5.0.7",
+    "react-scripts": "3.4.3",
    "react-test-renderer": "^16.9.0",
    "reactstrap": "^8.0.1",
    "sanitize-html": "^1.20.1",
@ -68,7 +68,7 @@
    "@types/flot": "0.0.31",
    "@types/moment-timezone": "^0.5.10",
    "@types/reactstrap": "^8.0.5",
-    "@types/sinon": "^7.5.0",
+    "@types/sinon": "^9.0.4",
    "@typescript-eslint/eslint-plugin": "2.x",
    "@typescript-eslint/parser": "2.x",
    "enzyme": "^3.10.0",
@ -76,15 +76,15 @@
    "eslint": "6.x",
    "eslint-config-prettier": "^6.4.0",
    "eslint-config-react-app": "^5.0.2",
-    "eslint-plugin-flowtype": "3.x",
+    "eslint-plugin-flowtype": "4.x",
    "eslint-plugin-import": "2.x",
    "eslint-plugin-jsx-a11y": "6.x",
    "eslint-plugin-prettier": "^3.1.1",
    "eslint-plugin-react": "7.x",
-    "eslint-plugin-react-hooks": "1.x",
-    "jest-fetch-mock": "^2.1.2",
+    "eslint-plugin-react-hooks": "2.x",
+    "jest-fetch-mock": "^3.0.3",
    "prettier": "^1.18.2",
-    "sinon": "^7.5.0"
+    "sinon": "^9.0.3"
  },
  "proxy": "http://localhost:9090",
  "jest": {
--- a/pkgs/servers/monitoring/prometheus/webui-yarndeps.nix
+++ b/pkgs/servers/monitoring/prometheus/webui-yarndeps.nix
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@ -33,6 +33,8 @@ buildGoModule rec {
    wrapProgram $out/bin/tailscaled --prefix PATH : ${
      lib.makeBinPath [ iproute iptables ]
    }
+    sed -i -e "s#/usr/sbin#$out/bin#" -e "/^EnvironmentFile/d" ./cmd/tailscaled/tailscaled.service
+    install -D -m0444 -t $out/lib/systemd/system ./cmd/tailscaled/tailscaled.service
  '';

  meta = with lib; {
--- a/Show More
+++ b/Show More