Merge staging-next into staging

2024-11-19 02:44:17 +03:00 · 2021-11-03 12:01:58 +00:00 · 2021-11-03 12:01:58 +00:00 · bf39715fe0
commit bf39715fe0
parent f8a407fe23 5ddd811104
65 changed files with 996 additions and 258 deletions
--- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml
@ -100,6 +100,25 @@
          Notes</link> for details.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          LXD support was greatly improved:
+        </para>
+        <itemizedlist spacing="compact">
+          <listitem>
+            <para>
+              building LXD images from configurations is now directly
+              possible with just nixpkgs
+            </para>
+          </listitem>
+          <listitem>
+            <para>
+              hydra is now building nixOS LXD images that can be used
+              standalone with full nixos-rebuild support
+            </para>
+          </listitem>
+        </itemizedlist>
+      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="sec-release-21.11-new-services">
--- a/nixos/doc/manual/release-notes/rl-2111.section.md
+++ b/nixos/doc/manual/release-notes/rl-2111.section.md
@ -35,6 +35,10 @@ In addition to numerous new and upgraded packages, this release has the followin

 - GNOME has been upgraded to 41. Please take a look at their [Release Notes](https://help.gnome.org/misc/release-notes/41.0/) for details.

+- LXD support was greatly improved:
+  - building LXD images from configurations is now directly possible with just nixpkgs
+  - hydra is now building nixOS LXD images that can be used standalone with full nixos-rebuild support
+
 ## New Services {#sec-release-21.11-new-services}

 - [btrbk](https://digint.ch/btrbk/index.html), a backup tool for btrfs subvolumes, taking advantage of btrfs specific capabilities to create atomic snapshots and transfer them incrementally to your backup locations. Available as [services.btrbk](options.html#opt-services.brtbk.instances).
--- a/nixos/maintainers/scripts/lxd/lxd-image-inner.nix
+++ b/nixos/maintainers/scripts/lxd/lxd-image-inner.nix
@ -0,0 +1,102 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, lib, ... }:
+
+with lib;
+
+{
+  imports =
+    [ # Include the default lxd configuration.
+      ../../../modules/virtualisation/lxc-container.nix
+      # Include the container-specific autogenerated configuration.
+      ./lxd.nix
+    ];
+
+  # networking.hostName = mkForce "nixos"; # Overwrite the hostname.
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Set your time zone.
+  # time.timeZone = "Europe/Amsterdam";
+
+  # The global useDHCP flag is deprecated, therefore explicitly set to false here.
+  # Per-interface useDHCP will be mandatory in the future, so this generated config
+  # replicates the default behaviour.
+  networking.useDHCP = false;
+  networking.interfaces.eth0.useDHCP = true;
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  # i18n.defaultLocale = "en_US.UTF-8";
+  # console = {
+  #   font = "Lat2-Terminus16";
+  #   keyMap = "us";
+  # };
+
+  # Enable the X11 windowing system.
+  # services.xserver.enable = true;
+
+  # Configure keymap in X11
+  # services.xserver.layout = "us";
+  # services.xserver.xkbOptions = "eurosign:e";
+
+  # Enable CUPS to print documents.
+  # services.printing.enable = true;
+
+  # Enable sound.
+  # sound.enable = true;
+  # hardware.pulseaudio.enable = true;
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.xserver.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  # users.users.jane = {
+  #   isNormalUser = true;
+  #   extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+  # };
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  # environment.systemPackages = with pkgs; [
+  #   vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+  #   wget
+  #   firefox
+  # ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  # services.openssh.enable = true;
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "21.05"; # Did you read the comment?
+
+  # As this is intended as a stadalone image, undo some of the minimal profile stuff
+  documentation.enable = true;
+  documentation.nixos.enable = true;
+  environment.noXlibs = false;
+}
--- a/nixos/maintainers/scripts/lxd/lxd-image.nix
+++ b/nixos/maintainers/scripts/lxd/lxd-image.nix
@ -0,0 +1,34 @@
+{ lib, config, pkgs, ... }:
+
+with lib;
+
+{
+  imports = [
+    ../../../modules/virtualisation/lxc-container.nix
+  ];
+
+  virtualisation.lxc.templates.nix = {
+    enable = true;
+    target = "/etc/nixos/lxd.nix";
+    template = ./nix.tpl;
+    when = [ "create" "copy" ];
+  };
+
+  # copy the config for nixos-rebuild
+  system.activationScripts.config = ''
+    if [ ! -e /etc/nixos/configuration.nix ]; then
+      mkdir -p /etc/nixos
+      cat ${./lxd-image-inner.nix} > /etc/nixos/configuration.nix
+      sed 's|../../../modules/virtualisation/lxc-container.nix|<nixpkgs/nixos/modules/virtualisation/lxc-container.nix>|g' -i /etc/nixos/configuration.nix
+    fi
+  '';
+
+  # Network
+  networking.useDHCP = false;
+  networking.interfaces.eth0.useDHCP = true;
+
+  # As this is intended as a stadalone image, undo some of the minimal profile stuff
+  documentation.enable = true;
+  documentation.nixos.enable = true;
+  environment.noXlibs = false;
+}
--- a/nixos/maintainers/scripts/lxd/nix.tpl
+++ b/nixos/maintainers/scripts/lxd/nix.tpl
@ -0,0 +1,9 @@
+{ lib, config, pkgs, ... }:
+
+with lib;
+
+# WARNING: THIS CONFIGURATION IS AUTOGENERATED AND WILL BE OVERWRITTEN AUTOMATICALLY
+
+{
+  networking.hostName = "{{ container.name }}";
+}
--- a/nixos/modules/services/finance/odoo.nix
+++ b/nixos/modules/services/finance/odoo.nix
@ -22,14 +22,14 @@ in
        type = with types; listOf package;
        default = [];
        example = literalExpression "[ pkgs.odoo_enterprise ]";
-        description = "Odoo addons";
+        description = "Odoo addons.";
      };

      settings = mkOption {
        type = format.type;
        default = {};
        description = ''
-          Odoo configuration settings. For more details see https://www.odoo.com/documentation/15.0/administration/install/deploy.html
+          Odoo configuration settings. For more details see <link xlink:href="https://www.odoo.com/documentation/15.0/administration/install/deploy.html"/>
        '';
      };

--- a/nixos/modules/services/monitoring/unifi-poller.nix
+++ b/nixos/modules/services/monitoring/unifi-poller.nix
@ -6,7 +6,7 @@ let
  cfg = config.services.unifi-poller;

  configFile = pkgs.writeText "unifi-poller.json" (generators.toJSON {} {
-    inherit (cfg) poller influxdb prometheus unifi;
+    inherit (cfg) poller influxdb loki prometheus unifi;
  });

 in {
@ -118,6 +118,61 @@ in {
      };
    };

+    loki = {
+      url = mkOption {
+        type = types.str;
+        default = "";
+        description = ''
+          URL of the Loki host.
+        '';
+      };
+      user = mkOption {
+        type = types.str;
+        default = "";
+        description = ''
+          Username for Loki.
+        '';
+      };
+      pass = mkOption {
+        type = types.path;
+        default = pkgs.writeText "unifi-poller-loki-default.password" "";
+        defaultText = "unifi-poller-influxdb-default.password";
+        description = ''
+          Path of a file containing the password for Loki.
+          This file needs to be readable by the unifi-poller user.
+        '';
+        apply = v: "file://${v}";
+      };
+      verify_ssl = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Verify Loki's certificate.
+        '';
+      };
+      tenant_id = mkOption {
+        type = types.str;
+        default = "";
+        description = ''
+          Tenant ID to use in Loki.
+        '';
+      };
+      interval = mkOption {
+        type = types.str;
+        default = "2m";
+        description = ''
+          How often the events are polled and pushed to Loki.
+        '';
+      };
+      timeout = mkOption {
+        type = types.str;
+        default = "10s";
+        description = ''
+          Should be increased in case of timeout errors.
+        '';
+      };
+    };
+
    unifi = let
      controllerOptions = {
        user = mkOption {
@ -157,7 +212,28 @@ in {
          type = types.bool;
          default = false;
          description = ''
-            Collect and save data from the intrusion detection system to influxdb.
+            Collect and save data from the intrusion detection system to influxdb and Loki.
+          '';
+        };
+        save_events = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Collect and save data from UniFi events to influxdb and Loki.
+          '';
+        };
+        save_alarms = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Collect and save data from UniFi alarms to influxdb and Loki.
+          '';
+        };
+        save_anomalies = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Collect and save data from UniFi anomalies to influxdb and Loki.
          '';
        };
        save_dpi = mkOption {
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@ -42,7 +42,7 @@ let
      "systemd-udevd-kernel.socket"
      "systemd-udevd.service"
      "systemd-udev-settle.service"
-      "systemd-udev-trigger.service"
+      ] ++ (optional (!config.boot.isContainer) "systemd-udev-trigger.service") ++ [
      # hwdb.bin is managed by NixOS
      # "systemd-hwdb-update.service"

--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@ -561,7 +561,8 @@ in
                                  then cfgZfs.requestEncryptionCredentials
                                  else cfgZfs.requestEncryptionCredentials != []) ''
                  ${cfgZfs.package}/sbin/zfs list -rHo name,keylocation ${pool} | while IFS=$'\t' read ds kl; do
-                    (${optionalString (!isBool cfgZfs.requestEncryptionCredentials) ''
+                    {
+                      ${optionalString (!isBool cfgZfs.requestEncryptionCredentials) ''
                         if ! echo '${concatStringsSep "\n" cfgZfs.requestEncryptionCredentials}' | grep -qFx "$ds"; then
                           continue
                         fi
@ -575,7 +576,8 @@ in
                      * )
                        ${cfgZfs.package}/sbin/zfs load-key "$ds"
                        ;;
-                    esac) < /dev/null # To protect while read ds kl in case anything reads stdin
+                    esac
+                    } < /dev/null # To protect while read ds kl in case anything reads stdin
                  done
                ''}
                echo "Successfully imported ${pool}"
--- a/nixos/modules/virtualisation/lxc-container.nix
+++ b/nixos/modules/virtualisation/lxc-container.nix
@ -1,26 +1,174 @@
-{ lib, ... }:
+{ lib, config, pkgs, ... }:

 with lib;

+let
+  templateSubmodule = { ... }: {
+    options = {
+      enable = mkEnableOption "this template";
+
+      target = mkOption {
+        description = "Path in the container";
+        type = types.path;
+      };
+      template = mkOption {
+        description = ".tpl file for rendering the target";
+        type = types.path;
+      };
+      when = mkOption {
+        description = "Events which trigger a rewrite (create, copy)";
+        type = types.listOf (types.str);
+      };
+      properties = mkOption {
+        description = "Additional properties";
+        type = types.attrs;
+        default = {};
+      };
+    };
+  };
+
+  toYAML = name: data: pkgs.writeText name (generators.toYAML {} data);
+
+  cfg = config.virtualisation.lxc;
+  templates = if cfg.templates != {} then let
+    list = mapAttrsToList (name: value: { inherit name; } // value)
+      (filterAttrs (name: value: value.enable) cfg.templates);
+  in
+    {
+      files = map (tpl: {
+        source = tpl.template;
+        target = "/templates/${tpl.name}.tpl";
+      }) list;
+      properties = listToAttrs (map (tpl: nameValuePair tpl.target {
+        when = tpl.when;
+        template = "${tpl.name}.tpl";
+        properties = tpl.properties;
+      }) list);
+    }
+  else { files = []; properties = {}; };
+
+in
 {
  imports = [
-    ../profiles/docker-container.nix # FIXME, shouldn't include something from profiles/
+    ../installer/cd-dvd/channel.nix
+    ../profiles/minimal.nix
+    ../profiles/clone-config.nix
  ];

-  # Allow the user to login as root without password.
-  users.users.root.initialHashedPassword = mkOverride 150 "";
+  options = {
+    virtualisation.lxc = {
+      templates = mkOption {
+        description = "Templates for LXD";
+        type = types.attrsOf (types.submodule (templateSubmodule));
+        default = {};
+        example = literalExample ''
+          {
+            # create /etc/hostname on container creation
+            "hostname" = {
+              enable = true;
+              target = "/etc/hostname";
+              template = builtins.writeFile "hostname.tpl" "{{ container.name }}";
+              when = [ "create" ];
+            };
+            # create /etc/nixos/hostname.nix with a configuration for keeping the hostname applied
+            "hostname-nix" = {
+              enable = true;
+              target = "/etc/nixos/hostname.nix";
+              template = builtins.writeFile "hostname-nix.tpl" "{ ... }: { networking.hostName = "{{ container.name }}"; }";
+              # copy keeps the file updated when the container is changed
+              when = [ "create" "copy" ];
+            };
+            # copy allow the user to specify a custom configuration.nix
+            "configuration-nix" = {
+              enable = true;
+              target = "/etc/nixos/configuration.nix";
+              template = builtins.writeFile "configuration-nix" "{{ config_get(\"user.user-data\", properties.default) }}";
+              when = [ "create" ];
+            };
+          };
+        '';
+      };
+    };
+  };

-  # Some more help text.
-  services.getty.helpLine =
-    ''
+  config = {
+    boot.isContainer = true;
+    boot.postBootCommands =
+      ''
+        # After booting, register the contents of the Nix store in the Nix
+        # database.
+        if [ -f /nix-path-registration ]; then
+          ${config.nix.package.out}/bin/nix-store --load-db < /nix-path-registration &&
+          rm /nix-path-registration
+        fi

-      Log in as "root" with an empty password.
+        # nixos-rebuild also requires a "system" profile
+        ${config.nix.package.out}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system
+      '';
+
+    system.build.metadata = pkgs.callPackage ../../lib/make-system-tarball.nix {
+      contents = [
+        {
+          source = toYAML "metadata.yaml" {
+            architecture = builtins.elemAt (builtins.match "^([a-z0-9_]+).+" (toString pkgs.system)) 0;
+            creation_date = 1;
+            properties = {
+              description = "NixOS ${config.system.nixos.codeName} ${config.system.nixos.label} ${pkgs.system}";
+              os = "nixos";
+              release = "${config.system.nixos.codeName}";
+            };
+            templates = templates.properties;
+          };
+          target = "/metadata.yaml";
+        }
+      ] ++ templates.files;
+    };
+
+    # TODO: build rootfs as squashfs for faster unpack
+    system.build.tarball = pkgs.callPackage ../../lib/make-system-tarball.nix {
+      extraArgs = "--owner=0";
+
+      storeContents = [
+        {
+          object = config.system.build.toplevel;
+          symlink = "none";
+        }
+      ];
+
+      contents = [
+        {
+          source = config.system.build.toplevel + "/init";
+          target = "/sbin/init";
+        }
+      ];
+
+      extraCommands = "mkdir -p proc sys dev";
+    };
+
+    # Add the overrides from lxd distrobuilder
+    systemd.extraConfig = ''
+      [Service]
+      ProtectProc=default
+      ProtectControlGroups=no
+      ProtectKernelTunables=no
    '';

-  # Containers should be light-weight, so start sshd on demand.
-  services.openssh.enable = mkDefault true;
-  services.openssh.startWhenNeeded = mkDefault true;
+    # Allow the user to login as root without password.
+    users.users.root.initialHashedPassword = mkOverride 150 "";

-  # Allow ssh connections
-  networking.firewall.allowedTCPPorts = [ 22 ];
+    system.activationScripts.installInitScript = mkForce ''
+      ln -fs $systemConfig/init /sbin/init
+    '';
+
+    # Some more help text.
+    services.getty.helpLine =
+      ''
+
+        Log in as "root" with an empty password.
+      '';
+
+    # Containers should be light-weight, so start sshd on demand.
+    services.openssh.enable = mkDefault true;
+    services.openssh.startWhenNeeded = mkDefault true;
+  };
 }
--- a/nixos/modules/virtualisation/lxd.nix
+++ b/nixos/modules/virtualisation/lxd.nix
@ -34,7 +34,7 @@ in {

      package = mkOption {
        type = types.package;
-        default = pkgs.lxd.override { nftablesSupport = config.networking.nftables.enable; };
+        default = pkgs.lxd;
        defaultText = literalExpression "pkgs.lxd";
        description = ''
          The LXD package to use.
--- a/nixos/release.nix
+++ b/nixos/release.nix
@ -251,6 +251,37 @@ in rec {

  );

+  # An image that can be imported into lxd and used for container creation
+  lxdImage = forMatchingSystems [ "x86_64-linux" "aarch64-linux" ] (system:
+
+    with import ./.. { inherit system; };
+
+    hydraJob ((import lib/eval-config.nix {
+      inherit system;
+      modules =
+        [ configuration
+          versionModule
+          ./maintainers/scripts/lxd/lxd-image.nix
+        ];
+    }).config.system.build.tarball)
+
+  );
+
+  # Metadata for the lxd image
+  lxdMeta = forMatchingSystems [ "x86_64-linux" "aarch64-linux" ] (system:
+
+    with import ./.. { inherit system; };
+
+    hydraJob ((import lib/eval-config.nix {
+      inherit system;
+      modules =
+        [ configuration
+          versionModule
+          ./maintainers/scripts/lxd/lxd-image.nix
+        ];
+    }).config.system.build.metadata)
+
+  );

  # Ensure that all packages used by the minimal NixOS config end up in the channel.
  dummy = forAllSystems (system: pkgs.runCommand "dummy"
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -237,6 +237,7 @@ in
  login = handleTest ./login.nix {};
  loki = handleTest ./loki.nix {};
  lxd = handleTest ./lxd.nix {};
+  lxd-image = handleTest ./lxd-image.nix {};
  lxd-nftables = handleTest ./lxd-nftables.nix {};
  #logstash = handleTest ./logstash.nix {};
  lorri = handleTest ./lorri/default.nix {};
--- a/nixos/tests/lxd-image.nix
+++ b/nixos/tests/lxd-image.nix
@ -0,0 +1,91 @@
+# This test ensures that the nixOS lxd images builds and functions properly
+# It has been extracted from `lxd.nix` to seperate failures of just the image and the lxd software
+
+import ./make-test-python.nix ({ pkgs, ...} : let
+  release = import ../release.nix {
+    /* configuration = {
+      environment.systemPackages = with pkgs; [ stdenv ]; # inject stdenv so rebuild test works
+    }; */
+  };
+
+  metadata = release.lxdMeta.${pkgs.system};
+  image = release.lxdImage.${pkgs.system};
+
+  lxd-config = pkgs.writeText "config.yaml" ''
+    storage_pools:
+      - name: default
+        driver: dir
+        config:
+          source: /var/lxd-pool
+
+    networks:
+      - name: lxdbr0
+        type: bridge
+        config:
+          ipv4.address: auto
+          ipv6.address: none
+
+    profiles:
+      - name: default
+        devices:
+          eth0:
+            name: eth0
+            network: lxdbr0
+            type: nic
+          root:
+            path: /
+            pool: default
+            type: disk
+  '';
+in {
+  name = "lxd-image";
+
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ mkg20001 ];
+  };
+
+  machine = { lib, ... }: {
+    virtualisation = {
+      # OOMs otherwise
+      memorySize = 1024;
+      # disk full otherwise
+      diskSize = 2048;
+
+      lxc.lxcfs.enable = true;
+      lxd.enable = true;
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("sockets.target")
+    machine.wait_for_unit("lxd.service")
+    machine.wait_for_file("/var/lib/lxd/unix.socket")
+
+    # It takes additional second for lxd to settle
+    machine.sleep(1)
+
+    # lxd expects the pool's directory to already exist
+    machine.succeed("mkdir /var/lxd-pool")
+
+    machine.succeed(
+        "cat ${lxd-config} | lxd init --preseed"
+    )
+
+    # TODO: test custom built container aswell
+
+    with subtest("importing container works"):
+        machine.succeed("lxc image import ${metadata}/*/*.tar.xz ${image}/*/*.tar.xz --alias nixos")
+
+    with subtest("launching container works"):
+        machine.succeed("lxc launch nixos machine -c security.nesting=true")
+        # make sure machine boots up properly
+        machine.sleep(5)
+
+    with subtest("container shell works"):
+        machine.succeed("echo true | lxc exec machine /run/current-system/sw/bin/bash -")
+        machine.succeed("lxc exec machine /run/current-system/sw/bin/true")
+
+    # with subtest("rebuilding works"):
+    #     machine.succeed("lxc exec machine /run/current-system/sw/bin/nixos-rebuild switch")
+  '';
+})
--- a/pkgs/applications/finance/odoo/default.nix
+++ b/pkgs/applications/finance/odoo/default.nix
@ -3,19 +3,12 @@
 , fetchurl
 , python3
 , python3Packages
+, nodePackages
 , wkhtmltopdf
 }:

 with python3Packages;

-/*
-
-TODO:
-  For languages with right-to-left interface (such as Arabic or Hebrew), the package rtlcss is needed:
-  $ sudo npm install -g rtlcss
-
-*/
-
 buildPythonApplication rec {
  pname = "odoo";

@ -40,12 +33,13 @@ buildPythonApplication rec {

  buildInputs = [
    wkhtmltopdf
+    nodePackages.rtlcss
  ];

  # needs some investigation
  doCheck = false;

-  makeWrapperArgs = [ "--prefix" "PATH" ":" "${wkhtmltopdf}/bin" ];
+  makeWrapperArgs = [ "--prefix" "PATH" ":" "${lib.makeBinPath [ wkhtmltopdf nodePackages.rtlcss ]}" ];

  propagatedBuildInputs = [
    Babel
--- a/pkgs/applications/graphics/graphicsmagick/default.nix
+++ b/pkgs/applications/graphics/graphicsmagick/default.nix
@ -45,5 +45,6 @@ stdenv.mkDerivation rec {
    description = "Swiss army knife of image processing";
    license = lib.licenses.mit;
    platforms = lib.platforms.all;
+    mainProgram = "gm";
  };
 }
--- a/pkgs/applications/misc/barrier/default.nix
+++ b/pkgs/applications/misc/barrier/default.nix
@ -5,13 +5,13 @@

 mkDerivation rec {
  pname = "barrier";
-  version = "2.3.3";
+  version = "2.4.0";

  src = fetchFromGitHub {
    owner = "debauchee";
    repo = pname;
    rev = "v${version}";
-    sha256 = "11vqkzpcjiv3pq6ps022223j6skgm1d23dj18n4a5nsf53wsvvp4";
+    sha256 = "sha256-2tHqLF3zS3C4UnOVIZfpcuzaemC9++nC7lXgFnFSfKU=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/misc/seatd/default.nix
+++ b/pkgs/applications/misc/seatd/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "seatd";
-  version = "0.6.2";
+  version = "0.6.3";

  src = fetchFromSourcehut {
    owner = "~kennylevinsen";
    repo = "seatd";
    rev = version;
-    sha256 = "0c07i1nq0k60xmcsnr37ryqs7nzbg4qfq6fzbnzwbh1yhr8kypcm";
+    sha256 = "sha256-LLRGi3IACqaIHExLhALnUeiPyUnlhAJzsMFE2p+QSp4=";
  };

  outputs = [ "bin" "out" "dev" "man" ];
--- a/pkgs/applications/networking/cluster/k0sctl/default.nix
+++ b/pkgs/applications/networking/cluster/k0sctl/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "k0sctl";
-  version = "0.10.4";
+  version = "0.11.4";

  src = fetchFromGitHub {
    owner = "k0sproject";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-22jZWRnymIYN1LlGOo8abVx8DTUe9VK1xAHddLknt6A=";
+    sha256 = "sha256-Fk1aYSa3LqzxiHtlzH5pcNtodOprjfnCFh4UMqCa6Rc=";
  };

  vendorSha256 = "sha256-N4cU9wzBRZn71mZHkNDXKgSXvlN2QFS6K4MtlR25DJc=";
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@ -21,13 +21,13 @@

 stdenv.mkDerivation rec {
  pname = "kubernetes";
-  version = "1.22.2";
+  version = "1.22.3";

  src = fetchFromGitHub {
    owner = "kubernetes";
    repo = "kubernetes";
    rev = "v${version}";
-    sha256 = "sha256-O+FY9wJ0fztO7i5qJfw+cfhfBgaMWKX7IBBXJV4uuCk=";
+    sha256 = "sha256-yXis1nq36MO/RnYLxOYBs6xnaTf9lk+VJBzSamrHcEU=";
  };

  nativeBuildInputs = [ removeReferencesTo makeWrapper which go rsync installShellFiles ];
--- a/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-cli/default.nix
@ -2,12 +2,12 @@

 stdenv.mkDerivation rec {
  pname = "signal-cli";
-  version = "0.9.0";
+  version = "0.9.2";

  # Building from source would be preferred, but is much more involved.
  src = fetchurl {
    url = "https://github.com/AsamK/signal-cli/releases/download/v${version}/signal-cli-${version}.tar.gz";
-    sha256 = "sha256-wk8kk+PG0nw2OE7mccGjP435SEytStRy1unxg6EqP/8=";
+    sha256 = "sha256-CumrIlOPmvQ3x7Ua5I2G7ZlTSAbhLgAQMPUg4I5WCeQ=";
  };

  buildInputs = lib.optionals stdenv.isLinux [ libmatthew_java dbus dbus_java ];
--- a/pkgs/applications/networking/sync/rclone/default.nix
+++ b/pkgs/applications/networking/sync/rclone/default.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "rclone";
-  version = "1.56.2";
+  version = "1.57.0";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-cEh1SgIOgX04ECEF0K2pvwJdugapoUzh8xbboRaMdTs=";
+    sha256 = "0pwbprbkx5y0c93b61k8znan4aimk7dkssapjhkhzw4c38xd4lza";
  };

-  vendorSha256 = "sha256-wQYVn8yGDIYlnlVTS7tiLEMwkNLF6p3OcY35nw1mvA8=";
+  vendorSha256 = "0353pff07lwpa1jmi095kb2izcw09z73x6nninnnpyqppwzas6ha";

  subPackages = [ "." ];

--- a/pkgs/applications/radio/sdrangel/default.nix
+++ b/pkgs/applications/radio/sdrangel/default.nix
@ -33,13 +33,13 @@

 mkDerivation rec {
  pname = "sdrangel";
-  version = "6.17.1";
+  version = "6.17.2";

  src = fetchFromGitHub {
    owner = "f4exb";
    repo = "sdrangel";
    rev = "v${version}";
-    sha256 = "sha256-VWHFrgJVyI3CtLXUiG3/4/cRTD8jSdunbrro34yLKvs=";
+    sha256 = "sha256-sMD2JTJJlssMdXCUHdFYjEqGknhGGuG4szfnvFFN7t4=";
    fetchSubmodules = false;
  };

--- a/pkgs/applications/science/biology/obitools/obitools3.nix
+++ b/pkgs/applications/science/biology/obitools/obitools3.nix
@ -1,10 +1,6 @@
-{ lib, fetchurl, python3Packages, cmake, python3 }:
+{ stdenv, lib, fetchurl, python3Packages, cmake, python3 }:

-let
-  pythonPackages = python3Packages;
-in
-
-pythonPackages.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
  pname = "obitools3";
  version = "3.0.1b11";

@ -13,15 +9,20 @@ pythonPackages.buildPythonApplication rec {
    sha256 = "1x7a0nrr9agg1pfgq8i1j8r1p6c0jpyxsv196ylix1dd2iivmas1";
  };

+  disabled = python3Packages.pythonOlder "3.5";
+
+  nativeBuildInputs = [ python3Packages.cython cmake ];
+
+  postPatch = lib.optionalString stdenv.isAarch64 ''
+      substituteInPlace setup.py \
+      --replace "'-msse2'," ""
+  '';
+
  preBuild = ''
    substituteInPlace src/CMakeLists.txt --replace \$'{PYTHONLIB}' "$out/lib/${python3.libPrefix}/site-packages";
    export NIX_CFLAGS_COMPILE="-L $out/lib/${python3.libPrefix}/site-packages $NIX_CFLAGS_COMPILE"
  '';

-  disabled = !pythonPackages.isPy3k;
-
-  nativeBuildInputs = [ pythonPackages.cython cmake ];
-
  dontConfigure = true;

  doCheck = true;
--- a/pkgs/applications/system/pantheon-tweaks/default.nix
+++ b/pkgs/applications/system/pantheon-tweaks/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "pantheon-tweaks";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "pantheon-tweaks";
    repo = pname;
    rev = version;
-    sha256 = "sha256-tAfDxX/RD7pO5PN/LaZ92Cj/iZtBI/EHb0+pORfYnPM=";
+    sha256 = "sha256-2spZ6RQ5PhBNrv/xG1TNbYsJrmuRpaZ72CeH2s8+P8g=";
  };

  patches = [
@ -38,9 +38,12 @@ stdenv.mkDerivation rec {
  buildInputs = [
    gtk3
    libgee
-    pantheon.granite
-    pantheon.switchboard
-  ];
+  ] ++ (with pantheon; [
+    elementary-files # settings schemas
+    elementary-terminal # settings schemas
+    granite
+    switchboard
+  ]);

  postPatch = ''
    chmod +x meson/post_install.py
--- a/pkgs/applications/version-management/git-and-tools/stgit/default.nix
+++ b/pkgs/applications/version-management/git-and-tools/stgit/default.nix
@ -12,13 +12,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "stgit";
-  version = "1.3";
+  version = "1.4";

  src = fetchFromGitHub {
    owner = "stacked-git";
    repo = "stgit";
    rev = "v${version}";
-    sha256 = "0wa3ba7afnbb1h08n9xr0cqsg93rx0qd9jv8a34mmpp0lpijmjw6";
+    sha256 = "0yx81d61kp33h7n0c14wvcrh8vvjjjq4xjh1qwq2sdbmqc43p3hg";
  };

  nativeBuildInputs = [ installShellFiles asciidoc xmlto docbook_xsl docbook_xml_dtd_45 ];
--- a/pkgs/applications/version-management/mercurial/default.nix
+++ b/pkgs/applications/version-management/mercurial/default.nix
@ -13,11 +13,11 @@ let

  self = python3Packages.buildPythonApplication rec {
    pname = "mercurial";
-    version = "5.9.1";
+    version = "5.9.3";

    src = fetchurl {
      url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      sha256 = "09wzyhyajy1dbp5kxkmvs9x8jk964wri19p5jgf83mv27i1zkvrj";
+      sha256 = "sha256-O0P2iXetD6dap/HlyPCoO6k1YhqyOWEpq7SY5W0b4I4=";
    };

    format = "other";
@ -27,7 +27,7 @@ let
    cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
      inherit src;
      name = "${pname}-${version}";
-      sha256 = "1f7q0kmp46rphw38rlzh1yvpn3rdjdnzzbxzjkrjks8n1gm8baca";
+      sha256 = "sha256:1d911jaawdrcv2mdhlp2ylr10791zj7dhb69aiw5yy7vn7gry82n";
      sourceRoot = "${pname}-${version}/rust";
    } else null;
    cargoRoot = if rustSupport then "rust" else null;
--- a/pkgs/applications/virtualization/catatonit/default.nix
+++ b/pkgs/applications/virtualization/catatonit/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "catatonit";
-  version = "0.1.6";
+  version = "0.1.7";

  src = fetchFromGitHub {
    owner = "openSUSE";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-hokG6o7toZxU984EvIlne33Aa2EZVZ3qu1jTZMm5nt4=";
+    sha256 = "sha256-jX4fYC/rpfd3ro2UZ6OEu4kU5wpusOwmEVPWEjxwlW4=";
  };

  nativeBuildInputs = [ autoreconfHook ];
--- a/pkgs/applications/window-managers/river/default.nix
+++ b/pkgs/applications/window-managers/river/default.nix
@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "river";
-  version = "unstable-2021-11-01";
+  version = "0.1.0";

  src = fetchFromGitHub {
    owner = "ifreund";
    repo = pname;
-    rev = "363fd3f6a466004eec157a40e51684e56992b857";
-    sha256 = "sha256-RzReUo1p2z4UQaO5n6PKQlEv0vTBGg+1Wq1UIYii0Mo=";
+    rev = "v${version}";
+    sha256 = "03pdgrcpj8db9s14249815z76dyjwwma8xv6p9hpw79flk6rk7v7";
    fetchSubmodules = true;
  };

@ -34,7 +34,6 @@ stdenv.mkDerivation rec {
  buildInputs = [
    wayland-protocols
    wlroots
-    pixman
    libxkbcommon
    pixman
    udev
--- a/pkgs/data/documentation/execline-man-pages/default.nix
+++ b/pkgs/data/documentation/execline-man-pages/default.nix
@ -2,8 +2,8 @@

 buildManPages {
  pname = "execline-man-pages";
-  version = "2.8.1.0.2";
-  sha256 = "1fl3pyjh9328l1h2b6s08j048jl4pfyyc24mjs45qx545kcp65q4";
+  version = "2.8.1.0.3";
+  sha256 = "1n7c75lmyrjzzcbwjl6fxhfs4k29qlr66r1q35799h942cn4li7v";
  description = "Port of the documentation for the execline suite to mdoc";
  maintainers = [ lib.maintainers.sternenseemann ];
 }
--- a/pkgs/data/fonts/public-sans/default.nix
+++ b/pkgs/data/fonts/public-sans/default.nix
@ -1,7 +1,7 @@
 { lib, fetchzip }:

 let
-  version = "1.008";
+  version = "2.000";
 in fetchzip {
  name = "public-sans-${version}";

@ -9,14 +9,11 @@ in fetchzip {

  postFetch = ''
    mkdir -p $out/share/fonts
-    unzip -j $downloadedFile binaries/otf/\*.otf -d $out/share/fonts/opentype
-    unzip -j $downloadedFile binaries/variable/\*.ttf -d $out/share/fonts/truetype
-    unzip -j $downloadedFile binaries/webfonts/\*.ttf -d $out/share/fonts/truetype
-    unzip -j $downloadedFile binaries/webfonts/\*.woff -d $out/share/fonts/woff
-    unzip -j $downloadedFile binaries/webfonts/\*.woff2 -d $out/share/fonts/woff2
+    unzip -j $downloadedFile \*.otf -d $out/share/fonts/opentype
+    unzip -j $downloadedFile \*.ttf -d $out/share/fonts/truetype
  '';

-  sha256 = "1s4xmliri3r1gcn1ws3wa6davj6giliqjdbcv0bh9ryg3dfpjz74";
+  sha256 = "0r34h9mim5c3h48cpq2m2ixkdqhv3i594pip10pavkmskldpbha5";

  meta = with lib; {
    description = "A strong, neutral, principles-driven, open source typeface for text or display";
--- a/pkgs/development/libraries/libpg_query/default.nix
+++ b/pkgs/development/libraries/libpg_query/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "libpg_query";
-  version = "13-2.0.7";
+  version = "13-2.1.0";

  src = fetchFromGitHub {
    owner = "pganalyze";
    repo = "libpg_query";
    rev = version;
-    sha256 = "sha256-xplp7Z17NlYbXIbBdN7EWDN4numdZUBIIVg5EowFMPA=";
+    sha256 = "sha256-DpvPmBvpx5pWDlx6T3Kp82ALi6FjOO549Exd8tWXDIk=";
  };

  nativeBuildInputs = [ which ];
--- a/pkgs/development/libraries/libqalculate/default.nix
+++ b/pkgs/development/libraries/libqalculate/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "libqalculate";
-  version = "3.20.1";
+  version = "3.21.0";

  src = fetchFromGitHub {
    owner = "qalculate";
    repo = "libqalculate";
    rev = "v${version}";
-    sha256 = "sha256-8SYI8CoeTfZXX0CgLnfl0rHwUZbYM7OGYzFQ41jm5Qs=";
+    sha256 = "sha256-aKNoLkqpnC+jOvqs7S7SYBu+5VZ+hHHzBkwccg+kYMQ=";
  };

  outputs = [ "out" "dev" "doc" ];
--- a/pkgs/development/libraries/libsixel/default.nix
+++ b/pkgs/development/libraries/libsixel/default.nix
@ -3,33 +3,24 @@
 , fetchFromGitHub
 , meson
 , ninja
-, libbsd
 , gdk-pixbuf
 , gd
 , libjpeg
 , pkg-config
-, fetchpatch
 }:
 stdenv.mkDerivation rec {
  pname = "libsixel";
-  version = "1.10.1";
+  version = "1.10.3";

  src = fetchFromGitHub {
    owner = "libsixel";
    repo = "libsixel";
    rev = "v${version}";
-    sha256 = "sha256-ACypJTFjXSzBjo4hQzUiJOqnaRaZnYX+/NublN9sbBo=";
+    sha256 = "1nny4295ipy4ajcxmmh04c796hcds0y7z7rv3qd17mj70y8j0r2d";
  };

-  patches = [
-    (fetchpatch {
-      url = "https://github.com/libsixel/libsixel/commit/4d3e53ee007f3b71f638875f9fabbba658b2ca8a.patch";
-      sha256 = "sha256-iDfsTyUczjtzV3pt1ZErbhVO2rMm2ZYKWSBl+ru+5HA=";
-    })
-  ];
-
  buildInputs = [
-    libbsd gdk-pixbuf gd
+    gdk-pixbuf gd
  ];

  nativeBuildInputs = [
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@ -79,6 +79,7 @@
 , "code-theme-converter"
 , "coffee-script"
 , "coinmon"
+, "concurrently"
 , "configurable-http-proxy"
 , "conventional-changelog-cli"
 , "cordova"
@ -177,6 +178,7 @@
 , "lua-fmt"
 , "madoko"
 , "markdownlint-cli"
+, "markdownlint-cli2"
 , "markdown-link-check"
 , {"markdown-preview-nvim": "../../misc/vim-plugins/markdown-preview-nvim"}
 , "mastodon-bot"
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@ -9832,13 +9832,13 @@ let
        sha512 = "2PK+p6dRFuQQM8F4JbBivGetnJxvb8ggQkY7XLeCSl4qVkBeBjX+mRtsiudk28NUTH3JEll7AgmKj2fHfxYpGQ==";
      };
    };
-    "apollo-graphql-0.9.4" = {
+    "apollo-graphql-0.9.5" = {
      name = "apollo-graphql";
      packageName = "apollo-graphql";
-      version = "0.9.4";
+      version = "0.9.5";
      src = fetchurl {
-        url = "https://registry.npmjs.org/apollo-graphql/-/apollo-graphql-0.9.4.tgz";
-        sha512 = "0X2sZxfmn7lJrRknUPBG+L0LP1B0SKX1qtULIWrDbIpyl9LuSyjnDaGtmvc4IQtyKvmQXtAhEHBnprRokkjkyw==";
+        url = "https://registry.npmjs.org/apollo-graphql/-/apollo-graphql-0.9.5.tgz";
+        sha512 = "RGt5k2JeBqrmnwRM0VOgWFiGKlGJMfmiif/4JvdaEqhMJ+xqe/9cfDYzXfn33ke2eWixsAbjEbRfy8XbaN9nTw==";
      };
    };
    "apollo-link-1.2.1" = {
@ -14999,13 +14999,13 @@ let
        sha512 = "bsTwuIg/BZZK/vreVTYYbSWoe2F+71P7K5QGEX+pT250DZbfU1MQ5prOKpPR+LL6uWKK3KMwMCAS74QB3Um1uw==";
      };
    };
-    "caniuse-lite-1.0.30001274" = {
+    "caniuse-lite-1.0.30001275" = {
      name = "caniuse-lite";
      packageName = "caniuse-lite";
-      version = "1.0.30001274";
+      version = "1.0.30001275";
      src = fetchurl {
-        url = "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001274.tgz";
-        sha512 = "+Nkvv0fHyhISkiMIjnyjmf5YJcQ1IQHZN6U9TLUMroWR38FNwpsC51Gb68yueafX1V6ifOisInSgP9WJFS13ew==";
+        url = "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001275.tgz";
+        sha512 = "ihJVvj8RX0kn9GgP43HKhb5q9s2XQn4nEQhdldEJvZhCsuiB2XOq6fAMYQZaN6FPWfsr2qU0cdL0CSbETwbJAg==";
      };
    };
    "canvas-2.8.0" = {
@ -15161,22 +15161,22 @@ let
        sha512 = "vlNK021QdI7PNeiUh/lKkC/mNHHfV0m/Ad5JoI0TYtlBnJAslM/JIkm/tGC88bkLIwO6OQ5uV6ztS6kVAtCDlg==";
      };
    };
-    "cdk8s-1.1.21" = {
+    "cdk8s-1.1.22" = {
      name = "cdk8s";
      packageName = "cdk8s";
-      version = "1.1.21";
+      version = "1.1.22";
      src = fetchurl {
-        url = "https://registry.npmjs.org/cdk8s/-/cdk8s-1.1.21.tgz";
-        sha512 = "jgPspKVy08Tccc2MioscI0aKU3JmlHlKiYTETvDYtONoitRW76ylK5Im+mX/Zy0nCF0Kwuxs6383RYKjwPaecQ==";
+        url = "https://registry.npmjs.org/cdk8s/-/cdk8s-1.1.22.tgz";
+        sha512 = "Mzhm2kj+z93QrSTH6yzq4M9tDXVsqM5HXnXKaLoDisDcRwjiF3rrqqRHoNhDUKX0wtoYWKy3+o3fyCkzEhVejQ==";
      };
    };
-    "cdk8s-plus-22-1.0.0-beta.28" = {
+    "cdk8s-plus-22-1.0.0-beta.29" = {
      name = "cdk8s-plus-22";
      packageName = "cdk8s-plus-22";
-      version = "1.0.0-beta.28";
+      version = "1.0.0-beta.29";
      src = fetchurl {
-        url = "https://registry.npmjs.org/cdk8s-plus-22/-/cdk8s-plus-22-1.0.0-beta.28.tgz";
-        sha512 = "14QKJGI1PTtf9l5n+r03pDLPerxlS49xGPz2nerGIczUpfFVed5PdoeXWtWRDWjfBjPN2IcGPCy/8gdsmDTVEg==";
+        url = "https://registry.npmjs.org/cdk8s-plus-22/-/cdk8s-plus-22-1.0.0-beta.29.tgz";
+        sha512 = "FgucgLJJujYWYa9KhpSAapCbGn+cpXUyd7n4wZI6vKsai0Pq2fYTid/9iYKOoDbM+Hq4W81T0ythQlVx+HqUeg==";
      };
    };
    "cdktf-0.7.0" = {
@ -34724,13 +34724,13 @@ let
        sha512 = "F7GLNdoHBAYN4eqw7c6Tv12lqGOoMazsjuXDJRubjjbbwZ0tM6a78rHhrZwE4w1XV7mIkTxKmkj4DnbSIPW8wg==";
      };
    };
-    "jsii-srcmak-0.1.386" = {
+    "jsii-srcmak-0.1.387" = {
      name = "jsii-srcmak";
      packageName = "jsii-srcmak";
-      version = "0.1.386";
+      version = "0.1.387";
      src = fetchurl {
-        url = "https://registry.npmjs.org/jsii-srcmak/-/jsii-srcmak-0.1.386.tgz";
-        sha512 = "cKGLruiv9J6dB8g2PEem2OQtpxG4HsUU5rhaon9J4H58rVaPIEskXVpeUn3/9DJ8hLQSMCV0QUM7JtzG/SeOyg==";
+        url = "https://registry.npmjs.org/jsii-srcmak/-/jsii-srcmak-0.1.387.tgz";
+        sha512 = "c9KlJZRHlBBZa8v46Hw/fMZBrjXyiVQvnRe8//6T8lkBC2gUAys0j3su2pxiIiuX/FxT1r5Zae+oc5VdTGNVlQ==";
      };
    };
    "json-bigint-1.0.0" = {
@ -39198,6 +39198,15 @@ let
        sha512 = "OJIGsGFV/rC9irI5E1FMy6v9hdACSwaa+EN3224Y5KG8zj2EYzdHOw0pOJovIYmjNfEZ9BtxUY4P7uYHTSNnbQ==";
      };
    };
+    "markdownlint-cli2-formatter-default-0.0.2" = {
+      name = "markdownlint-cli2-formatter-default";
+      packageName = "markdownlint-cli2-formatter-default";
+      version = "0.0.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/markdownlint-cli2-formatter-default/-/markdownlint-cli2-formatter-default-0.0.2.tgz";
+        sha512 = "jIz1X3SIC8sX4NDFqQFUXL+JEtfnDoN4i+xocEu+etcxGX455pHb6sx86f/yVk4mKJ2o7aNe2ydSx9an22BfBg==";
+      };
+    };
    "markdownlint-rule-helpers-0.15.0" = {
      name = "markdownlint-rule-helpers";
      packageName = "markdownlint-rule-helpers";
@ -57004,6 +57013,15 @@ let
        sha1 = "ff4ae6e68656056ba4b3e792ab3334d38273ca11";
      };
    };
+    "spawn-command-0.0.2" = {
+      name = "spawn-command";
+      packageName = "spawn-command";
+      version = "0.0.2";
+      src = fetchurl {
+        url = "https://registry.npmjs.org/spawn-command/-/spawn-command-0.0.2.tgz";
+        sha1 = "9544e1a43ca045f8531aac1a48cb29bdae62338e";
+      };
+    };
    "spawn-please-1.0.0" = {
      name = "spawn-please";
      packageName = "spawn-please";
@ -57760,13 +57778,13 @@ let
        sha512 = "zZ/Q1M+9ZWlrchgh4QauD/MEUFa6eC6H6FYq6T8Of/y82JqsQBLwN6YlzbO09evE7Rx6x0oliXDCnQSjwGwQRA==";
      };
    };
-    "sscaff-1.2.115" = {
+    "sscaff-1.2.116" = {
      name = "sscaff";
      packageName = "sscaff";
-      version = "1.2.115";
+      version = "1.2.116";
      src = fetchurl {
-        url = "https://registry.npmjs.org/sscaff/-/sscaff-1.2.115.tgz";
-        sha512 = "bEjTWtrXR+fOgJ9Oak+zP4DXUBWl3GmZ03QVLkL+/LC8SkfC+1p/+wcMWo2fij9HVTXlhsEgDnDyL7x0BFXf4A==";
+        url = "https://registry.npmjs.org/sscaff/-/sscaff-1.2.116.tgz";
+        sha512 = "ecCtXu5ZXFn4VjrDLTWGIOo/2E8qqso1H5JmwV3eLiuYtl+KUi9DtpwkPqi0tqzXnT48dSUkkaH5s92CW+Q3bw==";
      };
    };
    "ssh-config-1.1.6" = {
@ -71283,7 +71301,7 @@ in
      sources."buffer-5.7.1"
      sources."buffer-from-1.1.2"
      sources."callsites-3.1.0"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
      sources."chalk-3.0.0"
      sources."chardet-0.7.0"
      sources."chokidar-3.5.2"
@ -71817,7 +71835,7 @@ in
      sources."ansi-styles-3.2.1"
      sources."apollo-cache-control-0.14.0"
      sources."apollo-datasource-0.9.0"
-      sources."apollo-graphql-0.9.4"
+      sources."apollo-graphql-0.9.5"
      sources."apollo-link-1.2.14"
      sources."apollo-reporting-protobuf-0.8.0"
      (sources."apollo-server-caching-0.7.0" // {
@ -71919,7 +71937,7 @@ in
      sources."call-bind-1.0.2"
      sources."call-me-maybe-1.0.1"
      sources."camelcase-5.3.1"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
      sources."caseless-0.12.0"
      sources."caw-2.0.1"
      sources."chalk-2.4.2"
@ -73061,7 +73079,7 @@ in
      sources."balanced-match-1.0.2"
      sources."brace-expansion-1.1.11"
      sources."browserslist-4.17.6"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
      sources."chalk-2.4.2"
      sources."color-convert-1.9.3"
      sources."color-name-1.1.3"
@ -73201,7 +73219,7 @@ in
    };
    dependencies = [
      sources."browserslist-4.17.6"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
      sources."electron-to-chromium-1.3.887"
      sources."escalade-3.1.1"
      sources."fraction.js-4.1.1"
@ -76588,8 +76606,8 @@ in
      sources."call-bind-1.0.2"
      sources."camelcase-6.2.0"
      sources."case-1.6.3"
-      sources."cdk8s-1.1.21"
-      sources."cdk8s-plus-22-1.0.0-beta.28"
+      sources."cdk8s-1.1.22"
+      sources."cdk8s-plus-22-1.0.0-beta.29"
      sources."chalk-4.1.2"
      sources."cliui-7.0.4"
      sources."clone-2.1.2"
@ -76682,7 +76700,7 @@ in
          sources."yargs-16.2.0"
        ];
      })
-      (sources."jsii-srcmak-0.1.386" // {
+      (sources."jsii-srcmak-0.1.387" // {
        dependencies = [
          sources."fs-extra-9.1.0"
        ];
@ -76727,7 +76745,7 @@ in
      sources."snake-case-3.0.4"
      sources."sort-json-2.0.0"
      sources."spdx-license-list-6.4.0"
-      sources."sscaff-1.2.115"
+      sources."sscaff-1.2.116"
      (sources."streamroller-2.2.4" // {
        dependencies = [
          sources."date-format-2.1.0"
@ -76917,7 +76935,7 @@ in
        ];
      })
      sources."apollo-datasource-3.2.0"
-      sources."apollo-graphql-0.9.4"
+      sources."apollo-graphql-0.9.5"
      sources."apollo-reporting-protobuf-3.1.0"
      sources."apollo-server-caching-3.2.0"
      (sources."apollo-server-core-3.4.0" // {
@ -77369,7 +77387,7 @@ in
      sources."sort-json-2.0.0"
      sources."source-map-0.5.7"
      sources."spdx-license-list-6.4.0"
-      sources."sscaff-1.2.115"
+      sources."sscaff-1.2.116"
      (sources."stack-utils-2.0.5" // {
        dependencies = [
          sources."escape-string-regexp-2.0.0"
@ -78390,7 +78408,7 @@ in
      sources."callsites-3.1.0"
      sources."camelcase-2.1.1"
      sources."camelcase-keys-2.1.0"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
      sources."capture-stack-trace-1.0.1"
      sources."ccount-1.1.0"
      (sources."chalk-4.1.2" // {
@ -79503,7 +79521,7 @@ in
      sources."callsites-3.1.0"
      sources."camelcase-5.3.1"
      sources."camelcase-keys-6.2.2"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
      (sources."chalk-4.1.2" // {
        dependencies = [
          sources."ansi-styles-4.3.0"
@ -80496,6 +80514,55 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
+  concurrently = nodeEnv.buildNodePackage {
+    name = "concurrently";
+    packageName = "concurrently";
+    version = "6.3.0";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/concurrently/-/concurrently-6.3.0.tgz";
+      sha512 = "k4k1jQGHHKsfbqzkUszVf29qECBrkvBKkcPJEUDTyVR7tZd1G/JOfnst4g1sYbFvJ4UjHZisj1aWQR8yLKpGPw==";
+    };
+    dependencies = [
+      sources."ansi-regex-5.0.1"
+      sources."ansi-styles-4.3.0"
+      (sources."chalk-4.1.2" // {
+        dependencies = [
+          sources."supports-color-7.2.0"
+        ];
+      })
+      sources."cliui-7.0.4"
+      sources."color-convert-2.0.1"
+      sources."color-name-1.1.4"
+      sources."date-fns-2.25.0"
+      sources."emoji-regex-8.0.0"
+      sources."escalade-3.1.1"
+      sources."get-caller-file-2.0.5"
+      sources."has-flag-4.0.0"
+      sources."is-fullwidth-code-point-3.0.0"
+      sources."lodash-4.17.21"
+      sources."require-directory-2.1.1"
+      sources."rxjs-6.6.7"
+      sources."spawn-command-0.0.2"
+      sources."string-width-4.2.3"
+      sources."strip-ansi-6.0.1"
+      sources."supports-color-8.1.1"
+      sources."tree-kill-1.2.2"
+      sources."tslib-1.14.1"
+      sources."wrap-ansi-7.0.0"
+      sources."y18n-5.0.8"
+      sources."yargs-16.2.0"
+      sources."yargs-parser-20.2.9"
+    ];
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "Run commands concurrently";
+      homepage = "https://github.com/open-cli-tools/concurrently#readme";
+      license = "MIT";
+    };
+    production = true;
+    bypassCache = true;
+    reconstructLock = true;
+  };
  configurable-http-proxy = nodeEnv.buildNodePackage {
    name = "configurable-http-proxy";
    packageName = "configurable-http-proxy";
@ -82949,7 +83016,7 @@ in
        ];
      })
      sources."call-bind-1.0.2"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
      sources."chalk-2.4.2"
      sources."chokidar-2.1.8"
      (sources."class-utils-0.3.6" // {
@ -84469,7 +84536,7 @@ in
      sources."callsites-2.0.0"
      sources."camelcase-5.3.1"
      sources."camelcase-keys-6.2.2"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
      sources."chalk-2.4.2"
      sources."ci-info-2.0.0"
      sources."cli-boxes-2.2.1"
@ -87103,7 +87170,7 @@ in
      })
      sources."camelcase-6.2.0"
      sources."caniuse-api-3.0.0"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
      sources."caseless-0.12.0"
      (sources."chalk-4.1.2" // {
        dependencies = [
@ -89023,7 +89090,7 @@ in
      sources."callsites-2.0.0"
      sources."camelcase-5.3.1"
      sources."camelcase-keys-6.2.2"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
      sources."chalk-2.4.2"
      sources."chownr-1.1.4"
      sources."ci-info-2.0.0"
@ -91971,7 +92038,7 @@ in
      sources."call-bind-1.0.2"
      sources."camel-case-4.1.2"
      sources."camelcase-6.2.0"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
      sources."ccount-1.1.0"
      (sources."chalk-4.1.2" // {
        dependencies = [
@ -99421,7 +99488,7 @@ in
      sources."bytes-3.1.0"
      sources."bytesish-0.4.4"
      sources."call-bind-1.0.2"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
      sources."caseless-0.12.0"
      sources."chalk-2.4.2"
      sources."chardet-1.4.0"
@ -102323,7 +102390,7 @@ in
      sources."cached-path-relative-1.0.2"
      sources."call-bind-1.0.2"
      sources."camelcase-5.3.1"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
      sources."capture-exit-2.0.0"
      sources."caseless-0.12.0"
      (sources."chalk-3.0.0" // {
@ -103285,6 +103352,61 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
+  markdownlint-cli2 = nodeEnv.buildNodePackage {
+    name = "markdownlint-cli2";
+    packageName = "markdownlint-cli2";
+    version = "0.3.2";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/markdownlint-cli2/-/markdownlint-cli2-0.3.2.tgz";
+      sha512 = "Wj4iQy2J49m9CVkWkLTdFxMTPDqD3AyL3NbLQgz/nUnTu8LnDguFCbQtFhdzQPvncHVjrKT2vYqg7DifzVP4tA==";
+    };
+    dependencies = [
+      sources."@nodelib/fs.scandir-2.1.5"
+      sources."@nodelib/fs.stat-2.0.5"
+      sources."@nodelib/fs.walk-1.2.8"
+      sources."argparse-2.0.1"
+      sources."array-union-2.1.0"
+      sources."braces-3.0.2"
+      sources."dir-glob-3.0.1"
+      sources."entities-2.1.0"
+      sources."fast-glob-3.2.7"
+      sources."fastq-1.13.0"
+      sources."fill-range-7.0.1"
+      sources."glob-parent-5.1.2"
+      sources."globby-11.0.4"
+      sources."ignore-5.1.8"
+      sources."is-extglob-2.1.1"
+      sources."is-glob-4.0.3"
+      sources."is-number-7.0.0"
+      sources."linkify-it-3.0.3"
+      sources."markdown-it-12.2.0"
+      sources."markdownlint-0.24.0"
+      sources."markdownlint-cli2-formatter-default-0.0.2"
+      sources."markdownlint-rule-helpers-0.15.0"
+      sources."mdurl-1.0.1"
+      sources."merge2-1.4.1"
+      sources."micromatch-4.0.4"
+      sources."path-type-4.0.0"
+      sources."picomatch-2.3.0"
+      sources."queue-microtask-1.2.3"
+      sources."reusify-1.0.4"
+      sources."run-parallel-1.2.0"
+      sources."slash-3.0.0"
+      sources."strip-json-comments-3.1.1"
+      sources."to-regex-range-5.0.1"
+      sources."uc.micro-1.0.6"
+      sources."yaml-1.10.2"
+    ];
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "A fast, flexible, configuration-based command-line interface for linting Markdown/CommonMark files with the `markdownlint` library";
+      homepage = "https://github.com/DavidAnson/markdownlint-cli2";
+      license = "MIT";
+    };
+    production = true;
+    bypassCache = true;
+    reconstructLock = true;
+  };
  markdown-link-check = nodeEnv.buildNodePackage {
    name = "markdown-link-check";
    packageName = "markdown-link-check";
@ -106999,7 +107121,7 @@ in
      sources."caller-path-2.0.0"
      sources."callsites-2.0.0"
      sources."caniuse-api-3.0.0"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
      sources."caseless-0.12.0"
      sources."chalk-2.4.2"
      sources."chokidar-2.1.8"
@ -110785,7 +110907,7 @@ in
      sources."camel-case-3.0.0"
      sources."camelcase-5.3.1"
      sources."caniuse-api-3.0.0"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
      sources."case-sensitive-paths-webpack-plugin-2.4.0"
      sources."caw-2.0.1"
      sources."chalk-2.4.2"
@ -113339,6 +113461,37 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
+  rtlcss = nodeEnv.buildNodePackage {
+    name = "rtlcss";
+    packageName = "rtlcss";
+    version = "3.5.0";
+    src = fetchurl {
+      url = "https://registry.npmjs.org/rtlcss/-/rtlcss-3.5.0.tgz";
+      sha512 = "wzgMaMFHQTnyi9YOwsx9LjOxYXJPzS8sYnFaKm6R5ysvTkwzHiB0vxnbHwchHQT65PTdBjDG21/kQBWI7q9O7A==";
+    };
+    dependencies = [
+      sources."find-up-5.0.0"
+      sources."locate-path-6.0.0"
+      sources."nanoid-3.1.30"
+      sources."p-limit-3.1.0"
+      sources."p-locate-5.0.0"
+      sources."path-exists-4.0.0"
+      sources."picocolors-1.0.0"
+      sources."postcss-8.3.11"
+      sources."source-map-js-0.6.2"
+      sources."strip-json-comments-3.1.1"
+      sources."yocto-queue-0.1.0"
+    ];
+    buildInputs = globalBuildInputs;
+    meta = {
+      description = "Framework for transforming cascading style sheets (CSS) from left-to-right (LTR) to right-to-left (RTL)";
+      homepage = "https://rtlcss.com/";
+      license = "MIT";
+    };
+    production = true;
+    bypassCache = true;
+    reconstructLock = true;
+  };
  s3http = nodeEnv.buildNodePackage {
    name = "s3http";
    packageName = "s3http";
@ -121847,7 +122000,7 @@ in
      sources."buffer-from-1.1.2"
      sources."call-bind-1.0.2"
      sources."camelcase-6.2.0"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
      (sources."chalk-4.1.2" // {
        dependencies = [
          sources."supports-color-7.2.0"
@ -124227,7 +124380,7 @@ in
      sources."ajv-keywords-3.5.2"
      sources."browserslist-4.17.6"
      sources."buffer-from-1.1.2"
-      sources."caniuse-lite-1.0.30001274"
+      sources."caniuse-lite-1.0.30001275"
      sources."chrome-trace-event-1.0.3"
      sources."commander-2.20.3"
      sources."electron-to-chromium-1.3.887"
--- a/pkgs/development/python-modules/lightgbm/default.nix
+++ b/pkgs/development/python-modules/lightgbm/default.nix
@ -10,11 +10,11 @@

 buildPythonPackage rec {
  pname = "lightgbm";
-  version = "3.3.0";
+  version = "3.3.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "107ae7babbbda2c2f0e07484f0c53cdeb455e9219235f79dc4e1685d7541e505";
+    sha256 = "5b9f31759ab4e94d9409deb03104c55b0a40058a6ccea804022046d926bc4904";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/stashy/default.nix
+++ b/pkgs/development/python-modules/stashy/default.nix
@ -0,0 +1,31 @@
+{ lib
+, buildPythonPackage
+, decorator
+, fetchPypi
+, pythonOlder
+, requests
+ }:
+
+buildPythonPackage rec {
+  pname = "stashy";
+  version = "0.7";
+  disabled = pythonOlder "3.4";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1x89zazwxnsx6rdfw8nfr372hj4sk8nrcs5hsjxpcxcva0calrcr";
+  };
+
+  propagatedBuildInputs = [ decorator requests ];
+
+  # Tests require internet connection
+  doCheck = false;
+  pythonImportsCheck = [ "stashy" ];
+
+  meta = with lib; {
+    description = "Python client for the Atlassian Bitbucket Server (formerly known as Stash) REST API.";
+    homepage = "https://github.com/cosmin/stashy";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ mupdt ];
+  };
+}
--- a/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
+++ b/pkgs/development/tools/analysis/cargo-tarpaulin/default.nix
@ -2,13 +2,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-tarpaulin";
-  version = "0.18.2";
+  version = "0.18.3";

  src = fetchFromGitHub {
    owner = "xd009642";
    repo = "tarpaulin";
    rev = version;
-    sha256 = "sha256-3ep90G6LW83XGyS9b465u8/SznJRZBhEV/YQU8fua1s=";
+    sha256 = "sha256-n43n9rmLWmGF7JXz/jspT6Stn0fQnkbkxqbuqXiZLHA=";
  };

  nativeBuildInputs = [
@ -17,7 +17,7 @@ rustPlatform.buildRustPackage rec {
  buildInputs = [ openssl ]
    ++ lib.optionals stdenv.isDarwin [ curl Security ];

-  cargoSha256 = "sha256-UtFGuJ6HEUtonH43iuum1hrhnYesQpkyqPTVcqWAoiA=";
+  cargoSha256 = "sha256-dJey7z0gRUu5MRKOfR909eQNTt3zpZnoWYvRhHzZlGs=";
  #checkFlags = [ "--test-threads" "1" ];
  doCheck = false;

--- a/pkgs/development/tools/analysis/tflint/default.nix
+++ b/pkgs/development/tools/analysis/tflint/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "tflint";
-  version = "0.33.0";
+  version = "0.33.1";

  src = fetchFromGitHub {
    owner = "terraform-linters";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1cq84ggp32xx79sgrxyqysqs34lhzyv8jdg7d46d9hdvjcwjb5af";
+    sha256 = "1n1xw2h544r6bap2drgrip9i8nl5zg5gcdic8qj3y93ppisgzqml";
  };

-  vendorSha256 = "1ay3vf4dqlbizq98nxz2cgi67ck1c6lw7wi28w56607qzbx0yvmg";
+  vendorSha256 = "0fq4nbd0w1nb98g321mns76a60dwwhf4w7g589qz87z29vdy0jbk";

  doCheck = false;

--- a/pkgs/development/tools/azcopy/default.nix
+++ b/pkgs/development/tools/azcopy/default.nix
@ -2,18 +2,18 @@

 buildGoModule rec {
  pname = "azure-storage-azcopy";
-  version = "10.12.2";
+  version = "10.13.0";

  src = fetchFromGitHub {
    owner = "Azure";
    repo = "azure-storage-azcopy";
    rev = "v${version}";
-    sha256 = "sha256-NmWCaTmQlCAKaVDumDlubHQhUjhY7uYawkjrP2ggczk=";
+    sha256 = "sha256-L5gfS2hwk1uaWEygn+liupdANL9qizHAjxNz25KBwaY=";
  };

  subPackages = [ "." ];

-  vendorSha256 = "sha256-4Jz57VjdQX+LJexEZau4pd8nIQPt0HGzCjHRj7uPox4=";
+  vendorSha256 = "sha256-ePEpc18Y99Moe/aj8n1+no6D70vZoIEjC023Uup98Uo=";

  doCheck = false;

--- a/pkgs/development/tools/bazel-gazelle/default.nix
+++ b/pkgs/development/tools/bazel-gazelle/default.nix
@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "bazel-gazelle";
-  version = "0.21.1";
+  version = "0.24.0";

  src = fetchFromGitHub {
    owner = "bazelbuild";
    repo = pname;
    rev = "v${version}";
-    sha256 = "12ffrildgx4lah7bdnhr7i8z5jp05lll6gmmpzshmzz8dsgf39y4";
+    sha256 = "sha256-WWAOhV1H/OnARjhoWQYNmd9/y8pD3bRkhncmzt/36mA=";
  };

  vendorSha256 = null;
--- a/pkgs/development/tools/continuous-integration/github-runner/default.nix
+++ b/pkgs/development/tools/continuous-integration/github-runner/default.nix
@ -37,13 +37,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "github-runner";
-  version = "2.283.3";
+  version = "2.284.0";

  src = fetchFromGitHub {
    owner = "actions";
    repo = "runner";
    rev = "v${version}";
-    sha256 = "sha256-B2dn3AIGk+xMFqRsKv4pvlZ6K4xySsS0klk8vN8giso=";
+    sha256 = "sha256-JR0OzbT5gGhO/dxb/eSjP/d/VxW/aLmTs/oPwN8b8Rc=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/tools/krew/default.nix
+++ b/pkgs/development/tools/krew/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "krew";
-  version = "0.4.1";
+  version = "0.4.2";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "krew";
    rev = "v${version}";
-    sha256 = "sha256-+YwBkXrj5sWlMA01GfBhu12st+es5YygkD16jc+blt8=";
+    sha256 = "sha256-P4b8HMkqxzYKz9OgI4pNCjR9Wakh+kIIAnUAkayzGEo=";
  };

-  vendorSha256 = "sha256-49kWaU5dYqd86DvHi3mh5jYUQVmFlI8zsWtAFseYriE=";
+  vendorSha256 = "sha256-FQQCHq9f0yY8vSsvWIR7WKq+0c+dgGEnoQmXtoN6Ep0=";

  subPackages = [ "cmd/krew" ];

--- a/pkgs/development/tools/lazygit/default.nix
+++ b/pkgs/development/tools/lazygit/default.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "lazygit";
-  version = "0.29";
+  version = "0.30.1";

  src = fetchFromGitHub {
    owner = "jesseduffield";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-rw03K21Ay/+XKs06cUBybXLp8Rxrlz8T8YKrSGroyDU=";
+    sha256 = "sha256-8oyUI8jqJOJT1bZE25HlFA39gs3dcZbTL/vrL40K1IM=";
  };

  vendorSha256 = null;
--- a/pkgs/development/tools/misc/saleae-logic-2/default.nix
+++ b/pkgs/development/tools/misc/saleae-logic-2/default.nix
@ -1,10 +1,10 @@
 { lib, fetchurl, makeDesktopItem, appimageTools, gtk3 }:
 let
  name = "saleae-logic-2";
-  version = "2.3.38";
+  version = "2.3.39";
  src = fetchurl {
    url = "https://downloads.saleae.com/logic2/Logic-${version}-master.AppImage";
-    sha256 = "0y3ys3q6gd9fxgaf36q5av0kgvy7jv5anyjxb4cva8d95l4k3ask";
+    sha256 = "1p31i8xillc5vrl2nli74b7p7cv2yz2qafp2gnyjfn0nbx5ij52g";
  };
  desktopItem = makeDesktopItem {
    inherit name;
--- a/pkgs/development/tools/skaffold/default.nix
+++ b/pkgs/development/tools/skaffold/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "skaffold";
-  version = "1.32.0";
+  version = "1.34.0";

  src = fetchFromGitHub {
    owner = "GoogleContainerTools";
    repo = "skaffold";
    rev = "v${version}";
-    sha256 = "sha256-LvTAM3uYzSEhX7zz7Z+VcMYV5p80EnyaEIu0CmAUaSg=";
+    sha256 = "sha256-y9y1aUy2fDvMuYCKU2g2lBSmX53NDy9v0XImHXqdJqM=";
  };

-  vendorSha256 = "sha256-TUpHg4yvZ0WKcUFXjWh4Q4/gRtJ93xNa/gLkj5PYo/w=";
+  vendorSha256 = "sha256-h5UybTcvr9Zxpfw7zBCeSAG2oAZzFWpuYugqXUCMtjs=";

  subPackages = ["cmd/skaffold"];

--- a/pkgs/misc/emulators/citra/default.nix
+++ b/pkgs/misc/emulators/citra/default.nix
@ -1,27 +1,76 @@
-{ mkDerivation, lib, fetchgit, cmake, SDL2, qtbase, qtmultimedia, boost
-, wrapQtAppsHook }:
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, wrapQtAppsHook
+, SDL2
+, qtbase
+, qtmultimedia
+, boost17x
+, libpulseaudio
+, pkg-config
+, libusb1
+, zstd
+, libressl
+, alsa-lib
+, rapidjson
+, aacHleDecoding ? true
+, fdk_aac
+, ffmpeg-full
+}:

-mkDerivation {
+stdenv.mkDerivation {
  pname = "citra";
  version = "2021-11-01";

-  # Submodules
-  src = fetchgit {
-    url = "https://github.com/citra-emu/citra";
+  src = fetchFromGitHub {
+    owner = "citra-emu";
+    repo = "citra";
    rev = "5a7d80172dd115ad9bc6e8e85cee6ed9511c48d0";
    sha256 = "sha256-vy2JMizBsnRK9NBEZ1dxT7fP/HFhOZSsC+5P+Dzi27s=";
+    fetchSubmodules = true;
  };

-  nativeBuildInputs = [ cmake wrapQtAppsHook ];
-  buildInputs = [ SDL2 qtbase qtmultimedia boost ];
+  nativeBuildInputs = [ cmake wrapQtAppsHook pkg-config ];
+  buildInputs = [
+    SDL2
+    qtbase
+    qtmultimedia
+    libpulseaudio
+    boost17x
+    libusb1
+    alsa-lib
+    rapidjson # for discord-rpc
+  ] ++ lib.optional aacHleDecoding [ fdk_aac ffmpeg-full ];
+
+  cmakeFlags = [
+    "-DUSE_SYSTEM_BOOST=ON"
+    "-DUSE_DISCORD_PRESENCE=ON"
+  ] ++ lib.optionals aacHleDecoding [
+    "-DENABLE_FFMPEG_AUDIO_DECODER=ON"
+    "-DCITRA_USE_BUNDLED_FFMPEG=OFF"
+  ];
+
+  postPatch = ''
+    # we already know the submodules are present
+    substituteInPlace CMakeLists.txt \
+      --replace "check_submodules_present()" ""

-  preConfigure = ''
    # Trick configure system.
    sed -n 's,^ *path = \(.*\),\1,p' .gitmodules | while read path; do
-      mkdir "$path/.git"
+    mkdir "$path/.git"
    done
+
+    rm -rf externals/zstd externals/libressl
+    cp -r ${zstd.src} externals/zstd
+    tar xf ${libressl.src} -C externals/
+    mv externals/${libressl.name} externals/libressl
+    chmod -R a+w externals/zstd
  '';

+  # Todo: cubeb audio backend (the default one) doesn't work on the SDL interface.
+  # Note that the two interfaces have two separate configuration files.
+
  meta = with lib; {
    homepage = "https://citra-emu.org";
    description = "An open-source emulator for the Nintendo 3DS";
--- a/pkgs/os-specific/linux/bridge-utils/add-ip6-header.patch
+++ b/pkgs/os-specific/linux/bridge-utils/add-ip6-header.patch
@ -1,11 +0,0 @@
-diff --git a/libbridge/libbridge.h b/libbridge/libbridge.h
-index 39964f2..dd14bae 100644
--- a/libbridge/libbridge.h
-+++ b/libbridge/libbridge.h
-@@ -20,6 +20,7 @@
- #define _LIBBRIDGE_H
-
- #include <sys/socket.h>
-+#include <netinet/in.h>
- #include <linux/if.h>
- #include <linux/if_bridge.h>
--- a/pkgs/os-specific/linux/bridge-utils/autoconf-ar.patch
+++ b/pkgs/os-specific/linux/bridge-utils/autoconf-ar.patch
@ -1,7 +1,5 @@
-diff --git a/configure.in b/configure.in
-index 5e3f89b..19be6d9 100644
--- a/configure.in
-+++ b/configure.in
+--- a/configure.ac
+++ b/configure.ac
@@ -9,6 +9,7 @@ dnl Checks for programs.
 AC_PROG_CC
 AC_PROG_INSTALL
@ -10,8 +8,6 @@ index 5e3f89b..19be6d9 100644
 
 dnl Checks for header files.
 AC_HEADER_STDC
-diff --git a/libbridge/Makefile.in b/libbridge/Makefile.in
-index 20512c4..83c802b 100644
 --- a/libbridge/Makefile.in
 +++ b/libbridge/Makefile.in
@@ -1,7 +1,7 @@
--- a/pkgs/os-specific/linux/bridge-utils/default.nix
+++ b/pkgs/os-specific/linux/bridge-utils/default.nix
@ -2,29 +2,19 @@

 stdenv.mkDerivation rec {
  pname = "bridge-utils";
-  version = "1.5";
+  version = "1.7.1";

  src = fetchurl {
-    url = "mirror://sourceforge/bridge/bridge-utils-${version}.tar.gz";
-    sha256 = "42f9e5fb8f6c52e63a98a43b81bd281c227c529f194913e1c51ec48a393b6688";
+    url = "https://kernel.org/pub/linux/utils/net/bridge-utils/bridge-utils-${version}.tar.xz";
+    sha256 = "sha256-ph2L5PGhQFxgyO841UTwwYwFszubB+W0sxAzU2Fl5g4=";
  };

-  patches = [
-    ./autoconf-ar.patch
-    ./add-ip6-header.patch # Remove patch once the kernel headers are updated
-  ];
+  patches = [ ./autoconf-ar.patch ];

  nativeBuildInputs = [ autoreconfHook ];

-  postInstall = ''
-    # The bridge utils build does not fail even if the brctl binary
-    # is not build. This test ensures that we fail if we don't produce a brctl
-    # binary.
-    test -f $out/sbin/brctl
-  '';
-
  meta = {
-    description = "https://sourceforge.net/projects/bridge/";
+    description = "An userspace tool to configure linux bridges (deprecated in favour or iproute2).";
    homepage = "https://wiki.linuxfoundation.org/networking/bridge";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.linux;
--- a/pkgs/os-specific/linux/iotop-c/default.nix
+++ b/pkgs/os-specific/linux/iotop-c/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "iotop-c";
-  version = "1.19";
+  version = "1.20";

  src = fetchFromGitHub {
    owner = "Tomas-M";
    repo = "iotop";
    rev = "v${version}";
-    sha256 = "sha256-CuZwOIhjl6fpEvfw/4CTjKQkxazLL/NGujmNcx1Jrbc=";
+    sha256 = "sha256-6Pg2CLWzsD6EPRKD2xMMgKFkpbSheiMMkd0BvHh9onA=";
  };

  nativeBuildInputs = [ pkg-config ];
--- a/pkgs/shells/zsh/spaceship-prompt/default.nix
+++ b/pkgs/shells/zsh/spaceship-prompt/default.nix
@ -2,13 +2,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "spaceship-prompt";
-  version = "3.14.1";
+  version = "3.15.0";

  src = fetchFromGitHub {
    owner = "denysdovhan";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-/Q2vsCIDsHUSBavJoHX3L0NQ7REoQmaiRgHVGiLtNPE=";
+    sha256 = "sha256-/9c4o9tdXtDefZ1fA62Y9Sg2cv54YVZGlZ1n6EfQWC4=";
  };

  dontBuild = true;
--- a/pkgs/tools/admin/exoscale-cli/default.nix
+++ b/pkgs/tools/admin/exoscale-cli/default.nix
@ -2,13 +2,13 @@

 buildGoPackage rec {
  pname = "exoscale-cli";
-  version = "1.45.2";
+  version = "1.46.0";

  src = fetchFromGitHub {
    owner  = "exoscale";
    repo   = "cli";
    rev    = "v${version}";
-    sha256 = "sha256-bzm8UNFWAXHBdarovNMyARW2xA4tSXIgIHpxROx4nOI=";
+    sha256 = "sha256-dWbuzzFCBJuSUUQFXY3axK+T9rsMaIMOCKa0ig96bJE=";
  };

  goPackagePath = "github.com/exoscale/cli";
--- a/pkgs/tools/admin/stripe-cli/default.nix
+++ b/pkgs/tools/admin/stripe-cli/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "stripe-cli";
-  version = "1.7.3";
+  version = "1.7.4";

  src = fetchFromGitHub {
    owner = "stripe";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Hlh2nfqQD+HMoJ2n1vfffn5ieEKSMtXpdoM0ydFQqrc=";
+    sha256 = "sha256-2wiry3bBrxrhyyPT/81VpAS34XBZgZsz8Wlq8Qeybgk=";
  };

-  vendorSha256 = "sha256-DTNwgerJ7qZxH4imdrST7TaR20oevDluEDgAlubg5hw=";
+  vendorSha256 = "sha256-Lgd1vGXlZw0s4dVC0TlGEYoGOLrJPc/bZ75Mzke4rrg=";

  subPackages = [
    "cmd/stripe"
--- a/pkgs/tools/package-management/cargo-edit/default.nix
+++ b/pkgs/tools/package-management/cargo-edit/default.nix
@ -1,26 +1,26 @@
-{ stdenv
-, lib
+{ lib
 , rustPlatform
 , fetchFromGitHub
 , pkg-config
 , openssl
+, zlib
+, stdenv
 , libiconv
 , Security
-, zlib
 }:

 rustPlatform.buildRustPackage rec {
  pname = "cargo-edit";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "killercup";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256:0fh1lq793k4ddpqsf2av447hcb74vcq53afkm3g4672k48mjjw1y";
+    hash = "sha256-n9Ei1kpbDqOogNJJVvg9DRAPMVGNChCGGiuCVsuK3/8=";
  };

-  cargoSha256 = "0ah3zjx36ibax4gi66g13finh4m2k0aidxkg2nxx1c2aqj847mm1";
+  cargoSha256 = "sha256-6546jD+zDoScrJmpw5xtNdWeIPJ9Ma0bcIdnI1kFmu8=";

  nativeBuildInputs = [ pkg-config ];

@ -34,7 +34,8 @@ rustPlatform.buildRustPackage rec {
  meta = with lib; {
    description = "A utility for managing cargo dependencies from the command line";
    homepage = "https://github.com/killercup/cargo-edit";
+    changelog = "https://github.com/killercup/cargo-edit/blob/v${version}/CHANGELOG.md";
    license = with licenses; [ asl20 /* or */ mit ];
-    maintainers = with maintainers; [ gerschtli jb55 Br1ght0ne killercup ];
+    maintainers = with maintainers; [ Br1ght0ne figsoda gerschtli jb55 killercup ];
  };
 }
--- a/pkgs/tools/security/keybase/default.nix
+++ b/pkgs/tools/security/keybase/default.nix
@ -6,7 +6,7 @@

 buildGoPackage rec {
  pname = "keybase";
-  version = "5.7.1";
+  version = "5.8.1";

  goPackagePath = "github.com/keybase/client";
  subPackages = [ "go/kbnm" "go/keybase" ];
@ -17,7 +17,7 @@ buildGoPackage rec {
    owner = "keybase";
    repo = "client";
    rev = "v${version}";
-    sha256 = "sha256-72rVk8pYIQFESQqBu4bmFBPpAOB0oG2Iu36TbAdecBw=";
+    sha256 = "sha256-SeBZtrRsWTv5yBBsp18daKCNAr70OalH3shlKf+aiEU=";
  };

  patches = [
--- a/pkgs/tools/security/rbw/default.nix
+++ b/pkgs/tools/security/rbw/default.nix
@ -22,19 +22,22 @@
  # pass-import
 , withPass ? false
 , pass
+
+  # git-credential-helper
+, withGitCredential ? false
 }:

 rustPlatform.buildRustPackage rec {
  pname = "rbw";
-  version = "1.4.0";
+  version = "1.4.1";

  src = fetchCrate {
    inherit version;
    crateName = pname;
-    sha256 = "sha256-6O33rn/MTo7Dymwh57xQJ5v7n4yNSoICyR9gRwF4AH4=";
+    sha256 = "sha256-RNdxAp3Q/xNrK1XcKZPMfuqxWzDtdhwT+nqG25SjJhI=";
  };

-  cargoSha256 = "sha256-BrjKUovVV6BDZXtILVC0qaAF5xzE3715u9w9OYIJFbk=";
+  cargoSha256 = "sha256-I0KwHCmfYxgSF5IMHiPooaf2bypd6eYCOPSB+qnEBJY=";

  nativeBuildInputs = [
    pkg-config
@ -58,6 +61,10 @@ rustPlatform.buildRustPackage rec {
    patchShebangs bin/pass-import
    substituteInPlace bin/pass-import \
        --replace pass ${pass}/bin/pass
+  '' + lib.optionalString withGitCredential ''
+    patchShebangs bin/git-credential-rbw
+    substituteInPlace bin/git-credential-rbw \
+        --replace rbw $out/bin/rbw
  '';

  preConfigure = ''
@ -76,6 +83,8 @@ rustPlatform.buildRustPackage rec {
    cp bin/rbw-rofi $out/bin
  '' + lib.optionalString withPass ''
    cp bin/pass-import $out/bin
+  '' + lib.optionalString withGitCredential ''
+    cp bin/git-credential-rbw $out/bin
  '';

  meta = with lib; {
--- a/pkgs/tools/system/rsyslog/default.nix
+++ b/pkgs/tools/system/rsyslog/default.nix
@ -14,11 +14,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "rsyslog";
-  version = "8.2108.0";
+  version = "8.2110.0";

  src = fetchurl {
    url = "https://www.rsyslog.com/files/download/rsyslog/${pname}-${version}.tar.gz";
-    sha256 = "sha256-SCbCttCBqclfRp+wEVvj+VEgZSl9PeAOxRN1jNswsdk=";
+    sha256 = "sha256-P5BOwTfKZBLoJz94ltli7LWJ99DFib3xaxcJ7CfiTzE=";
  };

  #patches = [ ./fix-gnutls-detection.patch ];
--- a/pkgs/tools/system/syslog-ng/default.nix
+++ b/pkgs/tools/system/syslog-ng/default.nix
@ -7,11 +7,11 @@

 stdenv.mkDerivation rec {
  pname = "syslog-ng";
-  version = "3.33.2";
+  version = "3.34.1";

  src = fetchurl {
    url = "https://github.com/${pname}/${pname}/releases/download/${pname}-${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-C3hqBgd7kVAZHXFPRaG0s3kpUstYFjo68zbwdNqfsUs=";
+    sha256 = "sha256-zs457BxoyI1JNwXgpSi4PQONo4TonUg4OTzMdfYqLUw=";
  };

  nativeBuildInputs = [ pkg-config which ];
--- a/pkgs/tools/text/chroma/default.nix
+++ b/pkgs/tools/text/chroma/default.nix
@ -1,37 +1,32 @@
 { lib, buildGoModule, fetchFromGitHub }:

+let
+  srcInfo = builtins.fromJSON (builtins.readFile ./src.json);
+in
+
 buildGoModule rec {
  pname = "chroma";
-  version = "0.9.2";
+  version = "0.9.4";

+  # To update:
+  # nix-prefetch-git --rev v${version} https://github.com/alecthomas/chroma.git > src.json
  src = fetchFromGitHub {
    owner  = "alecthomas";
    repo   = pname;
    rev    = "v${version}";
-    sha256 = "19d7yr6q8kwrm91yyglmw9n7wa861sgi6dbwn8sl6dp55czfwvaq";
-    # populate values otherwise taken care of by goreleaser,
-    # unfortunately these require us to use git. By doing
-    # this in postFetch we can delete .git afterwards and
-    # maintain better reproducibility of the src.
-    leaveDotGit = true;
-    postFetch = ''
-      cd "$out"
-
-      commit="$(git rev-parse HEAD)"
-      date=$(git show -s --format=%aI "$commit")
-
-      substituteInPlace "$out/cmd/chroma/main.go" \
-        --replace 'version = "?"' 'version = "${version}"' \
-        --replace 'commit  = "?"' "commit = \"$commit\"" \
-        --replace 'date    = "?"' "date = \"$date\""
-
-      find "$out" -name .git -print0 | xargs -0 rm -rf
-    '';
+    inherit (srcInfo) sha256;
  };

-  vendorSha256 = "0y8mp08zccn9qxrsj9j7vambz8dwzsxbbgrlppzam53rg8rpxhrg";
+  vendorSha256 = "1l5ryhwifhff41r4z1d2lifpvjcc4yi1vzrzlvkx3iy9dmxqcssl";

-  subPackages = [ "cmd/chroma" ];
+  modRoot = "./cmd/chroma";
+
+  # substitute version info as done in goreleaser builds
+  ldflags = [
+    "-X" "main.version=${version}"
+    "-X" "main.commit=${srcInfo.rev}"
+    "-X" "main.date=${srcInfo.date}"
+  ];

  meta = with lib; {
    homepage = "https://github.com/alecthomas/chroma";
--- a/pkgs/tools/text/chroma/src.json
+++ b/pkgs/tools/text/chroma/src.json
@ -0,0 +1,11 @@
+{
+  "url": "https://github.com/alecthomas/chroma.git",
+  "rev": "6520148857c2ae3106ff371e527abea815b23915",
+  "date": "2021-10-17T08:46:20+11:00",
+  "path": "/nix/store/0s8a46d1nyjl3yhsgni2jz5vdv95cka8-chroma",
+  "sha256": "1iy6mymdjxbl5wbll1mivv7gqdyqhl6xpfqps99z307m7y38r1ni",
+  "fetchLFS": false,
+  "fetchSubmodules": false,
+  "deepClone": false,
+  "leaveDotGit": false
+}
--- a/pkgs/tools/text/crowdin-cli/default.nix
+++ b/pkgs/tools/text/crowdin-cli/default.nix
@ -7,6 +7,8 @@
 , installShellFiles
 , jre
 , makeWrapper
+, crowdin-cli
+, testVersion
 , unzip
 }:

@ -36,7 +38,10 @@ stdenv.mkDerivation rec {
    runHook postInstall
  '';

+  passthru.tests.version = testVersion { package = crowdin-cli; };
+
  meta = with lib; {
+    mainProgram = "crowdin";
    homepage = "https://github.com/crowdin/crowdin-cli/";
    description = "A command-line client for the Crowdin API";
    license = licenses.mit;
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -1469,6 +1469,8 @@ with pkgs;

  inherit (nodePackages) bitwarden-cli;

+  inherit (nodePackages) concurrently;
+
  inherit (nodePackages) hyperspace-cli;

  bklk = callPackage ../applications/misc/bklk { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -8879,6 +8879,8 @@ in {

  starline = callPackage ../development/python-modules/starline { };

+  stashy = callPackage ../development/python-modules/stashy { };
+
  staticjinja = callPackage ../development/python-modules/staticjinja { };

  statistics = callPackage ../development/python-modules/statistics { };