Merge branch 'master' into staging-next

2024-12-27 22:03:54 +03:00 · 2020-10-24 01:10:07 +02:00 · 2020-10-24 01:10:07 +02:00 · c252654584
commit c252654584
parent d13fc932cd 579daedfca
97 changed files with 2242 additions and 2155 deletions
--- a/doc/languages-frameworks/haskell.section.md
+++ b/doc/languages-frameworks/haskell.section.md
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -9624,6 +9624,12 @@
    githubId = 1069303;
    name = "Kim Simmons";
  };
+  zopieux = {
+    email = "zopieux@gmail.com";
+    github = "zopieux";
+    githubId = 81353;
+    name = "Alexandre Macabies";
+  };
  zowoq = {
    email = "59103226+zowoq@users.noreply.github.com";
    github = "zowoq";
--- a/nixos/doc/manual/README
+++ b/nixos/doc/manual/README
@ -1,12 +1,3 @@
-To build the manual, you need Nix installed on your system (no need
-for NixOS). To install Nix, follow the instructions at
+Moved to: ./contributing-to-this-manual.xml. Link:

-    https://nixos.org/nix/download.html
-
-When you have Nix on your system, in the root directory of the project
-(i.e., `nixpkgs`), run:
-
-    nix-build nixos/release.nix -A manual.x86_64-linux
-
-When this command successfully finishes, it will tell you where the
-manual got generated.
+https://nixos.org/manual/nixos/unstable/#chap-contributing
--- a/nixos/doc/manual/contributing-to-this-manual.xml
+++ b/nixos/doc/manual/contributing-to-this-manual.xml
@ -0,0 +1,22 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xml:id="chap-contributing">
+ <title>Contributing to this documentation</title>
+ <para>
+  The DocBook sources of NixOS' manual are in the <filename
+xlink:href="https://github.com/NixOS/nixpkgs/tree/master/nixos/doc/manual">
+nixos/doc/manual</filename> subdirectory of the <link
+xlink:href="https://github.com/NixOS/nixpkgs">Nixpkgs</link> repository.
+ </para>
+ <para>
+  You can quickly check your edits with the following:
+ </para>
+<screen>
+<prompt>$ </prompt>cd /path/to/nixpkgs/nixos/doc/manual
+<prompt>$ </prompt>nix-build nixos/release.nix -A manual.x86_64-linux
+</screen>
+ <para>
+  If the build succeeds, the manual will be in
+  <filename>./result/share/doc/nixos/index.html</filename>.
+ </para>
+</chapter>
--- a/nixos/doc/manual/manual.xml
+++ b/nixos/doc/manual/manual.xml
@ -19,5 +19,6 @@
  <xi:include href="./generated/options-db.xml"
                xpointer="configuration-variable-list" />
 </appendix>
+ <xi:include href="contributing-to-this-manual.xml" />
 <xi:include href="release-notes/release-notes.xml" />
 </book>
--- a/nixos/modules/hardware/rtl-sdr.nix
+++ b/nixos/modules/hardware/rtl-sdr.nix
@ -0,0 +1,20 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.hardware.rtl-sdr;
+
+in {
+  options.hardware.rtl-sdr = {
+    enable = lib.mkEnableOption ''
+      Enables rtl-sdr udev rules and ensures 'plugdev' group exists.
+      This is a prerequisite to using devices supported by rtl-sdr without
+      being root, since rtl-sdr USB descriptors will be owned by plugdev
+      through udev.
+    '';
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.udev.packages = [ pkgs.rtl-sdr ];
+    users.groups.plugdev = {};
+  };
+}
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -59,6 +59,7 @@
  ./hardware/pcmcia.nix
  ./hardware/printers.nix
  ./hardware/raid/hpsa.nix
+  ./hardware/rtl-sdr.nix
  ./hardware/steam-hardware.nix
  ./hardware/system-76.nix
  ./hardware/tuxedo-keyboard.nix
--- a/nixos/modules/programs/ssmtp.nix
+++ b/nixos/modules/programs/ssmtp.nix
@ -1,6 +1,6 @@
 # Configuration for `ssmtp', a trivial mail transfer agent that can
 # replace sendmail/postfix on simple systems.  It delivers email
-# directly to an SMTP server defined in its configuration file, wihout
+# directly to an SMTP server defined in its configuration file, without
 # queueing mail locally.

 { config, lib, pkgs, ... }:
--- a/nixos/modules/services/admin/salt/master.nix
+++ b/nixos/modules/services/admin/salt/master.nix
@ -59,5 +59,5 @@ in
    };
  };

-  meta.maintainers = with lib.maintainers; [ aneeshusa ];
+  meta.maintainers = with lib.maintainers; [ Flakebi ];
 }
--- a/nixos/modules/services/desktops/pipewire.nix
+++ b/nixos/modules/services/desktops/pipewire.nix
@ -5,8 +5,22 @@ with lib;

 let
  cfg = config.services.pipewire;
-  packages = with pkgs; [ pipewire ];
+  enable32BitAlsaPlugins = cfg.alsa.support32Bit
+                           && pkgs.stdenv.isx86_64
+                           && pkgs.pkgsi686Linux.pipewire != null;

+  # The package doesn't output to $out/lib/pipewire directly so that the
+  # overlays can use the outputs to replace the originals in FHS environments.
+  #
+  # This doesn't work in general because of missing development information.
+  jack-libs = pkgs.runCommand "jack-libs" {} ''
+    mkdir -p "$out/lib"
+    ln -s "${pkgs.pipewire.jack}/lib" "$out/lib/pipewire"
+  '';
+  pulse-libs = pkgs.runCommand "pulse-libs" {} ''
+    mkdir -p "$out/lib"
+    ln -s "${pkgs.pipewire.pulse}/lib" "$out/lib/pipewire"
+  '';
 in {

  meta = {
@ -25,17 +39,67 @@ in {
          Automatically run pipewire when connections are made to the pipewire socket.
        '';
      };
+
+      alsa = {
+        enable = mkEnableOption "ALSA support";
+        support32Bit = mkEnableOption "32-bit ALSA support on 64-bit systems";
+      };
+
+      jack = {
+        enable = mkEnableOption "JACK audio emulation";
+      };
+
+      pulse = {
+        enable = mkEnableOption "PulseAudio emulation";
+      };
    };
  };


  ###### implementation
  config = mkIf cfg.enable {
-    environment.systemPackages = packages;
+    assertions = [
+      {
+        assertion = cfg.pulse.enable -> !config.hardware.pulseaudio.enable;
+        message = "PipeWire based PulseAudio emulation doesn't use the PulseAudio service";
+      }
+      {
+        assertion = cfg.jack.enable -> !config.services.jack.jackd.enable;
+        message = "PIpeWire based JACK emulation doesn't use the JACK service";
+      }
+    ];

-    systemd.packages = packages;
+    environment.systemPackages = [ pkgs.pipewire ]
+                                 ++ lib.optional cfg.jack.enable jack-libs
+                                 ++ lib.optional cfg.pulse.enable pulse-libs;

+    systemd.packages = [ pkgs.pipewire ];
+
+    # PipeWire depends on DBUS but doesn't list it. Without this booting
+    # into a terminal results in the service crashing with an error.
    systemd.user.sockets.pipewire.wantedBy = lib.mkIf cfg.socketActivation [ "sockets.target" ];
-  };
+    systemd.user.services.pipewire.bindsTo = [ "dbus.service" ];
+    services.udev.packages = [ pkgs.pipewire ];

+    # If any paths are updated here they must also be updated in the package test.
+    sound.extraConfig = mkIf cfg.alsa.enable ''
+      pcm_type.pipewire {
+        libs.native = ${pkgs.pipewire.lib}/lib/alsa-lib/libasound_module_pcm_pipewire.so ;
+        ${optionalString enable32BitAlsaPlugins
+          "libs.32Bit = ${pkgs.pkgsi686Linux.pipewire.lib}/lib/alsa-lib/libasound_module_pcm_pipewire.so ;"}
+      }
+      pcm.!default {
+        @func getenv
+        vars [ PCM ]
+        default "plug:pipewire"
+        playback_mode "-1"
+        capture_mode "-1"
+      }
+    '';
+    environment.etc."alsa/conf.d/50-pipewire.conf" = mkIf cfg.alsa.enable {
+      source = "${pkgs.pipewire}/share/alsa/alsa.conf.d/50-pipewire.conf";
+    };
+    environment.sessionVariables.LD_LIBRARY_PATH =
+      lib.optional (cfg.jack.enable || cfg.pulse.enable) "/run/current-system/sw/lib/pipewire";
+  };
 }
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@ -43,6 +43,7 @@ let
    "postgres"
    "redis"
    "rspamd"
+    "rtl_433"
    "snmp"
    "surfboard"
    "tor"
@ -224,6 +225,8 @@ in
    services.prometheus.exporters.minio.minioAccessSecret = mkDefault config.services.minio.secretKey;
  })] ++ [(mkIf config.services.rspamd.enable {
    services.prometheus.exporters.rspamd.url = mkDefault "http://localhost:11334/stat";
+  })] ++ [(mkIf config.services.prometheus.exporters.rtl_433.enable {
+    hardware.rtl-sdr.enable = mkDefault true;
  })] ++ [(mkIf config.services.nginx.enable {
    systemd.services.prometheus-nginx-exporter.after = [ "nginx.service" ];
    systemd.services.prometheus-nginx-exporter.requires = [ "nginx.service" ];
--- a/nixos/modules/services/monitoring/prometheus/exporters/rtl_433.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/rtl_433.nix
@ -0,0 +1,78 @@
+{ config, lib, pkgs, options }:
+
+let
+  cfg = config.services.prometheus.exporters.rtl_433;
+in
+{
+  port = 9550;
+
+  extraOpts = let
+    mkMatcherOptionType = field: description: with lib.types;
+      listOf (submodule {
+        options = {
+          name = lib.mkOption {
+            type = str;
+            description = "Name to match.";
+          };
+          "${field}" = lib.mkOption {
+            type = int;
+            inherit description;
+          };
+          location = lib.mkOption {
+            type = str;
+            description = "Location to match.";
+          };
+        };
+      });
+  in
+  {
+    rtl433Flags = lib.mkOption {
+      type = lib.types.str;
+      default = "-C si";
+      example = "-C si -R 19";
+      description = ''
+        Flags passed verbatim to rtl_433 binary.
+        Having <literal>-C si</literal> (the default) is recommended since only Celsius temperatures are parsed.
+      '';
+    };
+    channels = lib.mkOption {
+      type = mkMatcherOptionType "channel" "Channel to match.";
+      default = [];
+      example = [
+        { name = "Acurite"; channel = 6543; location = "Kitchen"; }
+      ];
+      description = ''
+        List of channel matchers to export.
+      '';
+    };
+    ids = lib.mkOption {
+      type = mkMatcherOptionType "id" "ID to match.";
+      default = [];
+      example = [
+        { name = "Nexus"; id = 1; location = "Bedroom"; }
+      ];
+      description = ''
+        List of ID matchers to export.
+      '';
+    };
+  };
+
+  serviceOpts = {
+    serviceConfig = {
+      # rtl-sdr udev rules make supported USB devices +rw by plugdev.
+      SupplementaryGroups = "plugdev";
+      ExecStart = let
+        matchers = (map (m:
+          "--channel_matcher '${m.name},${toString m.channel},${m.location}'"
+        ) cfg.channels) ++ (map (m:
+          "--id_matcher '${m.name},${toString m.id},${m.location}'"
+        ) cfg.ids); in ''
+        ${pkgs.prometheus-rtl_433-exporter}/bin/rtl_433_prometheus \
+          -listen ${cfg.listenAddress}:${toString cfg.port} \
+          -subprocess "${pkgs.rtl_433}/bin/rtl_433 -F json ${cfg.rtl433Flags}" \
+          ${lib.concatStringsSep " \\\n  " matchers} \
+          ${lib.concatStringsSep " \\\n  " cfg.extraFlags}
+      '';
+    };
+  };
+}
--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@ -474,6 +474,12 @@ in
            )
            [dms wms]
          );
+
+    # Make xsessions and wayland sessions available in XDG_DATA_DIRS
+    # as some programs have behavior that depends on them being present
+    environment.sessionVariables.XDG_DATA_DIRS = [
+      "${cfg.displayManager.sessionData.desktops}/share"
+    ];
  };

  imports = [
--- a/nixos/tests/installed-tests/default.nix
+++ b/nixos/tests/installed-tests/default.nix
@ -101,5 +101,6 @@ in
  libxmlb = callInstalledTest ./libxmlb.nix {};
  malcontent = callInstalledTest ./malcontent.nix {};
  ostree = callInstalledTest ./ostree.nix {};
+  pipewire = callInstalledTest ./pipewire.nix {};
  xdg-desktop-portal = callInstalledTest ./xdg-desktop-portal.nix {};
 }
--- a/nixos/tests/installed-tests/pipewire.nix
+++ b/nixos/tests/installed-tests/pipewire.nix
@ -0,0 +1,5 @@
+{ pkgs, lib, makeInstalledTest, ... }:
+
+makeInstalledTest {
+  tested = pkgs.pipewire;
+}
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@ -563,6 +563,37 @@ let
      '';
    };

+    rtl_433 = {
+      exporterConfig = {
+        enable = true;
+      };
+      metricProvider = {
+        # Mock rtl_433 binary to return a dummy metric stream.
+        nixpkgs.overlays = [ (self: super: {
+          rtl_433 = self.runCommand "rtl_433" {} ''
+            mkdir -p "$out/bin"
+            cat <<EOF > "$out/bin/rtl_433"
+            #!/bin/sh
+            while true; do
+              printf '{"time" : "2020-04-26 13:37:42", "model" : "zopieux", "id" : 55, "channel" : 3, "temperature_C" : 18.000}\n'
+              sleep 4
+            done
+            EOF
+            chmod +x "$out/bin/rtl_433"
+          '';
+        }) ];
+      };
+      exporterTest = ''
+        wait_for_unit("prometheus-rtl_433-exporter.service")
+        wait_for_open_port(9550)
+        wait_until_succeeds(
+            "curl -sSf localhost:9550/metrics | grep -q '{}'".format(
+                'rtl_433_temperature_celsius{channel="3",id="55",location="",model="zopieux"} 18'
+            )
+        )
+      '';
+    };
+
    snmp = {
      exporterConfig = {
        enable = true;
--- a/pkgs/applications/audio/cantata/default.nix
+++ b/pkgs/applications/audio/cantata/default.nix
@ -31,7 +31,7 @@ assert withReplaygain -> withTaglib;
 assert withLibVlc -> withHttpStream;

 let
-  version = "2.4.1";
+  version = "2.4.2";
  pname = "cantata";
  fstat = x: fn: "-DENABLE_" + fn + "=" + (if x then "ON" else "OFF");
  fstats = x: map (fstat x);
@ -47,7 +47,7 @@ in mkDerivation {
    owner  = "CDrummond";
    repo   = "cantata";
    rev    = "v${version}";
-    sha256 = "0ix7xp352bziwz31mw79y7wxxmdn6060p8ry2px243ni1lz1qx1c";
+    sha256 = "15qfx9bpfdplxxs08inwf2j8kvf7g5cln5sv1wj1l2l41vbf1mjr";
  };

  patches = [
--- a/pkgs/applications/audio/cozy-audiobooks/default.nix
+++ b/pkgs/applications/audio/cozy-audiobooks/default.nix
@ -20,7 +20,7 @@ python3Packages.buildPythonApplication rec {
  format = "other"; # no setup.py

  pname = "cozy";
-  version = "0.6.7";
+  version = "0.7.2";

  # Temporary fix
  # See https://github.com/NixOS/nixpkgs/issues/57029
@ -31,7 +31,7 @@ python3Packages.buildPythonApplication rec {
    owner = "geigi";
    repo = pname;
    rev = version;
-    sha256 = "0f8dyqj6111czn8spgsnic1fqs3kimjwl1b19mw55fa924b9bhsa";
+    sha256 = "0fmbddi4ga0bppwg3rm3yjmf7jgqc6zfslmavnr1pglbzkjhy9fs";
  };

  nativeBuildInputs = [
@ -55,18 +55,23 @@ python3Packages.buildPythonApplication rec {
  ]);

  propagatedBuildInputs = with python3Packages; [
-    gst-python
-    pygobject3
+    apsw
+    cairo
    dbus-python
-    mutagen
-    peewee
+    distro
+    gst-python
    magic
+    mutagen
+    packaging
+    peewee
+    pygobject3
+    pytz
+    requests
  ];

  postPatch = ''
-    chmod +x data/meson_post_install.py
-    patchShebangs data/meson_post_install.py
-    substituteInPlace cozy/magic/magic.py --replace "ctypes.util.find_library('magic')" "'${file}/lib/libmagic${stdenv.hostPlatform.extensions.sharedLibrary}'"
+    chmod +x meson/post_install.py
+    patchShebangs meson/post_install.py
  '';

  postInstall = ''
--- a/pkgs/applications/editors/cudatext/default.nix
+++ b/pkgs/applications/editors/cudatext/default.nix
@ -30,22 +30,21 @@ let
  deps = lib.mapAttrs
    (name: spec:
      fetchFromGitHub {
-        owner = "Alexey-T";
        repo = name;
-        inherit (spec) rev sha256;
+        inherit (spec) owner rev sha256;
      }
    )
    (builtins.fromJSON (builtins.readFile ./deps.json));
 in
 stdenv.mkDerivation rec {
  pname = "cudatext";
-  version = "1.111.0";
+  version = "1.115.0";

  src = fetchFromGitHub {
    owner = "Alexey-T";
    repo = "CudaText";
    rev = version;
-    sha256 = "1ai0g8fmw4m237dqh5dkr8w9qqricyvp49ijz2ivvmg9dsdfzjfp";
+    sha256 = "0q7gfpzc97fvyvabjdb9a4d3c2qhm4zf5bqgnsj73vkly80kgww8";
  };

  patches = [
@ -74,6 +73,7 @@ stdenv.mkDerivation rec {
    cp -r --no-preserve=mode ${dep} ${name}
  '') deps) + ''
    lazbuild --lazarusdir=${lazarus}/share/lazarus --pcp=./lazarus --ws=${widgetset} \
+      bgrabitmap/bgrabitmap/bgrabitmappack.lpk \
      EncConv/encconv/encconv_package.lpk \
      ATBinHex-Lazarus/atbinhex/atbinhex_package.lpk \
      ATFlatControls/atflatcontrols/atflatcontrols_package.lpk \
--- a/pkgs/applications/editors/cudatext/deps.json
+++ b/pkgs/applications/editors/cudatext/deps.json
@ -1,42 +1,57 @@
 {
  "EncConv": {
+    "owner": "Alexey-T",
    "rev": "2020.06.15",
    "sha256": "07dpvq3ppfq3b70i1smkf7vwdlzq8qnxs3fk94hi9h1z36bz2rw3"
  },
  "ATBinHex-Lazarus": {
+    "owner": "Alexey-T",
    "rev": "2020.09.05",
    "sha256": "022yx5vic4hnc9lz53wvr4h7hf0h71801dzlilj55x5mf8p59072"
  },
  "ATFlatControls": {
-    "rev": "2020.08.23",
-    "sha256": "1axzwiz5h62v11ncynxcg431dfbky9pwyha7cd6kpizjdjagfklw"
+    "owner": "Alexey-T",
+    "rev": "2020.09.20",
+    "sha256": "09svn8yyqp6znvfpcxrsybkclh828h5rvah7nhbhk7nrfzj8i63x"
  },
  "ATSynEdit": {
-    "rev": "2020.09.05",
-    "sha256": "0qn0fp7rbi48f3nrysb0knkd7a3a6pl5w72yf95g5iibal4zrib2"
+    "owner": "Alexey-T",
+    "rev": "2020.10.12",
+    "sha256": "07vznwwfa3c1jr1cd32yppw0mmmm1ja9bmsxhxlcbnc2nb30n9zr"
  },
  "ATSynEdit_Cmp": {
-    "rev": "2020.09.05",
-    "sha256": "1bd25zc97001b7lg0bvi8va9mazkr6jih6d2ddkabcxcnsj0dxnq"
+    "owner": "Alexey-T",
+    "rev": "2020.10.11",
+    "sha256": "11vx685i85izp7wzb34dalcwlkmkbz1vzva5j9cf2yz1jff1v4qw"
  },
  "EControl": {
-    "rev": "2020.09.05",
-    "sha256": "1n7s1zkhrr216gqdqvq6wq0n3jq7s78mwpi5s5j8054p0fak1ywi"
+    "owner": "Alexey-T",
+    "rev": "2020.10.04",
+    "sha256": "0ypbaca3y5biw2207yh3x5p28gm8g51qf7glm5622w3cgbrf9mdq"
  },
  "ATSynEdit_Ex": {
-    "rev": "2020.09.05",
-    "sha256": "17y2cx5syj3jvrszjgdyf1p6vilp2qgaggz4y8yqnz99cvd0shs7"
+    "owner": "Alexey-T",
+    "rev": "2020.10.04",
+    "sha256": "0z66cm9pgdi7whqaim6hva4aa08zrr1881n1fal7lnz6wlla824k"
  },
  "Python-for-Lazarus": {
+    "owner": "Alexey-T",
    "rev": "2020.07.31",
    "sha256": "0qbs51h6gw8qd3h06kwy1j7db35shbg7r2rayrhvvw0vzr9n330j"
  },
  "Emmet-Pascal": {
+    "owner": "Alexey-T",
    "rev": "2020.09.05",
    "sha256": "0qfiirxnk5g3whx8y8hp54ch3h6gkkd01yf79m95bwar5qvdfybg"
  },
  "CudaText-lexers": {
+    "owner": "Alexey-T",
    "rev": "2020.08.10",
    "sha256": "1gzs2psyfhb9si1qyacxzfjb3dz2v255hv7y4jlkbxdxv0kckqr6"
+  },
+  "bgrabitmap": {
+    "owner": "bgrabitmap",
+    "rev": "v11.2.4",
+    "sha256": "1zk88crfn07md16wg6af4i8nlx4ikkhxq9gfk49jirwimgwbf1md"
  }
 }
--- a/pkgs/applications/editors/cudatext/dont-check-update.patch
+++ b/pkgs/applications/editors/cudatext/dont-check-update.patch
@ -1,8 +1,8 @@
 diff --git i/app/formmain.pas w/app/formmain.pas
-index 8c1131680..6c6c0043f 100644
+index f6f37febb..cf993d75e 100644
 --- i/app/formmain.pas
 +++ w/app/formmain.pas
-@@ -2135,6 +2135,7 @@ begin
+@@ -2156,6 +2156,7 @@ begin
     false
     {$endif};
     *)
--- a/pkgs/applications/networking/browsers/brave/default.nix
+++ b/pkgs/applications/networking/browsers/brave/default.nix
@ -86,11 +86,11 @@ in

 stdenv.mkDerivation rec {
  pname = "brave";
-  version = "1.12.112";
+  version = "1.15.76";

  src = fetchurl {
    url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    sha256 = "0nvxmz1wrr6cfyhbnrfjsy9szbjmvjl6080pgkp25xa8rcql5gmb";
+    sha256 = "3b054584c2272a9eeb9029f754cabaf4804db295fd0e6b84ead680b08af38d48";
  };

  dontConfigure = true;
--- a/pkgs/applications/networking/browsers/chromium/README.md
+++ b/pkgs/applications/networking/browsers/chromium/README.md
@ -0,0 +1,66 @@
+# Maintainers
+
+- TODO: We need more maintainers:
+  - https://github.com/NixOS/nixpkgs/issues/78450
+  - If you just want to help out without becoming a maintainer:
+    - Look for open Nixpkgs issues or PRs related to Chromium
+    - Make your own PRs (but please try to make reviews as easy as possible)
+- Primary maintainer (responsible for updating Chromium): @primeos
+- Testers (test all stable channel updates)
+  - `nixos-unstable`:
+    - `x86_64`: @danielfullmer
+    - `aarch64`: @thefloweringash
+  - Stable channel:
+    - `x86_64`: @Frostman
+- Other relevant packages:
+  - `chromiumBeta` and `chromiumDev`: For testing purposes (not build on Hydra)
+  - `google-chrome`, `google-chrome-beta`, `google-chrome-dev`: Updated via
+    Chromium's `upstream-info.json`
+  - `ungoogled-chromium`: Based on `chromium` (the expressions are regularly
+    copied over and patched accordingly)
+
+# Upstream links
+
+- Source code: https://source.chromium.org/chromium/chromium/src
+- Bugs: https://bugs.chromium.org/p/chromium/issues/list
+- Release updates: https://chromereleases.googleblog.com/
+  - Available as Atom or RSS feed (filter for
+    "Stable Channel Update for Desktop")
+  - Channel overview: https://omahaproxy.appspot.com/
+  - Release schedule: https://chromiumdash.appspot.com/schedule
+
+# Updating Chromium
+
+Simply run `./pkgs/applications/networking/browsers/chromium/update.py` to
+update `upstream-info.json`. After updates it is important to test at least
+`nixosTests.chromium` (or basic manual testing) and `google-chrome` (which
+reuses `upstream-info.json`).
+
+## Backports
+
+All updates are considered security critical and should be ported to the stable
+channel ASAP. When there is a new stable release the old one should receive
+security updates for roughly one month. After that it is important to mark
+Chromium as insecure (see 69e4ae56c4b for an example; it is important that the
+tested job still succeeds and that all browsers that use `upstream-info.json`
+are marked as insecure).
+
+## Major version updates
+
+Unfortunately, Chromium regularly breaks on major updates and might need
+various patches. Either due to issues with the Nix build sandbox (e.g. we cannot
+fetch dependencies via the network and do not use standard FHS paths) or due to
+missing upstream fixes that need to be backported.
+
+Good sources for such patches and other hints:
+- https://github.com/archlinux/svntogit-packages/tree/packages/chromium/trunk
+- https://gitweb.gentoo.org/repo/gentoo.git/tree/www-client/chromium
+- https://src.fedoraproject.org/rpms/chromium/tree/master
+
+If the build fails immediately due to unknown compiler flags this usually means
+that a new major release of LLVM is required.
+
+## Beta and Dev channels
+
+Those channels are only used to test and fix builds in advance. They may be
+broken at times and must not delay stable channel updates.
--- a/pkgs/applications/networking/browsers/chromium/browser.nix
+++ b/pkgs/applications/networking/browsers/chromium/browser.nix
@ -77,18 +77,11 @@ mkChromiumDerivation (base: rec {
      of source code for Google Chrome (which has some additional features).
    '';
    homepage = "https://www.chromium.org/";
-    maintainers = with maintainers; [ bendlas thefloweringash primeos ];
-    # Overview of the maintainer roles:
-    # nixos-unstable:
-    # - TODO: Need a new maintainer for x86_64 [0]
-    # - @thefloweringash: aarch64
-    # - @primeos: Provisional maintainer (x86_64)
-    # Stable channel:
-    # - TODO (need someone to test backports [0])
-    # [0]: https://github.com/NixOS/nixpkgs/issues/78450
+    maintainers = with maintainers; [ primeos thefloweringash bendlas ]; # See README.md
    license = if enableWideVine then licenses.unfree else licenses.bsd3;
    platforms = platforms.linux;
    hydraPlatforms = if channel == "stable" then ["aarch64-linux" "x86_64-linux"] else [];
-    timeout = 172800; # 48 hours
+    timeout = 172800; # 48 hours (increased from the Hydra default of 10h)
+    broken = channel == "dev"; # Blocked on https://bugs.chromium.org/p/chromium/issues/detail?id=1141896
  };
 })
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -154,18 +154,10 @@ let
      ++ optionals useOzone [ libdrm wayland mesa_drivers libxkbcommon ];

    patches = [
-      ./patches/no-build-timestamps.patch
-      ./patches/widevine-79.patch
-      # Unfortunately, chromium regularly breaks on major updates and
-      # then needs various patches backported in order to be compiled with GCC.
-      # Good sources for such patches and other hints:
-      # - https://gitweb.gentoo.org/repo/gentoo.git/plain/www-client/chromium/
-      # - https://git.archlinux.org/svntogit/packages.git/tree/trunk?h=packages/chromium
-      # - https://github.com/chromium/chromium/search?q=GCC&s=committer-date&type=Commits
-      #
-      # ++ optionals (channel == "dev") [ ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" ) ]
+      ./patches/no-build-timestamps.patch # Optional patch to use SOURCE_DATE_EPOCH in compute_build_timestamp.py (should be upstreamed)
+      ./patches/widevine-79.patch # For bundling Widevine (DRM), might be replaceable via bundle_widevine_cdm=true in gnFlags
      # ++ optional (versionRange "68" "72") ( githubPatch "<patch>" "0000000000000000000000000000000000000000000000000000000000000000" )
-    ] ++ optionals (useVaapi) [
+    ] ++ optionals (useVaapi && versionRange "86" "87") [
      # Check for enable-accelerated-video-decode on Linux:
      (githubPatch "54deb9811ca9bd2327def5c05ba6987b8c7a0897" "11jvxjlkzz1hm0pvfyr88j7z3zbwzplyl5idkx92l2lzv4459c8d")
    ];
--- a/pkgs/applications/networking/browsers/chromium/default.nix
+++ b/pkgs/applications/networking/browsers/chromium/default.nix
@ -47,6 +47,7 @@ let
      });
    } // lib.optionalAttrs (lib.versionAtLeast upstream-info.version "87") {
      useOzone = true; # YAY: https://chromium-review.googlesource.com/c/chromium/src/+/2382834 \o/
+      useVaapi = !stdenv.isAarch64; # TODO: Might be best to not set use_vaapi anymore (default is fine)
      gnChromium = gn.overrideAttrs (oldAttrs: {
        version = "2020-08-17";
        src = fetchgit {
--- a/pkgs/applications/networking/browsers/chromium/upstream-info.json
+++ b/pkgs/applications/networking/browsers/chromium/upstream-info.json
@ -10,8 +10,8 @@
    "sha256bin64": "1lsx4mhy8nachfb8c9f3mrx5nqw2bi046dqirb4lnv7y80jjjs1k"
  },
  "dev": {
-    "version": "88.0.4292.2",
-    "sha256": "0b8ihgbvdqpbcgw9p9sak8nz599pah94jmysqigs4phl9slvir5d",
-    "sha256bin64": "13bx19r56m2r1yjy3b84phv96kkckf87n88kpscf867lgwbrc4fc"
+    "version": "88.0.4298.4",
+    "sha256": "0ka11gmpkyrmifajaxm66c16hrj3xakdvhjqg04slyp2sv0nlhrl",
+    "sha256bin64": "0768y31jqbl1znp7yp6mvl5j12xl1nwjkh2l8zdga81q0wz52hh6"
  }
 }
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@ -23,7 +23,8 @@
 , ffmpegSupport ? true
 , gtk3Support ? true, gtk2, gtk3, wrapGAppsHook
 , waylandSupport ? true, libxkbcommon
-, ltoSupport ? stdenv.isLinux, overrideCC, buildPackages
+# LTO is disabled since it caused segfaults on wayland see https://github.com/NixOS/nixpkgs/issues/10142
+, ltoSupport ? false, overrideCC, buildPackages
 , gssSupport ? true, kerberos
 , pipewireSupport ? waylandSupport && webrtcSupport, pipewire

--- a/pkgs/applications/networking/cluster/argo/default.nix
+++ b/pkgs/applications/networking/cluster/argo/default.nix
@ -19,13 +19,13 @@ let
 in
 buildGoModule rec {
  pname = "argo";
-  version = "2.11.5";
+  version = "2.11.6";

  src = fetchFromGitHub {
    owner = "argoproj";
    repo = "argo";
    rev = "v${version}";
-    sha256 = "0p72v6bb2hbw2xndrzr13zkc91i1jcd67x4qgai136hp9mv97bk3";
+    sha256 = "1vlz1f4hyzgz1x9xgzlmpnbjba8xyhpx9ybia0pwilfg7mwfq92r";
  };

  vendorSha256 = "1ca0ssvbi4vrsn9ljc783hnh9bmf5p8nr1lz5wm8g3gbrrrf1ray";
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@ -133,14 +133,14 @@ let
  } source;

  source = rec {
-    version = "1.3.2";
+    version = "1.3.3";

    # Needs submodules
    src = fetchFromGitHub {
      owner = "mumble-voip";
      repo = "mumble";
      rev = version;
-      sha256 = "1ljn7h7dr9iyhvq7rdh0prl7hzn9d2hhnxv0ni6dha6f7d9qbfy6";
+      sha256 = "1jaq5bl5gdpzd4pskpcd2j93g2w320znn4s8ck8f4jz5f46da1bj";
      fetchSubmodules = true;
    };
  };
--- a/pkgs/applications/radio/rtl-sdr/default.nix
+++ b/pkgs/applications/radio/rtl-sdr/default.nix
@ -1,4 +1,4 @@
-{ stdenv, fetchgit, cmake, pkgconfig, libusb1 }:
+{ stdenv, fetchgit, fetchpatch, cmake, pkgconfig, libusb1 }:

 stdenv.mkDerivation rec {
  pname = "rtl-sdr";
@ -10,6 +10,12 @@ stdenv.mkDerivation rec {
    sha256 = "0lmvsnb4xw4hmz6zs0z5ilsah5hjz29g1s0050n59fllskqr3b8k";
  };

+  patches = [ (fetchpatch {
+    name = "hardened-udev-rules.patch";
+    url = "https://osmocom.org/projects/rtl-sdr/repository/revisions/b2814731563be4d5a0a68554ece6454a2c63af12/diff?format=diff";
+    sha256 = "0ns740s2rys4glq4la4bh0sxfv1mn61yfjns2yllhx70rsb2fqrn";
+  }) ];
+
  nativeBuildInputs = [ pkgconfig cmake ];
  buildInputs = [ libusb1 ];

--- a/pkgs/applications/science/electronics/nanovna-saver/default.nix
+++ b/pkgs/applications/science/electronics/nanovna-saver/default.nix
@ -0,0 +1,51 @@
+{ lib, mkDerivationWith, wrapQtAppsHook, python3Packages, fetchFromGitHub
+, qtbase }:
+
+let
+  version = "0.3.7";
+  pname = "nanovna-saver";
+
+in mkDerivationWith python3Packages.buildPythonApplication {
+  inherit pname version;
+
+  src = fetchFromGitHub {
+    owner = "NanoVNA-Saver";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "0c22ckyypg91gfb2sdc684msw28nnb6r8cq3b362gafvv00a35mi";
+  };
+
+  nativeBuildInputs = [ wrapQtAppsHook ];
+
+  propagatedBuildInputs = with python3Packages; [
+    cython
+    scipy_1_4
+    pyqt5
+    pyserial
+    numpy
+  ];
+
+  doCheck = false;
+
+  dontWrapGApps = true;
+  dontWrapQtApps = true;
+
+  postFixup = ''
+    wrapProgram $out/bin/NanoVNASaver \
+      "''${gappsWrapperArgs[@]}" \
+      "''${qtWrapperArgs[@]}"
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/NanoVNA-Saver/nanovna-saver";
+    description =
+      "A tool for reading, displaying and saving data from the NanoVNA";
+    longDescription = ''
+      A multiplatform tool to save Touchstone files from the NanoVNA, sweep
+      frequency spans in segments to gain more than 101 data points, and
+      generally display and analyze the resulting data.
+    '';
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ zaninime ];
+  };
+}
--- a/pkgs/applications/science/logic/cryptoverif/default.nix
+++ b/pkgs/applications/science/logic/cryptoverif/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "cryptoverif";
-  version = "2.01pl1";
+  version = "2.03pl1";

  src = fetchurl {
    url    = "http://prosecco.gforge.inria.fr/personal/bblanche/cryptoverif/cryptoverif${version}.tar.gz";
-    sha256 = "1bkmrv3wsy8mwhrxd3z3br9zgv37c2w6443rm4s9jl0aphcgnbiw";
+    sha256 = "0q7qa1qm7mbky3m36445gdmgmkb9mrhrdsk7mmwn8fzw0rfc6z00";
  };

  buildInputs = [ ocaml ];
--- a/pkgs/applications/version-management/p4/default.nix
+++ b/pkgs/applications/version-management/p4/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "p4";
-  version = "2020.1.1991450";
+  version = "2020.1.2007551";

  src = fetchurl {
    url = "https://cdist2.perforce.com/perforce/r20.1/bin.linux26x86_64/helix-core-server.tgz";
-    sha256 = "0nhcxhwx3scx6vf7i2bc8j0b1l57lmq9bfy1cfbfbqasd3an721k";
+    sha256 = "0ly9b838zrpp6841fzapizdd3xmria55bwfrh2j29qwxiwzqj80y";
  };

  sourceRoot = ".";
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@ -33,7 +33,7 @@ rec {
      name = "docker-containerd-${version}";
      inherit version;
      src = fetchFromGitHub {
-        owner = "docker";
+        owner = "containerd";
        repo = "containerd";
        rev = containerdRev;
        sha256 = containerdSha256;
--- a/pkgs/data/misc/hackage/default.nix
+++ b/pkgs/data/misc/hackage/default.nix
@ -1,6 +1,6 @@
 { fetchurl }:

 fetchurl {
-  url = "https://github.com/commercialhaskell/all-cabal-hashes/archive/cc32e957fbe01d248c9a0e99253fadb37fd3adfa.tar.gz";
-  sha256 = "121n26r3sm55ycwh6m71n4823c5af3hfpc497g4prf1j2n4yh2dl";
+  url = "https://github.com/commercialhaskell/all-cabal-hashes/archive/197a82b352062bfeeefd4b62bfec19dd51a3728d.tar.gz";
+  sha256 = "11c9a67j421vf6a7vvh280gsmssf49rxqnamdp1n9iljkhlfh5z1";
 }
--- a/pkgs/desktops/gnome-3/extensions/material-shell/default.nix
+++ b/pkgs/desktops/gnome-3/extensions/material-shell/default.nix
@ -1,25 +1,16 @@
-{ stdenv, lib, fetchFromGitHub, gnome3, fetchpatch }:
+{ stdenv, lib, fetchFromGitHub, gnome3 }:

 stdenv.mkDerivation rec {
  pname = "gnome-shell-extension-material-shell";
-  version = "7";
+  version = "8";

  src = fetchFromGitHub {
    owner = "material-shell";
    repo = "material-shell";
    rev = version;
-    sha256 = "076cv1l5qr5x71przjwvbzx0m91n4z0byc2gc3r48l8vsr2d0hwf";
+    sha256 = "08zc6xl2b7k7l5l6afr40ii3gnxxbysan3cqv2s9g614rbsmc62r";
  };

-  patches = [
-    # Fix for https://github.com/material-shell/material-shell/issues/284
-    # (Remove this patch when updating to version >= 8)
-    (fetchpatch {
-      url = "https://github.com/material-shell/material-shell/commit/fc27489a1ec503a4a5c7cb2f4e1eefa84a7ea2f1.patch";
-      sha256 = "0x2skg955c4jqgwbkfhk7plm8bh1qnk66cdds796bzkp3hb5syw8";
-    })
-  ];
-
  # This package has a Makefile, but it's used for building a zip for
  # publication to extensions.gnome.org. Disable the build phase so
  # installing doesn't build an unnecessary release.
--- a/pkgs/desktops/gnome-3/games/iagno/default.nix
+++ b/pkgs/desktops/gnome-3/games/iagno/default.nix
@ -1,6 +1,20 @@
-{ stdenv, fetchurl, pkgconfig, gtk3, gnome3, gdk-pixbuf, librsvg, wrapGAppsHook
-, itstool, gsound, libxml2
-, meson, ninja, python3, vala, desktop-file-utils
+{ stdenv
+, fetchurl
+, fetchpatch
+, pkg-config
+, gtk3
+, gnome3
+, gdk-pixbuf
+, librsvg
+, wrapGAppsHook
+, itstool
+, gsound
+, libxml2
+, meson
+, ninja
+, python3
+, vala
+, desktop-file-utils
 }:

 stdenv.mkDerivation rec {
@ -12,13 +26,34 @@ stdenv.mkDerivation rec {
    sha256 = "1fh2cvyqbz8saf2wij0bz2r9bja2k4gy6fqvbvig4gv0lx66gl29";
  };

-  nativeBuildInputs = [
-    meson ninja python3 vala desktop-file-utils
-    pkgconfig wrapGAppsHook itstool libxml2
+  patches = [
+    # Fix build with Meson 0.55
+    # https://gitlab.gnome.org/GNOME/iagno/-/issues/16
+    (fetchpatch {
+      url = "https://gitlab.gnome.org/GNOME/iagno/commit/0100bab269f2102f24a6e41202b931da1b6e8dc5.patch";
+      sha256 = "ZW75s+bV45ivwA+SKUN7ejSvnXYEo/kYQjDVvFBA/sg=";
+    })
  ];
-  buildInputs = [ gtk3 gnome3.adwaita-icon-theme gdk-pixbuf librsvg gsound ];

-  enableParallelBuilding = true;
+  nativeBuildInputs = [
+    meson
+    ninja
+    python3
+    vala
+    desktop-file-utils
+    pkg-config
+    wrapGAppsHook
+    itstool
+    libxml2
+  ];
+
+  buildInputs = [
+    gtk3
+    gnome3.adwaita-icon-theme
+    gdk-pixbuf
+    librsvg
+    gsound
+  ];

  passthru = {
    updateScript = gnome3.updateScript {
@ -31,7 +66,7 @@ stdenv.mkDerivation rec {
    homepage = "https://wiki.gnome.org/Apps/Iagno";
    description = "Computer version of the game Reversi, more popularly called Othello";
    maintainers = teams.gnome.members;
-    license = licenses.gpl2;
+    license = licenses.gpl3Plus;
    platforms = platforms.linux;
  };
 }
--- a/pkgs/development/compilers/ecl/default.nix
+++ b/pkgs/development/compilers/ecl/default.nix
@ -1,5 +1,6 @@
 {stdenv, fetchurl
 , libtool, autoconf, automake
+, texinfo
 , gmp, mpfr, libffi, makeWrapper
 , noUnicode ? false
 , gcc
@ -10,14 +11,13 @@ let
  s = # Generated upstream information
  rec {
    baseName="ecl";
-    version="16.1.3";
+    version="20.4.24";
    name="${baseName}-${version}";
-    hash="0m0j24w5d5a9dwwqyrg0d35c0nys16ijb4r0nyk87yp82v38b9bn";
-    url="https://common-lisp.net/project/ecl/static/files/release/ecl-16.1.3.tgz";
-    sha256="0m0j24w5d5a9dwwqyrg0d35c0nys16ijb4r0nyk87yp82v38b9bn";
+    url="https://common-lisp.net/project/ecl/static/files/release/${name}.tgz";
+    sha256="01qgdmr54wkj854f69qdm9sybrvd6gd21dpx4askdaaqybnkh237";
  };
  buildInputs = [
-    libtool autoconf automake makeWrapper
+    libtool autoconf automake texinfo makeWrapper
  ];
  propagatedBuildInputs = [
    libffi gmp mpfr gcc
@ -36,7 +36,6 @@ stdenv.mkDerivation {
  };

  patches = [
-    ./libffi-3.3-abi.patch
  ];

  configureFlags = [
--- a/pkgs/development/compilers/ecl/libffi-3.3-abi.patch
+++ b/pkgs/development/compilers/ecl/libffi-3.3-abi.patch
@ -1,15 +0,0 @@
-diff --git a/src/c/ffi.d b/src/c/ffi.d
-index 8174977a..caa69f39 100644
--- a/src/c/ffi.d
-+++ b/src/c/ffi.d
-@@ -133,8 +133,8 @@ static struct {
- #elif defined(X86_WIN64)
-   {@':win64', FFI_WIN64},
- #elif defined(X86_ANY) || defined(X86) || defined(X86_64)
-  {@':cdecl', FFI_SYSV},
-  {@':sysv', FFI_SYSV},
-+  {@':cdecl', FFI_UNIX64},
-+  {@':sysv', FFI_UNIX64},
-   {@':unix64', FFI_UNIX64},
- #endif
- };
--- a/pkgs/development/compilers/eql/default.nix
+++ b/pkgs/development/compilers/eql/default.nix
@ -15,6 +15,9 @@ stdenv.mkDerivation rec {

  postPatch = ''
    sed -re 's@[(]in-home "gui/.command-history"[)]@(concatenate '"'"'string (ext:getenv "HOME") "/.eql-gui-command-history")@' -i gui/gui.lisp
+
+    # cl_def_c_function was renamed to ecl_def_c_function in ECL 20.4.24.
+    find . -type f -exec sed -e 's/\scl_def_c_function(/ ecl_def_c_function(/' -i {} \;
  '';

  buildPhase = ''
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@ -940,7 +940,7 @@ self: super: {
  dhall-json = generateOptparseApplicativeCompletions ["dhall-to-json" "dhall-to-yaml"] super.dhall-json;
  dhall-nix = generateOptparseApplicativeCompletion "dhall-to-nix" (
    super.dhall-nix.overrideScope (self: super: {
-      dhall = super.dhall_1_35_0;
+      dhall = super.dhall_1_36_0;
      repline = self.repline_0_4_0_0;
      haskeline = self.haskeline_0_8_1_0;
    }));
@ -1230,6 +1230,7 @@ self: super: {
    hie-bios = dontCheck super.hie-bios_0_7_1;
    lsp-test = dontCheck self.lsp-test_0_11_0_7;
  }));
+  implicit-hie-cradle = super.implicit-hie-cradle.override { hie-bios = dontCheck super.hie-bios_0_7_1; };

  # hasn‘t bumped upper bounds
  # upstream: https://github.com/obsidiansystems/which/pull/6
@ -1322,10 +1323,6 @@ self: super: {
  # Upstream issue: https://github.com/kowainik/trial/issues/62
  trial = doJailbreak super.trial;

-  # 2020-06-24: Tests are broken in hackage distribution.
-  # See: https://github.com/kowainik/stan/issues/316
-  stan = dontCheck super.stan;
-
  # 2020-06-24: Tests are broken in hackage distribution.
  # See: https://github.com/robstewart57/rdf4h/issues/39
  rdf4h = dontCheck super.rdf4h;
@ -1464,8 +1461,8 @@ self: super: {
  cryptonite = doDistribute self.cryptonite_0_27;

  # We want the latest version of Pandoc.
-  skylighting = doDistribute super.skylighting_0_10_0_2;
-  skylighting-core = doDistribute super.skylighting-core_0_10_0_2;
+  skylighting = doDistribute super.skylighting_0_10_0_3;
+  skylighting-core = doDistribute super.skylighting-core_0_10_0_3;
  hslua = doDistribute self.hslua_1_1_2;
  jira-wiki-markup = doDistribute self.jira-wiki-markup_1_3_2;
  pandoc = doDistribute self.pandoc_2_11_0_2;
@ -1481,6 +1478,9 @@ self: super: {
  # stack-2.5.1 needs a more current version of pantry to compile
  pantry = self.pantry_0_5_1_3;

+  # Too tight version bounds, see https://github.com/haskell-hvr/microaeson/pull/4
+  microaeson = doJailbreak super.microaeson;
+
  # haskell-language-server needs a more current version of pantry to compile
 } // (let
  inherit (self) hls-ghcide hls-brittany;
--- a/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-8.10.x.nix
@ -66,7 +66,7 @@ self: super: {
  unliftio-core = doJailbreak super.unliftio-core;

  # Use the latest version to fix the build.
-  dhall = self.dhall_1_35_0;
+  dhall = self.dhall_1_36_0;
  lens = self.lens_4_19_2;
  optics = self.optics_0_3;
  optics-core = self.optics-core_0_3_0_1;
--- a/pkgs/development/haskell-modules/configuration-ghc-9.0.x.nix
+++ b/pkgs/development/haskell-modules/configuration-ghc-9.0.x.nix
@ -43,4 +43,72 @@ self: super: {
  unix = null;
  xhtml = null;

+  # Take the 3.4.x release candidate.
+  cabal-install = assert super.cabal-install.version == "3.2.0.0";
+                  overrideCabal super.cabal-install (drv: {
+    postUnpack = "sourceRoot+=/cabal-install; echo source root reset to $sourceRoot";
+    version = "cabal-install-3.4.0.0-rc4";
+    editedCabalFile = null;
+    src = pkgs.fetchgit {
+      url = "git://github.com/haskell/cabal.git";
+      rev = "cabal-install-3.4.0.0-rc4";
+      sha256 = "049hllk1d8jid9yg70hmcsdgb0n7hm24p39vavllaahfb0qfimrk";
+    };
+  });
+
+  # Jailbreaks & Version Updates
+  async = doJailbreak super.async;
+  ChasingBottoms = markBrokenVersion "1.3.1.9" super.ChasingBottoms;
+  dec = doJailbreak super.dec;
+  ed25519 = doJailbreak super.ed25519;
+  hashable = overrideCabal (doJailbreak (dontCheck super.hashable)) (drv: { postPatch = "sed -i -e 's,integer-gmp .*<1.1,integer-gmp < 2,' hashable.cabal"; });
+  hashable-time = doJailbreak super.hashable-time;
+  integer-logarithms = overrideCabal (doJailbreak super.integer-logarithms) (drv: { postPatch = "sed -i -e 's,integer-gmp <1.1,integer-gmp < 2,' integer-logarithms.cabal"; });
+  lukko = doJailbreak super.lukko;
+  parallel = doJailbreak super.parallel;
+  primitive = doJailbreak super.primitive_0_7_1_0;
+  regex-posix = doJailbreak super.regex-posix;
+  resolv = doJailbreak super.resolv;
+  singleton-bool = doJailbreak super.singleton-bool;
+  split = doJailbreak super.split;
+  splitmix = self.splitmix_0_1_0_3;
+  tar = doJailbreak super.tar;
+  th-abstraction = self.th-abstraction_0_4_0_0;
+  time-compat = doJailbreak super.time-compat;
+  vector = doJailbreak (dontCheck super.vector);
+  zlib = doJailbreak super.zlib;
+
+  # Apply patches from head.hackage.
+  alex = appendPatch (dontCheck super.alex) (pkgs.fetchpatch {
+    url = "https://gitlab.haskell.org/ghc/head.hackage/-/raw/master/patches/alex-3.2.5.patch";
+    sha256 = "0q8x49k3jjwyspcmidwr6b84s4y43jbf4wqfxfm6wz8x2dxx6nwh";
+  });
+  doctest = appendPatch (dontCheck (doJailbreak super.doctest_0_17)) (pkgs.fetchpatch {
+    url = "https://gitlab.haskell.org/ghc/head.hackage/-/raw/master/patches/doctest-0.17.patch";
+    sha256 = "16s2jcbk9hsww38i2wzxghbf0zpp5dc35hp6rd2n7d4z5xfavp62";
+  });
+  generic-deriving = appendPatch (doJailbreak super.generic-deriving) (pkgs.fetchpatch {
+    url = "https://gitlab.haskell.org/ghc/head.hackage/-/raw/master/patches/generic-deriving-1.13.1.patch";
+    sha256 = "0z85kiwhi5p2wiqwyym0y8q8qrcifp125x5vm0n4482lz41kmqds";
+  });
+  language-haskell-extract = appendPatch (doJailbreak super.language-haskell-extract) (pkgs.fetchpatch {
+    url = "https://gitlab.haskell.org/ghc/head.hackage/-/raw/master/patches/language-haskell-extract-0.2.4.patch";
+    sha256 = "0rgzrq0513nlc1vw7nw4km4bcwn4ivxcgi33jly4a7n3c1r32v1f";
+  });
+  QuickCheck = appendPatch super.QuickCheck_2_14_1 (pkgs.fetchpatch {
+    url = "https://gitlab.haskell.org/ghc/head.hackage/-/raw/master/patches/QuickCheck-2.14.1.patch";
+    sha256 = "0n89nx95w353h4dzala57gb0y7hx4wbkv5igs89dza50p7ybq9an";
+  });
+  regex-base = appendPatch (doJailbreak super.regex-base) (pkgs.fetchpatch {
+    url = "https://gitlab.haskell.org/ghc/head.hackage/-/raw/master/patches/regex-base-0.94.0.0.patch";
+    sha256 = "0k5fglbl7nnhn8400c4cpnflxcbj9p3xi5prl9jfmszr31jwdy5d";
+  });
+  syb = appendPatch (dontCheck super.syb) (pkgs.fetchpatch {
+    url = "https://gitlab.haskell.org/ghc/head.hackage/-/raw/master/patches/syb-0.7.1.patch";
+    sha256 = "1407r8xv6bfnmpbw7glfh4smi76a2fc9pkq300c3d9f575708zqr";
+  });
+
+  # The test suite depends on ChasingBottoms, which is broken with ghc-9.0.x.
+  unordered-containers = dontCheck super.unordered-containers;
+
 }
--- a/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix.yaml
@ -75,7 +75,7 @@ default-package-overrides:
  # haskell-language-server 0.5.0.0 doesn't accept newer versions
  - fourmolu ==0.2.*
  - refinery ==0.2.*
-  # LTS Haskell 16.18
+  # LTS Haskell 16.19
  - abstract-deque ==0.3
  - abstract-par ==0.3.3
  - AC-Angle ==1.0
@ -83,7 +83,7 @@ default-package-overrides:
  - ace ==0.6
  - action-permutations ==0.0.0.1
  - active ==0.2.0.14
-  - ad ==4.4
+  - ad ==4.4.1
  - adjunctions ==4.4
  - adler32 ==0.1.2.0
  - advent-of-code-api ==0.2.7.0
@ -91,7 +91,7 @@ default-package-overrides:
  - aeson-attoparsec ==0.0.0
  - aeson-better-errors ==0.9.1.0
  - aeson-casing ==0.2.0.0
-  - aeson-combinators ==0.0.2.1
+  - aeson-combinators ==0.0.3.0
  - aeson-compat ==0.3.9
  - aeson-default ==0.9.1.0
  - aeson-diff ==1.1.0.9
@ -301,7 +301,7 @@ default-package-overrides:
  - bech32 ==1.0.2
  - bech32-th ==1.0.2
  - bench ==1.0.12
-  - benchpress ==0.2.2.14
+  - benchpress ==0.2.2.15
  - between ==0.11.0.0
  - bibtex ==0.1.0.6
  - bifunctors ==5.5.7
@ -492,7 +492,7 @@ default-package-overrides:
  - concurrent-split ==0.0.1.1
  - concurrent-supply ==0.1.8
  - cond ==0.4.1.1
-  - conduit ==1.3.2.1
+  - conduit ==1.3.3
  - conduit-algorithms ==0.0.11.0
  - conduit-combinators ==1.3.0
  - conduit-concurrent-map ==0.1.1
@ -522,7 +522,7 @@ default-package-overrides:
  - convertible ==1.1.1.0
  - cookie ==0.4.5
  - core-data ==0.2.1.8
-  - core-program ==0.2.4.5
+  - core-program ==0.2.5.0
  - core-text ==0.2.3.6
  - countable ==1.0
  - cpio-conduit ==0.7.0
@ -606,7 +606,7 @@ default-package-overrides:
  - data-or ==1.0.0.5
  - data-ordlist ==0.4.7.0
  - data-ref ==0.0.2
-  - data-reify ==0.6.2
+  - data-reify ==0.6.3
  - data-serializer ==0.3.4.1
  - data-textual ==0.3.0.3
  - data-tree-print ==0.1.0.2
@ -623,7 +623,7 @@ default-package-overrides:
  - declarative ==0.5.3
  - deepseq-generics ==0.2.0.0
  - deepseq-instances ==0.1.0.1
-  - deferred-folds ==0.9.10.1
+  - deferred-folds ==0.9.11
  - dejafu ==2.3.0.1
  - dense-linear-algebra ==0.1.0.0
  - depq ==0.4.1.0
@ -1030,10 +1030,10 @@ default-package-overrides:
  - hedgehog-fakedata ==0.0.1.3
  - hedgehog-fn ==1.0
  - hedgehog-quickcheck ==0.1.1
-  - hedis ==0.12.14
+  - hedis ==0.12.15
  - here ==1.2.13
  - heredoc ==0.2.0.0
-  - heterocephalus ==1.0.5.3
+  - heterocephalus ==1.0.5.4
  - hexml ==0.3.4
  - hexml-lens ==0.2.1
  - hexpat ==0.20.13
@ -1091,9 +1091,9 @@ default-package-overrides:
  - HSlippyMap ==3.0.1
  - hslogger ==1.3.1.0
  - hslua ==1.0.3.2
-  - hslua-aeson ==1.0.3
+  - hslua-aeson ==1.0.3.1
  - hslua-module-doclayout ==0.1.0
-  - hslua-module-system ==0.2.2
+  - hslua-module-system ==0.2.2.1
  - hslua-module-text ==0.2.1
  - HsOpenSSL ==0.11.4.20
  - hsp ==0.10.0
@ -1212,7 +1212,7 @@ default-package-overrides:
  - influxdb ==1.7.1.6
  - ini ==0.4.1
  - inj ==1.0
-  - inline-c ==0.9.1.2
+  - inline-c ==0.9.1.3
  - inline-c-cpp ==0.4.0.2
  - inliterate ==0.1.0
  - insert-ordered-containers ==0.2.3.1
@ -1651,7 +1651,7 @@ default-package-overrides:
  - password-instances ==2.0.0.1
  - path ==0.7.0
  - path-extra ==0.2.0
-  - path-io ==1.6.0
+  - path-io ==1.6.1
  - path-pieces ==0.2.1
  - path-text-utf8 ==0.0.1.6
  - pathtype ==0.8.1.1
@ -1858,7 +1858,7 @@ default-package-overrides:
  - regex-compat ==0.95.2.0
  - regex-compat-tdfa ==0.95.1.4
  - regex-pcre ==0.95.0.0
-  - regex-pcre-builtin ==0.95.1.2.8.43
+  - regex-pcre-builtin ==0.95.1.3.8.43
  - regex-posix ==0.96.0.0
  - regex-tdfa ==1.3.1.0
  - regex-with-pcre ==1.1.0.0
@ -2099,7 +2099,7 @@ default-package-overrides:
  - storablevector ==0.2.13.1
  - stratosphere ==0.53.0
  - streaming ==0.2.3.0
-  - streaming-bytestring ==0.1.6
+  - streaming-bytestring ==0.1.7
  - streaming-commons ==0.2.2.1
  - streamly ==0.7.2
  - streamly-bytestring ==0.1.2
@ -2162,7 +2162,7 @@ default-package-overrides:
  - tar-conduit ==0.3.2
  - tardis ==0.4.1.0
  - tasty ==1.2.3
-  - tasty-ant-xml ==1.1.6
+  - tasty-ant-xml ==1.1.7
  - tasty-dejafu ==2.0.0.6
  - tasty-discover ==4.2.2
  - tasty-expected-failure ==0.11.1.2
@ -2172,7 +2172,7 @@ default-package-overrides:
  - tasty-hunit ==0.10.0.2
  - tasty-kat ==0.0.3
  - tasty-leancheck ==0.0.1
-  - tasty-lua ==0.2.3
+  - tasty-lua ==0.2.3.1
  - tasty-program ==1.0.5
  - tasty-quickcheck ==0.10.1.1
  - tasty-rerun ==1.1.17
@ -2303,7 +2303,7 @@ default-package-overrides:
  - type-equality ==1
  - type-errors ==0.2.0.0
  - type-errors-pretty ==0.0.1.1
-  - type-fun ==0.1.1
+  - type-fun ==0.1.2
  - type-hint ==0.1
  - type-level-integers ==0.0.1
  - type-level-kv-list ==1.1.0
@ -2330,7 +2330,7 @@ default-package-overrides:
  - unexceptionalio-trans ==0.5.1
  - unicode ==0.0.1.1
  - unicode-show ==0.1.0.4
-  - unicode-transforms ==0.3.7
+  - unicode-transforms ==0.3.7.1
  - unification-fd ==0.10.0.1
  - union-find ==0.2
  - uniplate ==1.6.12
@ -2361,7 +2361,7 @@ default-package-overrides:
  - urbit-hob ==0.3.3
  - uri-bytestring ==0.3.2.2
  - uri-bytestring-aeson ==0.1.0.8
-  - uri-encode ==1.5.0.6
+  - uri-encode ==1.5.0.7
  - url ==2.1.3
  - users ==0.5.0.0
  - utf8-conversions ==0.1.0.4
@ -2501,7 +2501,7 @@ default-package-overrides:
  - xturtle ==0.2.0.0
  - xxhash-ffi ==0.2.0.0
  - yaml ==0.11.5.0
-  - yamlparse-applicative ==0.1.0.1
+  - yamlparse-applicative ==0.1.0.2
  - yesod ==1.6.1.0
  - yesod-auth ==1.6.10
  - yesod-auth-fb ==1.10.1
@ -2877,6 +2877,7 @@ broken-packages:
  - AC-VanillaArray
  - AC-Vector
  - AC-Vector-Fancy
+  - acc
  - accelerate
  - accelerate-arithmetic
  - accelerate-fftw
@ -2946,6 +2947,7 @@ broken-packages:
  - aern2-mp
  - aern2-real
  - aeson-applicative
+  - aeson-commit
  - aeson-decode
  - aeson-diff-generic
  - aeson-filthy
@ -3052,6 +3054,9 @@ broken-packages:
  - aop-prelude
  - aosd
  - apart
+  - apecs-gloss
+  - apecs-physics
+  - apecs-physics-gloss
  - apecs-stm
  - apelsin
  - api-builder
@ -3094,6 +3099,7 @@ broken-packages:
  - arbor-monad-metric-datadog
  - arbor-postgres
  - arbtt
+  - arch-hs
  - archive-libarchive
  - archive-tar-bytestring
  - archiver
@ -3274,6 +3280,7 @@ broken-packages:
  - Bang
  - bank-holiday-usa
  - banwords
+  - barbies-th
  - barchart
  - barcodes-code128
  - barecheck
@ -3281,6 +3288,7 @@ broken-packages:
  - barrie
  - barrier
  - barrier-monad
+  - base-compat-migrate
  - base-encoding
  - base-feature-macros
  - base-generics
@ -3507,6 +3515,7 @@ broken-packages:
  - blunt
  - bno055-haskell
  - bogre-banana
+  - boilerplate
  - bolt
  - boltzmann-brain
  - bond
@ -3553,6 +3562,7 @@ broken-packages:
  - brotli-conduit
  - brotli-streams
  - browscap
+  - bsd-sysctl
  - bson
  - bson-generic
  - bson-generics
@ -3567,6 +3577,7 @@ broken-packages:
  - BufferedSocket
  - buffet
  - buffon
+  - bugsnag-haskell
  - bugzilla
  - build
  - buildable
@ -3615,6 +3626,7 @@ broken-packages:
  - c10k
  - c2ats
  - cabal-audit
+  - cabal-auto-expose
  - cabal-bundle-clib
  - cabal-cache
  - cabal-cargs
@ -3631,6 +3643,7 @@ broken-packages:
  - cabal-install-bundle
  - cabal-install-ghc72
  - cabal-install-ghc74
+  - cabal-install-parsers
  - cabal-meta
  - cabal-mon
  - cabal-nirvana
@ -3655,6 +3668,7 @@ broken-packages:
  - cabin
  - cabocha
  - cached
+  - caching
  - cacophony
  - cafeteria-prelude
  - caffegraph
@ -3789,6 +3803,7 @@ broken-packages:
  - chessIO
  - chevalier-common
  - chiasma
+  - chiphunk
  - chitauri
  - Chitra
  - choose
@ -3854,6 +3869,7 @@ broken-packages:
  - clckwrks-plugin-mailinglist
  - clckwrks-plugin-media
  - clckwrks-plugin-page
+  - clckwrks-plugin-redirect
  - clckwrks-theme-bootstrap
  - clckwrks-theme-clckwrks
  - clckwrks-theme-geo-bootstrap
@ -4043,6 +4059,7 @@ broken-packages:
  - confide
  - config-parser
  - config-select
+  - config-value-getopt
  - ConfigFileTH
  - Configger
  - configifier
@ -4229,6 +4246,7 @@ broken-packages:
  - cuboid
  - cuckoo
  - cudd
+  - curl-runnings
  - currency-codes
  - currency-convert
  - curry-frontend
@ -4446,6 +4464,8 @@ broken-packages:
  - dhall-check
  - dhall-docs
  - dhall-fly
+  - dhall-nix
+  - dhall-nixpkgs
  - dhall-text
  - dhall-to-cabal
  - dhall-yaml
@ -4497,6 +4517,7 @@ broken-packages:
  - dingo-core
  - dingo-example
  - dingo-widgets
+  - diohsc
  - diophantine
  - diplomacy
  - diplomacy-server
@ -4508,6 +4529,7 @@ broken-packages:
  - directed-cubical
  - direm
  - dirfiles
+  - dirichlet
  - dirtree
  - discogs-haskell
  - discord-gateway
@ -4846,6 +4868,7 @@ broken-packages:
  - exference
  - exherbo-cabal
  - exif
+  - exiftool
  - exinst
  - exinst-aeson
  - exinst-bytes
@ -5042,6 +5065,7 @@ broken-packages:
  - flaccuraterip
  - flamethrower
  - flamingra
+  - flashblast
  - flat
  - flat-maybe
  - flatbuffers
@ -5050,6 +5074,7 @@ broken-packages:
  - flexiwrap
  - flexiwrap-smallcheck
  - flickr
+  - flink-statefulfun
  - Flippi
  - flite
  - float-binstring
@ -5208,6 +5233,7 @@ broken-packages:
  - funsat
  - funspection
  - fused-effects-exceptions
+  - fused-effects-mwc-random
  - fused-effects-optics
  - fused-effects-random
  - fused-effects-readline
@ -5215,6 +5241,7 @@ broken-packages:
  - fused-effects-th
  - fusion
  - fusion-plugin
+  - futhark
  - futun
  - future
  - fuzzy-time-gen
@ -5369,6 +5396,7 @@ broken-packages:
  - gi-gtk-declarative-app-simple
  - gi-gtk-hs
  - gi-gtkosxapplication
+  - gi-gtksheet
  - gi-handy
  - gi-poppler
  - gi-wnck
@ -5550,6 +5578,8 @@ broken-packages:
  - graphicstools
  - graphmod-plugin
  - graphql
+  - graphql-client
+  - graphql-engine
  - graphql-utils
  - graphql-w-persistent
  - graphted
@ -5620,6 +5650,7 @@ broken-packages:
  - haar
  - habit
  - hablo
+  - hablog
  - HABQT
  - Hach
  - hack-contrib
@ -5710,6 +5741,7 @@ broken-packages:
  - halma-gui
  - halma-telegram-bot
  - halves
+  - ham
  - HaMinitel
  - hampp
  - hamsql
@ -5819,6 +5851,7 @@ broken-packages:
  - haskell-bitmex-client
  - haskell-bitmex-rest
  - haskell-brainfuck
+  - haskell-ci
  - haskell-cnc
  - haskell-coffee
  - haskell-compression
@ -6054,6 +6087,7 @@ broken-packages:
  - hdph-closure
  - hdr-histogram
  - HDRUtils
+  - headed-megaparsec
  - headergen
  - heapsort
  - heart-app
@ -6615,7 +6649,9 @@ broken-packages:
  - http-client-request-modifiers
  - http-client-session
  - http-client-streams
+  - http-client-websockets
  - http-conduit-browser
+  - http-conduit-downloader
  - http-directory
  - http-dispatch
  - http-enumerator
@ -6860,6 +6896,7 @@ broken-packages:
  - instapaper-sender
  - instinct
  - int-multimap
+  - intcode
  - integer-pure
  - integreat
  - intel-aes
@ -6953,6 +6990,7 @@ broken-packages:
  - ixmonad
  - ixshader
  - iyql
+  - j
  - j2hs
  - jack-bindings
  - JackMiniMix
@ -7032,6 +7070,7 @@ broken-packages:
  - JSONb
  - jsonextfilter
  - JsonGrammar
+  - jsonifier
  - jsonresume
  - jsonrpc-conduit
  - jsons-to-schema
@ -7124,6 +7163,7 @@ broken-packages:
  - kit
  - kmeans-par
  - kmeans-vector
+  - kmonad
  - kmp-dfa
  - knead
  - knead-arithmetic
@ -7134,6 +7174,7 @@ broken-packages:
  - korfu
  - kqueue
  - kraken
+  - krank
  - krapsh
  - Kriens
  - krpc
@ -7336,6 +7377,7 @@ broken-packages:
  - libhbb
  - libinfluxdb
  - libjenkins
+  - libjwt-typed
  - liblastfm
  - liblawless
  - liblinear-enumerator
@ -7509,6 +7551,7 @@ broken-packages:
  - loopy
  - lord
  - lorem
+  - lorentz
  - loris
  - loshadka
  - lostcities
@ -7521,6 +7564,7 @@ broken-packages:
  - ls-usb
  - lscabal
  - LslPlus
+  - lsp
  - lsystem
  - ltext
  - lti13
@ -7609,6 +7653,7 @@ broken-packages:
  - mangopay
  - manifold-random
  - manifolds
+  - Map
  - map-exts
  - mapalgebra
  - Mapping
@ -7729,7 +7774,6 @@ broken-packages:
  - Michelangelo
  - miconix-test
  - micro-recursion-schemes
-  - microaeson
  - microbase
  - microformats2-parser
  - microformats2-types
@ -7782,6 +7826,7 @@ broken-packages:
  - mlist
  - mltool
  - mm2
+  - mmsyn4
  - mmtf
  - mmtl
  - mmtl-base
@ -7883,6 +7928,7 @@ broken-packages:
  - moo
  - morfette
  - morfeusz
+  - morley
  - morpheus-graphql-cli
  - morpheus-graphql-client
  - morphisms-functors
@ -8029,6 +8075,9 @@ broken-packages:
  - nagios-plugin-ekg
  - nakadi-client
  - named-lock
+  - named-servant
+  - named-servant-client
+  - named-servant-server
  - namelist
  - nano-hmac
  - nano-md5
@ -8186,7 +8235,9 @@ broken-packages:
  - NoSlow
  - not-gloss-examples
  - notcpp
+  - nothunks
  - notifications-tray-icon
+  - notmuch
  - notmuch-haskell
  - notmuch-web
  - NoTrace
@ -8210,6 +8261,7 @@ broken-packages:
  - numeric-ranges
  - numerical
  - numhask-array
+  - numhask-free
  - numhask-hedgehog
  - numhask-histogram
  - numhask-prelude
@ -8279,6 +8331,8 @@ broken-packages:
  - op
  - opaleye-classy
  - opaleye-sqlite
+  - open-adt
+  - open-adt-tutorial
  - open-haddock
  - open-pandoc
  - open-signals
@ -8314,6 +8368,7 @@ broken-packages:
  - Operads
  - operate-do
  - operational-extra
+  - oplang
  - opml-conduit
  - opn
  - optima
@ -8343,6 +8398,7 @@ broken-packages:
  - origami
  - orizentic
  - OrPatterns
+  - orthotope
  - osc
  - oscpacking
  - oset
@ -8523,6 +8579,9 @@ broken-packages:
  - perfecthash
  - perhaps
  - periodic
+  - periodic-client
+  - periodic-client-exe
+  - periodic-server
  - perm
  - permutation
  - permutations
@ -8840,6 +8899,7 @@ broken-packages:
  - proj4-hs-bindings
  - project-m36
  - projectile
+  - prolens
  - prolog
  - prolog-graph
  - prolog-graph-lib
@ -8878,6 +8938,7 @@ broken-packages:
  - pseudo-trie
  - PTQ
  - ptr
+  - ptr-poker
  - publicsuffixlistcreate
  - publish
  - pubnub
@ -8915,6 +8976,7 @@ broken-packages:
  - puzzle-draw
  - puzzle-draw-cmdline
  - pvd
+  - PyF
  - pyffi
  - pyfi
  - python-pickle
@ -8923,6 +8985,7 @@ broken-packages:
  - qd
  - qd-vec
  - qed
+  - qhs
  - qhull-simple
  - qif
  - QIO
@ -9082,6 +9145,7 @@ broken-packages:
  - readpyc
  - readshp
  - really-simple-xml-parser
+  - reanimate
  - reasonable-lens
  - record
  - record-aeson
@ -9105,6 +9169,7 @@ broken-packages:
  - reenact
  - Ref
  - ref
+  - ref-extras
  - ref-mtl
  - refcount
  - Referees
@ -9295,10 +9360,12 @@ broken-packages:
  - rng-utils
  - rob
  - robin
+  - roboservant
  - robots-txt
  - roc-cluster
  - roc-cluster-demo
  - rock
+  - rocksdb-haskell
  - rocksdb-query
  - roku-api
  - rollbar
@ -9447,6 +9514,7 @@ broken-packages:
  - scotty-binding-play
  - scotty-blaze
  - scotty-fay
+  - scotty-form
  - scotty-format
  - scotty-hastache
  - scotty-haxl
@ -9524,6 +9592,7 @@ broken-packages:
  - serv-wai
  - servant-aeson-specs
  - servant-auth-cookie
+  - servant-auth-docs
  - servant-auth-hmac
  - servant-auth-token
  - servant-auth-token-acid
@ -9532,6 +9601,7 @@ broken-packages:
  - servant-auth-token-persistent
  - servant-auth-token-rocksdb
  - servant-avro
+  - servant-client-js
  - servant-client-namedargs
  - servant-csharp
  - servant-db
@ -9558,6 +9628,7 @@ broken-packages:
  - servant-matrix-param
  - servant-namedargs
  - servant-nix
+  - servant-openapi3
  - servant-pandoc
  - servant-pool
  - servant-postgresql
@ -9624,6 +9695,7 @@ broken-packages:
  - shake-cabal-build
  - shake-dhall
  - shake-extras
+  - shake-futhark
  - shake-minify
  - shake-pack
  - shake-path
@ -9675,8 +9747,10 @@ broken-packages:
  - sifflet
  - sifflet-lib
  - sigma-ij
+  - signable
  - signals
  - signed-multiset
+  - silkscreen
  - silvi
  - simd
  - simgi
@ -10002,7 +10076,6 @@ broken-packages:
  - stackage-types
  - stackage-upload
  - stackage2nix
-  - stan
  - standalone-derive-topdown
  - standalone-haddock
  - starling
@ -10041,7 +10114,9 @@ broken-packages:
  - stgi
  - STL
  - STLinkUSB
+  - stm-actor
  - stm-chunked-queues
+  - stm-containers
  - stm-firehose
  - stm-promise
  - stm-stats
@ -10742,6 +10817,7 @@ broken-packages:
  - Updater
  - uploadcare
  - upskirt
+  - urbit-airlock
  - ureader
  - urembed
  - uri
@ -10794,6 +10870,7 @@ broken-packages:
  - uuid-aeson
  - uuid-bytes
  - uuid-crypto
+  - uusi
  - uvector
  - uvector-algorithms
  - uxadt
@ -10908,6 +10985,7 @@ broken-packages:
  - vty-menu
  - vty-ui
  - vty-ui-extras
+  - vulkan-utils
  - waargonaut
  - wacom-daemon
  - waddle
@ -10991,9 +11069,11 @@ broken-packages:
  - web3
  - webapi
  - webapp
+  - webauthn
  - WebBits
  - WebBits-Html
  - WebBits-multiplate
+  - webby
  - webcloud
  - WebCont
  - webcrank
@ -11057,6 +11137,7 @@ broken-packages:
  - word2vec-model
  - WordAlignment
  - wordify
+  - wordn
  - WordNet
  - WordNet-ghc74
  - wordpass
@ -11160,6 +11241,7 @@ broken-packages:
  - xmonad-bluetilebranch
  - xmonad-contrib-bluetilebranch
  - xmonad-contrib-gpl
+  - xmonad-dbus
  - xmonad-eval
  - xmonad-vanessa
  - xmonad-windownames
@ -11338,6 +11420,8 @@ broken-packages:
  - yu-utils
  - yuuko
  - yxdb-utils
+  - Z-Data
+  - Z-IO
  - z3-encoding
  - z85
  - zabt
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@ -542,6 +542,7 @@ self: super: builtins.intersectAttrs super {

  # Break infinite recursion cycle between QuickCheck and splitmix.
  splitmix = dontCheck super.splitmix;
+  splitmix_0_1_0_3 = dontCheck super.splitmix_0_1_0_3;

  # Break infinite recursion cycle between tasty and clock.
  clock = dontCheck super.clock;
@ -730,6 +731,7 @@ self: super: builtins.intersectAttrs super {

  # break infinite recursion with base-orphans
  primitive = dontCheck super.primitive;
+  primitive_0_7_1_0 = dontCheck super.primitive_0_7_1_0;

  cut-the-crap =
    let path = pkgs.stdenv.lib.makeBinPath [ pkgs.ffmpeg_3 pkgs.youtube-dl ];
--- a/pkgs/development/haskell-modules/generic-builder.nix
+++ b/pkgs/development/haskell-modules/generic-builder.nix
@ -64,6 +64,7 @@ in
 , patches ? null, patchPhase ? null, prePatch ? "", postPatch ? ""
 , preConfigure ? null, postConfigure ? null
 , preBuild ? null, postBuild ? null
+, preHaddock ? null, postHaddock ? null
 , installPhase ? null, preInstall ? null, postInstall ? null
 , checkPhase ? null, preCheck ? null, postCheck ? null
 , preFixup ? null, postFixup ? null
@ -658,6 +659,8 @@ stdenv.mkDerivation ({
 // optionalAttrs (args ? checkPhase)             { inherit checkPhase; }
 // optionalAttrs (args ? preCheck)               { inherit preCheck; }
 // optionalAttrs (args ? postCheck)              { inherit postCheck; }
+// optionalAttrs (args ? preHaddock)             { inherit preHaddock; }
+// optionalAttrs (args ? postHaddock)            { inherit postHaddock; }
 // optionalAttrs (args ? preInstall)             { inherit preInstall; }
 // optionalAttrs (args ? installPhase)           { inherit installPhase; }
 // optionalAttrs (args ? postInstall)            { inherit postInstall; }
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
--- a/pkgs/development/interpreters/perl/default.nix
+++ b/pkgs/development/interpreters/perl/default.nix
@ -174,11 +174,11 @@ let
      priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
    };
  } // optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) rec {
-    crossVersion = "f59d2b6a179760230d925550db78b93c410433e4"; # Sept 22, 2020
+    crossVersion = "65e06e238ccb949e8399bdebc6d7fd798c34127b"; # Oct 21, 2020

    perl-cross-src = fetchurl {
      url = "https://github.com/arsv/perl-cross/archive/${crossVersion}.tar.gz";
-      sha256 = "1r07waq4ik4gf32c046f27pglwcy5rv9b6whj6497xbxfmaa5562";
+      sha256 = "1rk9kbvkj7cl3bvv6cph20f0hcb6y9ijgcd4rxj7aq98fxzvyhxx";
    };

    depsBuildBuild = [ buildPackages.stdenv.cc makeWrapper ];
@ -214,7 +214,7 @@ in {
  perldevel = common {
    perl = pkgs.perldevel;
    buildPerl = buildPackages.perldevel;
-    version = "5.33.2";
-    sha256 = "0zrb3d744argzy5idmafk92iprq9qbhzqbg4xj5w2i80sgg41212";
+    version = "5.33.3";
+    sha256 = "1k9pyy8d3wx8cpp5ss7hjwf9sxgga5gd0x2nq3vnqblkxfna0jsg";
  };
 }
--- a/pkgs/development/libraries/amdvlk/default.nix
+++ b/pkgs/development/libraries/amdvlk/default.nix
@ -21,13 +21,13 @@ let

 in stdenv.mkDerivation rec {
  pname = "amdvlk";
-  version = "2020.Q3.6";
+  version = "2020.Q4.1";

  src = fetchRepoProject {
    name = "${pname}-src";
    manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
    rev = "refs/tags/v-${version}";
-    sha256 = "05bvxxgaz94y85g1sq0jzjxd4j8vgdfan04q2fzmfcw3h6p7syjy";
+    sha256 = "UxUsXngsMbLNSmg0a7gqCqw30ckZ8IlDrSZMMnKHlh4=";
  };

  buildInputs = [
--- a/pkgs/development/libraries/aspell/dictionaries.nix
+++ b/pkgs/development/libraries/aspell/dictionaries.nix
@ -132,15 +132,15 @@ let
        # drop comments
        aspell-affix() {
          words-only \
-            | grep -v '#' \
+            | grep -a -v '#' \
            | aspell-create "$@"
        }

        # Hack: drop comments and words with affixes
        aspell-plain() {
          words-only \
-            | grep -v '#' \
-            | grep -v '/' \
+            | grep -a -v '#' \
+            | grep -a -v '/' \
            | aspell-create "$@"
        }

--- a/pkgs/development/libraries/intel-media-driver/default.nix
+++ b/pkgs/development/libraries/intel-media-driver/default.nix
@ -5,13 +5,13 @@

 stdenv.mkDerivation rec {
  pname = "intel-media-driver";
-  version = "20.2.0";
+  version = "20.3.0";

  src = fetchFromGitHub {
    owner  = "intel";
    repo   = "media-driver";
    rev    = "intel-media-${version}";
-    sha256 = "02a9wm7cz0nkpyfwic4a0dfm9bx1d2sybgh5rv0c618pl41mla33";
+    sha256 = "0dy30g32iqyygap3cm1idbhwnm1p3qvf2j2nzcr9n5im287h5gcr";
  };

  cmakeFlags = [
--- a/pkgs/development/libraries/libpsl/default.nix
+++ b/pkgs/development/libraries/libpsl/default.nix
@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
    lzip
    pkgconfig
    python3
-    valgrind
+    (stdenv.lib.optionalString (!stdenv.isDarwin) valgrind)
    libxslt
  ];

--- a/pkgs/development/libraries/openscenegraph/default.nix
+++ b/pkgs/development/libraries/openscenegraph/default.nix
@ -1,6 +1,7 @@
 { stdenv, lib, fetchFromGitHub, cmake, pkgconfig, doxygen,
  libX11, libXinerama, libXrandr, libGLU, libGL,
  glib, ilmbase, libxml2, pcre, zlib,
+  AGL, Carbon, Cocoa, Foundation,
  jpegSupport ? true, libjpeg,
  exrSupport ? false, openexr,
  gifSupport ? true, giflib,
@ -60,6 +61,7 @@ stdenv.mkDerivation rec {
    ++ lib.optional sdlSupport SDL2
    ++ lib.optionals restSupport [ asio boost ]
    ++ lib.optionals withExamples [ fltk wxGTK ]
+    ++ lib.optionals stdenv.isDarwin [ AGL Carbon Cocoa Foundation ]
  ;

  cmakeFlags = lib.optional (!withApps) "-DBUILD_OSG_APPLICATIONS=OFF" ++ lib.optional withExamples "-DBUILD_OSG_EXAMPLES=ON";
@ -68,7 +70,7 @@ stdenv.mkDerivation rec {
    description = "A 3D graphics toolkit";
    homepage = "http://www.openscenegraph.org/";
    maintainers = with maintainers; [ aanderse raskin ];
-    platforms = platforms.linux;
+    platforms = with platforms; linux ++ darwin;
    license = "OpenSceneGraph Public License - free LGPL-based license";
  };
 }
--- a/pkgs/development/libraries/pdal/default.nix
+++ b/pkgs/development/libraries/pdal/default.nix
@ -3,7 +3,7 @@
 , fetchpatch
 , cmake
 , pkg-config
-# , openscenegraph
+, openscenegraph
 , curl
 , gdal
 , hdf5-cpp
@ -20,34 +20,22 @@

 stdenv.mkDerivation rec {
  pname = "pdal";
-  version = "2.1.0";
+  version = "2.2.0";

  src = fetchFromGitHub {
    owner = "PDAL";
    repo = "PDAL";
    rev = version;
-    sha256 = "0zb3zjqgmjjryb648c1hmwh1nfa7893bjzbqpmr6shjxvzgnj9p6";
+    sha256 = "1i7nbfvv60jjlf3iq7a7xci4dycmg2wrd35dqvjwl6hpfynpb6wz";
  };

-  patches = [
-    # Fix duplicate paths like
-    #     /nix/store/7iafqfmjdlxqim922618wg87cclrpznr-PDAL-2.1.0//nix/store/7iafqfmjdlxqim922618wg87cclrpznr-PDAL-2.1.0/lib
-    # similar to https://github.com/NixOS/nixpkgs/pull/82654.
-    # TODO Remove on release > 2.1.0
-    (fetchpatch {
-      name = "pdal-Fixup-install-config.patch";
-      url = "https://github.com/PDAL/PDAL/commit/2f887ef624db50c6e20f091f34bb5d3e65b5c5c8.patch";
-      sha256 = "0pdw9v5ypq7w9i7qzgal110hjb9nqi386jvy3x2h4vf1dyalzid8";
-    })
-  ];
-
  nativeBuildInputs = [
    cmake
    pkg-config
  ];

  buildInputs = [
-    # openscenegraph
+    openscenegraph
    curl
    gdal
    hdf5-cpp
@ -68,11 +56,6 @@ stdenv.mkDerivation rec {
    "-DBUILD_PLUGIN_PGPOINTCLOUD=ON"
    "-DBUILD_PLUGIN_TILEDB=ON"

-    # Plugins that can probably be made working relatively easily:
-    # As of writing, seems to be incompatible (build error):
-    #     error: no matching function for call to 'osg::TriangleFunctor<pdal::CollectTriangles>::operator()(const Vec3&, const Vec3&, const Vec3&)'
-    "-DBUILD_PLUGIN_OPENSCENEGRAPH=OFF" # requires OpenGL
-
    # Plugins can probably not be made work easily:
    "-DBUILD_PLUGIN_CPD=OFF"
    "-DBUILD_PLUGIN_FBX=OFF" # Autodesk FBX SDK is gratis+proprietary; not packaged in nixpkgs
--- a/pkgs/development/libraries/pipewire/alsa-profiles-use-libdir.patch
+++ b/pkgs/development/libraries/pipewire/alsa-profiles-use-libdir.patch
@ -0,0 +1,13 @@
+diff --git a/meson.build b/meson.build
+index ffee41b4..f3e4ec74 100644
+--- a/meson.build
+++ b/meson.build
+@@ -53,7 +53,7 @@ endif
+ 
+ spa_plugindir = join_paths(pipewire_libdir, spa_name)
+ 
+-alsadatadir = join_paths(pipewire_datadir, 'alsa-card-profile', 'mixer')
+alsadatadir = join_paths(pipewire_libdir, '..', 'share', 'alsa-card-profile', 'mixer')
+ 
+ pipewire_headers_dir = join_paths(pipewire_name, 'pipewire')
+ 
--- a/pkgs/development/libraries/pipewire/default.nix
+++ b/pkgs/development/libraries/pipewire/default.nix
@ -1,89 +1,146 @@
 { stdenv
+, lib
 , fetchFromGitLab
 , fetchpatch
+, removeReferencesTo
 , meson
 , ninja
+, systemd
 , pkgconfig
 , doxygen
 , graphviz
 , valgrind
 , glib
 , dbus
-, gst_all_1
 , alsaLib
-, ffmpeg_3
 , libjack2
 , udev
 , libva
-, xorg
-, sbc
-, SDL2
 , libsndfile
-, bluez
 , vulkan-headers
 , vulkan-loader
 , libpulseaudio
 , makeFontsConf
+, callPackage
+, nixosTests
+, gstreamerSupport ? true, gst_all_1 ? null
+, ffmpegSupport ? true, ffmpeg ? null
+, bluezSupport ? true, bluez ? null, sbc ? null
+, nativeHspSupport ? true
+, ofonoSupport ? true
+, hsphfpdSupport ? false
 }:

 let
  fontsConf = makeFontsConf {
    fontDirectories = [];
  };
+
+  mesonBool = b: if b then "true" else "false";
 in
 stdenv.mkDerivation rec {
  pname = "pipewire";
-  version = "0.3.7";
+  version = "0.3.13";

-  outputs = [ "out" "lib" "dev" "doc" ];
+  outputs = [
+    "out"
+    "lib"
+    "pulse"
+    "jack"
+    "dev"
+    "doc"
+    "installedTests"
+  ];

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "pipewire";
    repo = "pipewire";
    rev = version;
-    sha256 = "04l66p0wj553gp2zf3vwwh6jbr1vkf6wrq4za9zlm9dn144am4j2";
+    sha256 = "19j5kmb7iaivkq2agfzncfm2qms41ckqi0ddxvhpc91ihwprdc5w";
  };

+  patches = [
+    # Break up a dependency cycle between outputs.
+    ./alsa-profiles-use-libdir.patch
+    # Move installed tests into their own output.
+    ./installed-tests-path.patch
+
+    # TODO Remove this on next update
+    # Fixes rpath referencecs.
+    (fetchpatch {
+      url = "https://gitlab.freedesktop.org/pipewire/pipewire/commit/2e3556fa128b778be62a7ffad5fbe78393035825.diff";
+      sha256 = "039yysb8j1aiqml54rxnaqfmzqz1b6m8sv5w3vz52grvav3kyr1l";
+    })
+  ];
+
  nativeBuildInputs = [
    doxygen
    graphviz
    meson
    ninja
    pkgconfig
-    valgrind
+    removeReferencesTo
  ];

  buildInputs = [
-    SDL2
    alsaLib
-    bluez
    dbus
-    ffmpeg_3
    glib
-    gst_all_1.gst-plugins-base
-    gst_all_1.gstreamer
    libjack2
    libpulseaudio
    libsndfile
-    libva
-    sbc
    udev
    vulkan-headers
    vulkan-loader
-    xorg.libX11
-  ];
+    valgrind
+    systemd
+  ] ++ lib.optionals gstreamerSupport [ gst_all_1.gst-plugins-base gst_all_1.gstreamer ]
+  ++ lib.optional ffmpegSupport ffmpeg
+  ++ lib.optionals bluezSupport [ bluez sbc ];

  mesonFlags = [
    "-Ddocs=true"
    "-Dman=false" # we don't have xmltoman
-    "-Dgstreamer=true"
+    "-Dexamples=true" # only needed for `pipewire-media-session`
+    "-Dudevrulesdir=lib/udev/rules.d"
+    "-Dinstalled_tests=true"
+    "-Dinstalled_test_prefix=${placeholder "installedTests"}"
+    "-Dlibpulse-path=${placeholder "pulse"}/lib"
+    "-Dlibjack-path=${placeholder "jack"}/lib"
+    "-Dgstreamer=${mesonBool gstreamerSupport}"
+    "-Dffmpeg=${mesonBool ffmpegSupport}"
+    "-Dbluez5=${mesonBool bluezSupport}"
+    "-Dbluez5-backend-native=${mesonBool nativeHspSupport}"
+    "-Dbluez5-backend-ofono=${mesonBool ofonoSupport}"
+    "-Dbluez5-backend-hsphfpd=${mesonBool hsphfpdSupport}"
  ];

  FONTCONFIG_FILE = fontsConf; # Fontconfig error: Cannot load default config file

  doCheck = true;

+  # Pulseaudio asserts lead to dev references.
+  # TODO This should be fixed in the pulseaudio sources instead.
+  preFixup = ''
+    remove-references-to -t ${libpulseaudio.dev} "$(readlink -f $pulse/lib/libpulse.so)"
+  '';
+
+  passthru.tests = {
+    installedTests = nixosTests.installed-tests.pipewire;
+
+    # This ensures that all the paths used by the NixOS module are found.
+    test-paths = callPackage ./test-paths.nix {
+      paths-out = [
+        "share/alsa/alsa.conf.d/50-pipewire.conf"
+      ];
+      paths-lib = [
+        "lib/alsa-lib/libasound_module_pcm_pipewire.so"
+        "share/alsa-card-profile/mixer"
+      ];
+    };
+  };
+
  meta = with stdenv.lib; {
    description = "Server and user space API to deal with multimedia pipelines";
    homepage = "https://pipewire.org/";
--- a/pkgs/development/libraries/pipewire/installed-tests-path.patch
+++ b/pkgs/development/libraries/pipewire/installed-tests-path.patch
@ -0,0 +1,29 @@
+diff --git a/meson.build b/meson.build
+index ffee41b4..bab6f019 100644
+--- a/meson.build
+++ b/meson.build
+@@ -318,8 +318,8 @@ alsa_dep = (get_option('pipewire-alsa')
+     ? dependency('alsa', version : '>=1.1.7')
+     : dependency('', required: false))
+ 
+-installed_tests_metadir = join_paths(pipewire_datadir, 'installed-tests', pipewire_name)
+-installed_tests_execdir = join_paths(pipewire_libexecdir, 'installed-tests', pipewire_name)
+installed_tests_metadir = join_paths(get_option('installed_test_prefix'), 'share', 'installed-tests', pipewire_name)
+installed_tests_execdir = join_paths(get_option('installed_test_prefix'), 'libexec', 'installed-tests', pipewire_name)
+ installed_tests_enabled = get_option('installed_tests')
+ installed_tests_template = files('template.test.in')
+ 
+diff --git a/meson_options.txt b/meson_options.txt
+index f03033c3..32df6c53 100644
+--- a/meson_options.txt
+++ b/meson_options.txt
+@@ -18,6 +18,9 @@ option('installed_tests',
+        description: 'Install manual and automated test executables',
+        type: 'boolean',
+        value: false)
+option('installed_test_prefix',
+       description: 'Prefix for installed tests',
+       type: 'string')
+ option('gstreamer',
+        description: 'Build GStreamer plugins',
+        type: 'boolean',
--- a/pkgs/development/libraries/pipewire/test-paths.nix
+++ b/pkgs/development/libraries/pipewire/test-paths.nix
@ -0,0 +1,23 @@
+{ lib, runCommand, pipewire, paths-out, paths-lib }:
+
+let
+  check-path = output: path: ''
+    if [[ ! -f "${output}/${path}" && ! -d "${output}/${path}" ]]; then
+      printf "Missing: %s\n" "${output}/${path}" | tee -a $out
+      error=error
+    else
+      printf "Found: %s\n" "${output}/${path}" | tee -a $out
+    fi
+  '';
+
+  check-output = output: lib.concatMapStringsSep "\n" (check-path output);
+in runCommand "pipewire-test-paths" { } ''
+  touch $out
+
+  ${check-output pipewire.lib paths-lib}
+  ${check-output pipewire paths-out}
+
+  if [[ -n "$error" ]]; then
+    exit 1
+  fi
+''
--- a/pkgs/development/libraries/srt/default.nix
+++ b/pkgs/development/libraries/srt/default.nix
@ -4,13 +4,13 @@
 with stdenv.lib;
 stdenv.mkDerivation rec {
  pname = "srt";
-  version = "1.4.1";
+  version = "1.4.2";

  src = fetchFromGitHub {
    owner = "Haivision";
    repo = "srt";
    rev = "v${version}";
-    sha256 = "01xaq44j95kbgqfl41pnybvqy0yq6wd4wdw88ckylzf0nzp977xz";
+    sha256 = "01nx3a35hzq2x0dvp2n2b86phpdy1z83kdraag7aq3hmc7f8iagg";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/development/misc/haskell/hasura/graphql-engine/default.nix
+++ b/pkgs/development/misc/haskell/hasura/graphql-engine/default.nix
@ -70,4 +70,6 @@ mkDerivation {
  description = "GraphQL API over Postgres";
  license = stdenv.lib.licenses.asl20;
  maintainers = with stdenv.lib.maintainers; [ offline ];
+  hydraPlatforms = [];
+  broken = true;
 }
--- a/pkgs/development/ocaml-modules/yaml/default.nix
+++ b/pkgs/development/ocaml-modules/yaml/default.nix
@ -1,17 +1,21 @@
 { lib, fetchurl, buildDunePackage
+, dune-configurator
 , ppx_sexp_conv
 , bos, ctypes, fmt, logs, rresult, sexplib
 }:

 buildDunePackage rec {
  pname = "yaml";
-  version = "2.0.1";
+  version = "2.1.0";
+
+  useDune2 = true;

  src = fetchurl {
    url = "https://github.com/avsm/ocaml-yaml/releases/download/v${version}/yaml-v${version}.tbz";
-    sha256 = "1r8jj572h416g2zliwmxj2j9hkv73nxnpfb9gmbj9gixg24lskx0";
+    sha256 = "03g8vsh5jgi1cm5q78v15slgnzifp91fp7n4v1i7pa8yk0bkh585";
  };

+  buildInputs = [ dune-configurator ];
  propagatedBuildInputs = [ bos ctypes fmt logs ppx_sexp_conv rresult sexplib ];

  meta = {
--- a/pkgs/development/python-modules/ftputil/default.nix
+++ b/pkgs/development/python-modules/ftputil/default.nix
@ -1,4 +1,4 @@
-{ lib, buildPythonPackage, fetchPypi, pythonOlder, pytest, freezegun }:
+{ stdenv, lib, buildPythonPackage, fetchPypi, pythonOlder, pytest, freezegun }:

 buildPythonPackage rec {
  version = "4.0.0";
@ -18,12 +18,15 @@ buildPythonPackage rec {
    py.test test \
      -k "not test_public_servers and not test_real_ftp \
          and not test_set_parser and not test_repr \
-          and not test_conditional_upload and not test_conditional_download_with_older_target"
-  '';
+          and not test_conditional_upload and not test_conditional_download_with_older_target \
+  ''
+  # need until https://ftputil.sschwarzer.net/trac/ticket/140#ticket is fixed
+  + lib.optionalString stdenv.isDarwin ''and not test_error_message_reuse''
+  + ''"'';

  meta = with lib; {
    description = "High-level FTP client library (virtual file system and more)";
-    homepage    = "http://ftputil.sschwarzer.net/";
-    license     = licenses.bsd2; # "Modified BSD license, says pypi"
+    homepage = "http://ftputil.sschwarzer.net/";
+    license = licenses.bsd2; # "Modified BSD license, says pypi"
  };
 }
--- a/pkgs/development/python-modules/google-api-python-client/default.nix
+++ b/pkgs/development/python-modules/google-api-python-client/default.nix
@ -4,11 +4,11 @@

 buildPythonPackage rec {
  pname = "google-api-python-client";
-  version = "1.12.4";
+  version = "1.12.5";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "1mn20wzy2001wk75br2qfx73yj8dx056f9xgkcri6w8hmbhm1f6l";
+    sha256 = "0a989wynp0m1pj8qpa0mr8v8zxhazasc738nyb15wkhn1m4wv4hq";
  };

  # No tests included in archive
--- a/pkgs/development/python-modules/imdbpy/default.nix
+++ b/pkgs/development/python-modules/imdbpy/default.nix
@ -0,0 +1,25 @@
+{ lib, buildPythonPackage, fetchPypi, lxml, sqlalchemy }:
+
+buildPythonPackage rec {
+  pname = "IMDbPY";
+  version = "2020.9.25";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "1p3j9j1jcgbw4626cvgpryhvczy9gzlg0laz6lflgq17m129gin2";
+  };
+
+  patches = [ ./sql_error.patch ]; # Already fixed in master, but not yet in the current release. This can be removed upon the next version update
+
+  propagatedBuildInputs = [ lxml sqlalchemy ];
+
+  doCheck = false; # Tests require networking, and https://github.com/alberanid/imdbpy/issues/240
+  pythonImportsCheck = [ "imdb" ];
+
+  meta = with lib; {
+    homepage = "https://imdbpy.github.io/";
+    description = "A Python package for retrieving and managing the data of the IMDb database";
+    maintainers = [ maintainers.ivar ];
+    license = licenses.gpl2Only;
+  };
+}
--- a/pkgs/development/python-modules/imdbpy/sql_error.patch
+++ b/pkgs/development/python-modules/imdbpy/sql_error.patch
@ -0,0 +1,39 @@
+diff --git a/imdb/parser/sql/__init__.py b/imdb/parser/sql/__init__.py
+index cd4a3e3..3fcfdd4 100644
+--- a/imdb/parser/sql/__init__.py
+++ b/imdb/parser/sql/__init__.py
+@@ -557,7 +557,6 @@ class IMDbSqlAccessSystem(IMDbBase):
+     """The class used to access IMDb's data through a SQL database."""
+
+     accessSystem = 'sql'
+-    _sql_logger = logging.getLogger('imdbpy.parser.sql')
+
+     def __init__(self, uri, adultSearch=True, *arguments, **keywords):
+         """Initialize the access system."""
+@@ -582,7 +581,7 @@ class IMDbSqlAccessSystem(IMDbBase):
+         except ImportError as e:
+             raise IMDbError('unable to import SQLAlchemy')
+         # Set the connection to the database.
+-        self._sql_logger.debug('connecting to %s', uri)
+        logger.debug('connecting to %s', uri)
+         try:
+             self._connection = setConnection(uri, DB_TABLES)
+         except AssertionError as e:
+@@ -593,7 +592,7 @@ class IMDbSqlAccessSystem(IMDbBase):
+         # Maps some IDs to the corresponding strings.
+         self._kind = {}
+         self._kindRev = {}
+-        self._sql_logger.debug('reading constants from the database')
+        logger.debug('reading constants from the database')
+         try:
+             for kt in KindType.select():
+                 self._kind[kt.id] = kt.kind
+@@ -1616,7 +1615,7 @@ class IMDbSqlAccessSystem(IMDbBase):
+         return
+         if not hasattr(self, '_connection'):
+             return
+-        self._sql_logger.debug('closing connection to the database')
+        logger.debug('closing connection to the database')
+         try:
+             self._connection.close()
+         except:
--- a/pkgs/development/python-modules/pyobjc/default.nix
+++ b/pkgs/development/python-modules/pyobjc/default.nix
@ -16,7 +16,7 @@ buildPythonPackage rec {
  meta = {
    description = "A bridge between the Python and Objective-C programming languages";
    license = stdenv.lib.licenses.mit;
-    maintainers = with stdenv.lib.maintainers; [ sauyon ];
+    maintainers = with stdenv.lib.maintainers; [ ];
    homepage = "https://pythonhosted.org/pyobjc/";
  };
 }
--- a/pkgs/development/python-modules/pyotp/default.nix
+++ b/pkgs/development/python-modules/pyotp/default.nix
@ -1,14 +1,17 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib, buildPythonPackage, fetchPypi, isPy27 }:

 buildPythonPackage rec {
  pname = "pyotp";
  version = "2.4.0";
+  disabled = isPy27;

  src = fetchPypi {
    inherit pname version;
    sha256 = "01eceab573181188fe038d001e42777884a7f5367203080ef5bda0e30fe82d28";
  };

+  pythonImportsCheck = [ "pyotp" ];
+
  meta = with lib; {
    description = "Python One Time Password Library";
    homepage = "https://github.com/pyotp/pyotp";
--- a/pkgs/development/python-modules/pyside/shiboken.nix
+++ b/pkgs/development/python-modules/pyside/shiboken.nix
@ -1,22 +1,37 @@
-{ lib, fetchurl, cmake, buildPythonPackage, libxml2, libxslt, pysideApiextractor, pysideGeneratorrunner, python, sphinx, qt4, isPy3k, isPy35, isPy36, isPy37 }:
+{ lib, fetchFromGitHub, buildPythonPackage
+, cmake
+, isPy35
+, isPy36
+, isPy37
+, isPy3k
+, libxml2
+, libxslt
+, pkg-config
+, pysideApiextractor
+, pysideGeneratorrunner
+, python
+, qt4
+, sphinx
+}:

-# This derivation provides a Python module and should therefore be called via `python-packages.nix`.
-# Python 3.5 is not supported: https://github.com/PySide/Shiboken/issues/77
 buildPythonPackage rec {
  pname = "pyside-shiboken";
  version = "1.2.4";
-
  format = "other";
+  disabled = !isPy3k;

-  src = fetchurl {
-    url = "https://github.com/PySide/Shiboken/archive/${version}.tar.gz";
-    sha256 = "1536f73a3353296d97a25e24f9554edf3e6a48126886f8d21282c3645ecb96a4";
+  src = fetchFromGitHub {
+    owner = "PySide";
+    repo = "Shiboken";
+    rev = version;
+    sha256 = "0x2lyg52m6a0vn0665pgd1z1qrydglyfxxcggw6xzngpnngb6v5v";
  };

-
  enableParallelBuilding = true;

-  nativeBuildInputs = [ cmake libxml2 libxslt pysideApiextractor pysideGeneratorrunner python sphinx qt4 ];
+  nativeBuildInputs = [ cmake pkg-config pysideApiextractor pysideGeneratorrunner sphinx qt4 ];
+
+  buildInputs = [ python libxml2 libxslt ];

  preConfigure = ''
    echo "preConfigure: Fixing shiboken_generator install target."
@ -27,7 +42,11 @@ buildPythonPackage rec {
  # gcc6 patch was also sent upstream: https://github.com/pyside/Shiboken/pull/86
  patches = [ ./gcc6.patch ] ++ (lib.optional (isPy35 || isPy36 || isPy37) ./shiboken_py35.patch);

-  cmakeFlags = lib.optional isPy3k "-DUSE_PYTHON3=TRUE";
+  cmakeFlags = lib.optionals isPy3k [
+    "-DUSE_PYTHON3=TRUE"
+    "-DPYTHON3_INCLUDE_DIR=${lib.getDev python}/include/${python.libPrefix}"
+    "-DPYTHON3_LIBRARY=${lib.getLib python}/lib"
+  ];

  meta = {
    description = "Plugin (front-end) for pyside-generatorrunner, that generates bindings for C++ libraries using CPython source code";
--- a/pkgs/development/python-modules/pystray/default.nix
+++ b/pkgs/development/python-modules/pystray/default.nix
@ -26,6 +26,7 @@ buildPythonPackage rec {
    homepage = "https://github.com/moses-palmer/pystray";
    description = "This library allows you to create a system tray icon";
    license = licenses.lgpl3;
+    platforms = platforms.linux;
    maintainers = with maintainers; [ jojosch ];
  };
 }
--- a/pkgs/development/r-modules/default.nix
+++ b/pkgs/development/r-modules/default.nix
@ -797,6 +797,9 @@ let
    });

    openssl = old.openssl.overrideDerivation (attrs: {
+      preConfigure = ''
+        patchShebangs configure
+        '';
      PKGCONFIG_CFLAGS = "-I${pkgs.openssl.dev}/include";
      PKGCONFIG_LIBS = "-Wl,-rpath,${pkgs.openssl.out}/lib -L${pkgs.openssl.out}/lib -lssl -lcrypto";
    });
--- a/pkgs/development/tools/analysis/valgrind/default.nix
+++ b/pkgs/development/tools/analysis/valgrind/default.nix
@ -86,5 +86,6 @@ stdenv.mkDerivation rec {
      "riscv32-linux" "riscv64-linux"
      "alpha-linux"
    ];
+    broken = stdenv.isDarwin; # https://hydra.nixos.org/build/128521440/nixlog/2
  };
 }
--- a/pkgs/development/tools/buildah/default.nix
+++ b/pkgs/development/tools/buildah/default.nix
@ -14,13 +14,13 @@

 buildGoModule rec {
  pname = "buildah";
-  version = "1.16.4";
+  version = "1.16.5";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "buildah";
    rev = "v${version}";
-    sha256 = "1i7v4chbgl15n3vn1liinjd4lxaxk9q2lyi1l2ak7iazx9px6cn9";
+    sha256 = "1d2k7n1d9mpkyjy7hp1svl34ssai62df3mp5awsill092dlwn8p2";
  };

  outputs = [ "out" "man" ];
--- a/pkgs/misc/emulators/pcsx2/default.nix
+++ b/pkgs/misc/emulators/pcsx2/default.nix
@ -1,21 +1,19 @@
-{ alsaLib, cmake, fetchFromGitHub, glib, gettext, gtk2, harfbuzz, lib, libaio
-, libpng, libpcap, libxml2, makeWrapper, perl, pkgconfig, portaudio
-, SDL2, soundtouch, stdenv, udev, wxGTK, zlib
+{ alsaLib, cmake, fetchFromGitHub, gcc-unwrapped, gettext, glib, gtk3, harfbuzz
+, libaio, libpcap, libpng, libxml2, makeWrapper, perl, pkgconfig, portaudio
+, SDL2, soundtouch, stdenv, udev, wrapGAppsHook, wxGTK, zlib
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
  pname = "pcsx2";
-  version = "1.6.0";
+  version = "unstable-2020-10-10";

  src = fetchFromGitHub {
    owner = "PCSX2";
    repo = "pcsx2";
-    rev = "v${version}";
-    sha256 = "0528kh3275285lvfsykycdhc35c1z8pmccl2s7dfi3va2cp4x8wa";
+    rev = "7e2ccd64e8e6049b6059141e8767037463421c33";
+    sha256 = "0c7m74ch68p4y9xlld34a9r38kb2py6wlkg4vranc6dicxvi1b3r";
  };

-  postPatch = "sed '1i#include \"x86intrin.h\"' -i common/src/x86emitter/cpudetect.cpp";
-
  cmakeFlags = [
    "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}"
    "-DDISABLE_ADVANCE_SIMD=TRUE"
@ -23,31 +21,36 @@ stdenv.mkDerivation rec {
    "-DDOC_DIR=${placeholder "out"}/share/doc/pcsx2"
    "-DGAMEINDEX_DIR=${placeholder "out"}/share/pcsx2"
    "-DGLSL_SHADER_DIR=${placeholder "out"}/share/pcsx2"
-    "-DwxWidgets_LIBRARIES=${wxGTK}/lib"
-    "-DwxWidgets_INCLUDE_DIRS=${wxGTK}/include"
-    "-DwxWidgets_CONFIG_EXECUTABLE=${wxGTK}/bin/wx-config"
+    "-DGTK3_API=TRUE"
    "-DPACKAGE_MODE=TRUE"
    "-DPLUGIN_DIR=${placeholder "out"}/lib/pcsx2"
    "-DREBUILD_SHADER=TRUE"
+    "-DUSE_LTO=TRUE"
+    "-DwxWidgets_CONFIG_EXECUTABLE=${wxGTK}/bin/wx-config"
+    "-DwxWidgets_INCLUDE_DIRS=${wxGTK}/include"
+    "-DwxWidgets_LIBRARIES=${wxGTK}/lib"
    "-DXDG_STD=TRUE"
-    "-DGTK2_GLIBCONFIG_INCLUDE_DIR=${glib.out}/lib/glib-2.0/include"
-    "-DGTK2_GDKCONFIG_INCLUDE_DIR=${gtk2.out}/lib/gtk-2.0/include"
-    "-DGTK2_INCLUDE_DIRS=${gtk2.dev}/include/gtk-2.0"
-    "-DGTK3_API=FALSE"
  ];

+  postPatch = ''
+    substituteInPlace cmake/BuildParameters.cmake \
+      --replace /usr/bin/gcc-ar ${gcc-unwrapped}/bin/gcc-ar \
+      --replace /usr/bin/gcc-nm ${gcc-unwrapped}/bin/gcc-nm \
+      --replace /usr/bin/gcc-ranlib ${gcc-unwrapped}/bin/gcc-ranlib
+  '';
+
  postFixup = ''
    wrapProgram $out/bin/PCSX2 \
      --set __GL_THREADED_OPTIMIZATIONS 1
  '';

-  nativeBuildInputs = [ cmake makeWrapper perl pkgconfig ];
+  nativeBuildInputs = [ cmake makeWrapper perl pkgconfig wrapGAppsHook ];

  buildInputs = [
    alsaLib
-    glib
    gettext
-    gtk2
+    glib
+    gtk3
    harfbuzz
    libaio
    libpcap
@ -71,13 +74,13 @@ stdenv.mkDerivation rec {
      PC, with many additional features and benefits.
    '';
    homepage = "https://pcsx2.net";
-    maintainers = with maintainers; [ hrdinka ];
+    maintainers = with maintainers; [ hrdinka samuelgrf ];

    # PCSX2's source code is released under LGPLv3+. It However ships
    # additional data files and code that are licensed differently.
    # This might be solved in future, for now we should stick with
    # license.free
    license = licenses.free;
-    platforms = platforms.i686;
+    platforms = platforms.x86;
  };
 }
--- a/pkgs/os-specific/linux/alsa-utils/default.nix
+++ b/pkgs/os-specific/linux/alsa-utils/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "alsa-utils";
-  version = "1.2.3";
+  version = "1.2.4";

  src = fetchurl {
    url = "mirror://alsa/utils/${pname}-${version}.tar.bz2";
-    sha256 = "1ai1z4kf91b1m3qrpwqkc1af5vm2fkdkknqv95xdwf19q94aw6gz";
+    sha256 = "09m4dnn4kplawprd2bl15nwa0b4r1brab3x44ga7f1fyk7aw5zwq";
  };

  nativeBuildInputs = [ gettext ];
--- a/pkgs/servers/http/couchdb/3.nix
+++ b/pkgs/servers/http/couchdb/3.nix
@ -3,14 +3,14 @@

 stdenv.mkDerivation rec {
  pname = "couchdb";
-  version = "3.1.0";
+  version = "3.1.1";


  # when updating this, please consider bumping the erlang/OTP version
  # in all-packages.nix
  src = fetchurl {
    url = "mirror://apache/couchdb/source/${version}/apache-${pname}-${version}.tar.gz";
-    sha256 = "1vgqj3zsrkdqgnwzji3mqkapnfd6kq466f5xnya0fvzzl6bcfrs8";
+    sha256 = "18wcqxrv2bz88xadkqpqznprrxmcmwr0g6k895xrm8rbp9mpdzlg";
  };

  buildInputs = [ erlang icu openssl spidermonkey_68 (python3.withPackages(ps: with ps; [ requests ]))];
--- a/pkgs/servers/monitoring/prometheus/rtl_433-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/rtl_433-exporter.nix
@ -0,0 +1,26 @@
+{ lib, buildGoModule, fetchFromGitHub, bash, nixosTests }:
+
+buildGoModule rec {
+  pname = "rtl_433-exporter";
+  version = "0.1";
+
+  src = fetchFromGitHub {
+    owner = "mhansen";
+    repo = "rtl_433_prometheus";
+    rev = "v${version}";
+    sha256 = "1998gvfa5310bxhi6kfv8bn99369dxph3pwrpp335997b25lc2w2";
+  };
+
+  postPatch = "substituteInPlace rtl_433_prometheus.go --replace /bin/bash ${bash}/bin/bash";
+
+  vendorSha256 = "03mnmzq72844hzyw7iq5g4gm1ihpqkg4i9dgj2yln1ghwk843hq6";
+
+  passthru.tests = { inherit (nixosTests.prometheus-exporters) rtl_433; };
+
+  meta = with lib; {
+    description = "Prometheus time-series DB exporter for rtl_433 433MHz radio packet decoder";
+    homepage = "https://github.com/mhansen/rtl_433_prometheus";
+    license = licenses.mit;
+    maintainers = with maintainers; [ zopieux ];
+  };
+}
--- a/pkgs/servers/sql/mariadb/default.nix
+++ b/pkgs/servers/sql/mariadb/default.nix
@ -23,14 +23,14 @@ mariadb = server // {
 };

 common = rec { # attributes common to both builds
-  version = "10.4.14";
+  version = "10.4.15";

  src = fetchurl {
    urls = [
      "https://downloads.mariadb.org/f/mariadb-${version}/source/mariadb-${version}.tar.gz"
      "https://downloads.mariadb.com/MariaDB/mariadb-${version}/source/mariadb-${version}.tar.gz"
    ];
-    sha256 = "1z469j39chq7d3dp39cljjbzcz0wl1g7rii85x46290jw1cwsbzr";
+    sha256 = "0cdfzr768cb7n9ag9gqahr8c6igfn513md67xn4rf98ajmnxg0r7";
    name   = "mariadb-${version}.tar.gz";
  };

--- a/pkgs/servers/sql/monetdb/default.nix
+++ b/pkgs/servers/sql/monetdb/default.nix
@ -1,24 +1,23 @@
-{ stdenv, fetchurl, pkgconfig, file
+{ stdenv, fetchurl, cmake, python3
 , bison, openssl, readline, bzip2
 }:

-let
-  version = "11.37.11";
-in stdenv.mkDerivation {
-
+stdenv.mkDerivation rec {
  pname = "monetdb";
-  inherit version;
+  version = "11.39.5";

  src = fetchurl {
    url = "https://dev.monetdb.org/downloads/sources/archive/MonetDB-${version}.tar.bz2";
-    sha256 = "0ch4vka64m5fbyah2730rcv7xpgy4hq26vbi8wd8mkadwna7azr5";
+    sha256 = "1hdlab2gcj71yw6sb3yvl8s027blcsyvch3n5sgi0a2yz84wj765";
  };

  postPatch = ''
-    sed -i "s,/usr/bin/file,${file}/bin/file," configure
+    substituteInPlace cmake/monetdb-packages.cmake --replace \
+      'get_os_release_info(LINUX_DISTRO LINUX_DISTRO_VERSION)' \
+      'set(LINUX_DISTRO "nixos")'
  '';

-  nativeBuildInputs = [ pkgconfig file ];
+  nativeBuildInputs = [ cmake python3 ];
  buildInputs = [ bison openssl readline bzip2 ];

  meta = with stdenv.lib; {
--- a/pkgs/servers/tailscale/default.nix
+++ b/pkgs/servers/tailscale/default.nix
@ -21,6 +21,13 @@ buildGoModule rec {

  subPackages = [ "cmd/tailscale" "cmd/tailscaled" ];

+  preBuild = ''
+    export buildFlagsArray=(
+      -tags="xversion"
+      -ldflags="-X tailscale.com/version.LONG=${version} -X tailscale.com/version.SHORT=${version}"
+    )
+  '';
+
  postInstall = ''
    wrapProgram $out/bin/tailscaled --prefix PATH : ${
      lib.makeBinPath [ iproute iptables ]
--- a/pkgs/servers/x11/xorg/default.nix
+++ b/pkgs/servers/x11/xorg/default.nix
@ -2692,11 +2692,11 @@ lib.makeScope newScope (self: with self; {
  }) {};

  xorgserver = callPackage ({ stdenv, pkgconfig, fetchurl, xorgproto, openssl, libX11, libXau, libXaw, libxcb, xcbutil, xcbutilwm, xcbutilimage, xcbutilkeysyms, xcbutilrenderutil, libXdmcp, libXfixes, libxkbfile, libXmu, libXpm, libXrender, libXres, libXt }: stdenv.mkDerivation {
-    name = "xorg-server-1.20.8";
+    name = "xorg-server-1.20.9";
    builder = ./builder.sh;
    src = fetchurl {
-      url = "mirror://xorg/individual/xserver/xorg-server-1.20.8.tar.bz2";
-      sha256 = "0ih15m7gh1z1ly6z7g82bkni719yisqmbk61a1wgp82bxrmn8yyi";
+      url = "mirror://xorg/individual/xserver/xorg-server-1.20.9.tar.bz2";
+      sha256 = "0w9mrnffvjgmwi50kln15i8rpdskxv97r78l75wlcmg4vzhg46g2";
    };
    hardeningDisable = [ "bindnow" "relro" ];
    nativeBuildInputs = [ pkgconfig ];
--- a/pkgs/servers/x11/xorg/overrides.nix
+++ b/pkgs/servers/x11/xorg/overrides.nix
@ -635,6 +635,16 @@ self: super:
        propagatedBuildInputs = attrs.propagatedBuildInputs or [] ++ [ libpciaccess epoxy ] ++ commonPropagatedBuildInputs ++ lib.optionals stdenv.isLinux [
          udev
        ];
+        # patchPhase is not working, this is a hack but we can remove it in the next xorg-server release
+        preConfigure = let
+          # https://gitlab.freedesktop.org/xorg/xserver/-/issues/1067
+          headerFix = fetchpatch {
+            url = "https://gitlab.freedesktop.org/xorg/xserver/-/commit/919f1f46fc67dae93b2b3f278fcbfc77af34ec58.patch";
+            sha256 = "0w48rdpl01v0c97n9zdxhf929y76r1f6rqkfs9mfygkz3xcmrfsq";
+          };
+        in ''
+          patch -p1 < ${headerFix}
+        '';
        prePatch = stdenv.lib.optionalString stdenv.hostPlatform.isMusl ''
          export CFLAGS+=" -D__uid_t=uid_t -D__gid_t=gid_t"
        '';
--- a/pkgs/servers/x11/xorg/tarballs.list
+++ b/pkgs/servers/x11/xorg/tarballs.list
@ -218,4 +218,4 @@ mirror://xorg/individual/util/lndir-1.0.3.tar.bz2
 mirror://xorg/individual/util/makedepend-1.0.6.tar.bz2
 mirror://xorg/individual/util/util-macros-1.19.2.tar.bz2
 mirror://xorg/individual/util/xorg-cf-files-1.0.6.tar.bz2
-mirror://xorg/individual/xserver/xorg-server-1.20.8.tar.bz2
+mirror://xorg/individual/xserver/xorg-server-1.20.9.tar.bz2
--- a/pkgs/tools/admin/salt/default.nix
+++ b/pkgs/tools/admin/salt/default.nix
@ -7,11 +7,11 @@
 }:
 python3.pkgs.buildPythonApplication rec {
  pname = "salt";
-  version = "3001.1";
+  version = "3002";

  src = python3.pkgs.fetchPypi {
    inherit pname version;
-    sha256 = "1g2sdcibir0zhldmngv1iyzlhh2adq9dqjc73grap3df5zcv9sz9";
+    sha256 = "tiLJ3p/eVx25a/1lmhg76lU90m5xyshWWTh+k3IhquY=";
  };

  propagatedBuildInputs = with python3.pkgs; [
@ -40,8 +40,9 @@ python3.pkgs.buildPythonApplication rec {

  meta = with lib; {
    homepage = "https://saltstack.com/";
+    changelog = "https://docs.saltstack.com/en/latest/topics/releases/${version}.html";
    description = "Portable, distributed, remote execution and configuration management system";
-    maintainers = with maintainers; [ aneeshusa ];
+    maintainers = with maintainers; [ Flakebi ];
    license = licenses.asl20;
  };
 }
--- a/pkgs/tools/filesystems/mergerfs/default.nix
+++ b/pkgs/tools/filesystems/mergerfs/default.nix
@ -2,25 +2,28 @@

 stdenv.mkDerivation rec {
  pname = "mergerfs";
-  version = "2.28.3";
+  version = "2.31.0";

  src = fetchFromGitHub {
    owner = "trapexit";
    repo = pname;
    rev = version;
-    sha256 = "1w6p3svc2yknp6swqg8lax6n9b31lyplb3j7r8nv14hbq4hymylx";
+    sha256 = "0j7nbxzv85as76glzk4cf7j6ggfihcjaihp06s0zcar4i7zaiy9z";
  };

  nativeBuildInputs = [
    automake autoconf pkgconfig gettext libtool pandoc which
  ];
+  prePatch = ''
+    sed -i -e '/chown/d' -e '/chmod/d' libfuse/Makefile
+  '';
  buildInputs = [ attr libiconv ];

  preConfigure = ''
    echo "${version}" > VERSION
  '';

-  makeFlags = [ "PREFIX=${placeholder "out"}" "XATTR_AVAILABLE=1" ];
+  makeFlags = [ "DESTDIR=${placeholder "out"}" "XATTR_AVAILABLE=1" "PREFIX=/" "SBINDIR=/bin" ];
  enableParallelBuilding = true;

  postFixup = ''
--- a/pkgs/tools/misc/direnv/default.nix
+++ b/pkgs/tools/misc/direnv/default.nix
@ -2,7 +2,7 @@

 buildGoModule rec {
  pname = "direnv";
-  version = "2.23.0";
+  version = "2.23.1";

  vendorSha256 = null;

@ -10,7 +10,7 @@ buildGoModule rec {
    owner = "direnv";
    repo = "direnv";
    rev = "v${version}";
-    sha256 = "0m42mg4z04880dwl3iyppq2nda9v883jaxl8221d0xcpkjfm8hjm";
+    sha256 = "02b27imda9pg65z5xw2q398p2281d5d46vgs3i9mrwcfsbpl5s6d";
  };

  # we have no bash at the moment for windows
--- a/pkgs/tools/misc/skim/default.nix
+++ b/pkgs/tools/misc/skim/default.nix
@ -1,19 +1,17 @@
-{ stdenv, fetchFromGitHub, rustPlatform }:
+{ stdenv, fetchCrate, rustPlatform }:

 rustPlatform.buildRustPackage rec {
  pname = "skim";
-  version = "0.8.2";
+  version = "0.9.1";

-  src = fetchFromGitHub {
-    owner = "lotabout";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "0paxrf03rqzahbpr4gnsj62vl09vcxvw248n9wzhjq14dqlwcr9w";
+  src = fetchCrate {
+    inherit pname version;
+    sha256 = "1r8zf56kb9rhh8nlh8w684srr8jfhndf8742x8byw374my9xn8pb";
  };

  outputs = [ "out" "vim" ];

-  cargoSha256 = "0rxxdad60fpwkb4wx5407ihd89wqpf2ldcnp7nsx17xh4brp1l9r";
+  cargoSha256 = "0wjlkyngrc03a92fwmavgj90h0kakww38bfc1wapn2my7p3b6nc1";

  postPatch = ''
    sed -i -e "s|expand('<sfile>:h:h')|'$out'|" plugin/skim.vim
--- a/pkgs/tools/networking/fastd/default.nix
+++ b/pkgs/tools/networking/fastd/default.nix
@ -1,29 +1,20 @@
-{ stdenv, fetchFromGitHub, cmake, bison, pkgconfig
+{ stdenv, fetchFromGitHub, bison, meson, ninja, pkgconfig
 , libuecc, libsodium, libcap, json_c, openssl }:

 stdenv.mkDerivation rec {
  pname = "fastd";
-  version = "19";
+  version = "21";

  src = fetchFromGitHub {
    owner  = "Neoraider";
    repo = "fastd";
    rev = "v${version}";
-    sha256 = "1h3whjvy2n2cyvbkbg4y1z9vlrn790spzbdhj4glwp93xcykhz5i";
+    sha256 = "1p4k50dk8byrghbr0fwmgwps8df6rlkgcd603r14i71m5g27z5gw";
  };

-  postPatch = ''
-    substituteInPlace src/crypto/cipher/CMakeLists.txt \
-      --replace 'add_subdirectory(aes128_ctr)' ""
-  '';
-
-  nativeBuildInputs = [ pkgconfig bison cmake ];
+  nativeBuildInputs = [ pkgconfig bison meson ninja ];
  buildInputs = [ libuecc libsodium libcap json_c openssl ];

-  cmakeFlags = [
-    "-DENABLE_OPENSSL=true"
-  ];
-
  enableParallelBuilding = true;

  meta = with stdenv.lib; {
--- a/pkgs/tools/package-management/cargo-release/default.nix
+++ b/pkgs/tools/package-management/cargo-release/default.nix
@ -2,16 +2,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-release";
-  version = "0.13.5";
+  version = "0.13.8";

  src = fetchFromGitHub {
    owner = "sunng87";
    repo = "cargo-release";
    rev = "v${version}";
-    sha256 = "098p6yfq8nlfckr61j3pkimwzrg5xb2i34nxvk2hiv1njl1vrqng";
+    sha256 = "16v93k8d1aq0as4ab1i972bjw410k07gb3s6xdzb1r019gxg2i2h";
  };

-  cargoSha256 = "07rmp4j4jpzd1rz59wsjmzmj2qkc2x4wrs9pafqrym58ypm8i4gx";
+  cargoSha256 = "1jbp8jbpxnchzinjzv36crszdipxp1myknmrxn7r0ijfjdpigk9r";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ openssl ]
--- a/pkgs/tools/security/sonar-scanner-cli/default.nix
+++ b/pkgs/tools/security/sonar-scanner-cli/default.nix
@ -0,0 +1,47 @@
+{ stdenv, lib, fetchurl, unzip, jre }:
+
+let
+
+  version = "4.5.0.2216";
+
+  sonarScannerArchPackage = {
+    "x86_64-linux" = {
+      url = "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-${version}-linux.zip";
+      sha256 = "sha256-rmvDb5l2BGV8j94Uhu2kJXwoDAHA3VncAahqGvLY3I0=";
+    };
+    "x86_64-darwin" = {
+      url = "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-${version}-macosx.zip";
+      sha256 = "1g3lldpkrjlvwld9h82hlwclyplxpbk4q3nq59ylw4dhp26kb993";
+    };
+  };
+
+in stdenv.mkDerivation rec {
+  inherit version;
+  pname = "sonar-scanner-cli";
+
+  src = fetchurl sonarScannerArchPackage.${stdenv.hostPlatform.system};
+
+  buildInputs = [ unzip ];
+
+  installPhase = ''
+    mkdir -p $out/lib
+    cp -r lib/* $out/lib/
+    mkdir -p $out/bin
+    cp bin/* $out/bin/
+    mkdir -p $out/conf
+    cp conf/* $out/conf/
+  '';
+
+  fixupPhase = ''
+    substituteInPlace $out/bin/sonar-scanner \
+      --replace "\$sonar_scanner_home/jre" "${lib.getBin jre}"
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/SonarSource/sonar-scanner-cli";
+    description = "SonarQube Scanner used to start code analysis";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ peterromfeldhk ];
+    platforms = builtins.attrNames sonarScannerArchPackage;
+  };
+}
--- a/pkgs/tools/system/bpytop/default.nix
+++ b/pkgs/tools/system/bpytop/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "bpytop";
-  version = "1.0.42";
+  version = "1.0.44";

  src = fetchFromGitHub {
    owner = "aristocratos";
    repo = pname;
    rev = "v${version}";
-    sha256 = "04xbzczrd85icld7azvwzw785kmb2c2q22ly21pbi7d89wkys9kh";
+    sha256 = "1fb7n0p364sj8pzsg35lrgl5wga3v4d0b4nynkfs5g8rfnmb0rr0";
  };

  buildInputs = [ makeWrapper ];
--- a/pkgs/tools/typesetting/tectonic/default.nix
+++ b/pkgs/tools/typesetting/tectonic/default.nix
@ -3,16 +3,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "tectonic";
-  version = "0.1.17";
+  version = "0.2.0";

  src = fetchFromGitHub {
    owner = "tectonic-typesetting";
    repo = "tectonic";
    rev = "tectonic@${version}";
-    sha256 = "VHhvdIBFPE5CkWVQ4tzMionUnAkZTucVXl5zp5prgok=";
+    sha256 = "+kHp5qy0lzT5sLoxC1tlW6oaKZ11vQF+30zW0wXlQBU=";
  };

-  cargoSha256 = "/f/suiI5XzI0+lCscsqLZTWU6slHdXgR+5epYpxyU1w=";
+  cargoSha256 = "bsuNHqr/8OTG3LXd+PYPKsXEBpbcwxP4A7SEqLYNKU0=";

  nativeBuildInputs = [ pkgconfig ];

--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@ -2,7 +2,7 @@
 , texlive
 , zlib, libiconv, libpng, libX11
 , freetype, gd, libXaw, icu, ghostscript, libXpm, libXmu, libXext
-, perl, perlPackages, python2Packages, pkgconfig, autoreconfHook
+, perl, perlPackages, python2Packages, pkgconfig
 , poppler, libpaper, graphite2, zziplib, harfbuzz, potrace, gmp, mpfr
 , cairo, pixman, xorg, clisp, biber, xxHash
 , makeWrapper, shortenPerlShebang
@ -34,10 +34,6 @@ let
      cp -pv texk/web2c/pdftexdir/pdftosrc{-poppler0.83.0,}.cc
    '';

-    # remove when removing synctex-missing-header.patch
-    preAutoreconf = "pushd texk/web2c";
-    postAutoreconf = "popd";
-
    configureFlags = [
      "--with-banner-add=/NixOS.org"
      "--disable-missing" "--disable-native-texlive-build"
@ -71,11 +67,11 @@ core = stdenv.mkDerivation rec {
  pname = "texlive-bin";
  inherit version;

-  inherit (common) src prePatch preAutoreconf postAutoreconf;
+  inherit (common) src prePatch;

  outputs = [ "out" "doc" ];

-  nativeBuildInputs = [ pkgconfig autoreconfHook ];
+  nativeBuildInputs = [ pkgconfig ];
  buildInputs = [
    /*teckit*/ zziplib poppler mpfr gmp
    pixman gd freetype libpng libpaper zlib
@ -161,7 +157,7 @@ core-big = stdenv.mkDerivation { #TODO: upmendex
  pname = "texlive-core-big.bin";
  inherit version;

-  inherit (common) src prePatch preAutoreconf postAutoreconf;
+  inherit (common) src prePatch;

  hardeningDisable = [ "format" ];

@ -429,7 +425,7 @@ xdvi = stdenv.mkDerivation {

 } # un-indented

-// stdenv.lib.optionalAttrs (!stdenv.isDarwin) # see #20062
+// stdenv.lib.optionalAttrs (!clisp.meta.broken) # broken on aarch64 and darwin (#20062)
 {

 xindy = stdenv.mkDerivation {
--- a/pkgs/tools/typesetting/tex/texlive/dvisvgm-fix.patch
+++ b/pkgs/tools/typesetting/tex/texlive/dvisvgm-fix.patch
@ -1,16 +0,0 @@
-diff a/texk/dvisvgm/dvisvgm-src/src/psdefs.cpp b/texk/dvisvgm/dvisvgm-src/src/psdefs.cpp
--- a/texk/dvisvgm/dvisvgm-src/src/psdefs.cpp
-+++ b/texk/dvisvgm/dvisvgm-src/src/psdefs.cpp
-@@ -107,8 +107,7 @@ const char *PSInterpreter::PSDEFS =
- "dmode sysexec<</Normal 0/Compatible 0/Multiply 1/Screen 2/Overlay 3/SoftLight "
- "4/HardLight 5/ColorDodge 6/ColorBurn 7/Darken 8/Lighten 9/Difference 10/Exclus"
- "ion 11/Hue 12/Saturation 13/Color 14/Luminosity 15/CompatibleOverprint 16>>exc"
-"h get 1(setblendmode)prcmd}def/@pdfpagecount{GS_PDF_ProcSet begin pdfdict begi"
-"n(r)file pdfopen begin pdfpagecount currentdict pdfclose end end end}def/@pdfp"
-"agebox{GS_PDF_ProcSet begin pdfdict begin(r)file pdfopen begin dup dup 1 lt ex"
-"ch pdfpagecount gt or{pop}{pdfgetpage/MediaBox pget pop aload pop}ifelse curre"
-"ntdict pdfclose end end end}def DELAYBIND{.bindnow}if ";
-+"h get 1(setblendmode)prcmd}def/@pdfpagecount{(r)file runpdfbegin pdfpagecount "
-+"runpdfend}def/@pdfpagebox{(r)file runpdfbegin dup dup 1 lt exch pdfpagecount g"
-+"t or{pop}{pdfgetpage/MediaBox pget pop aload pop}ifelse runpdfend}def DELAYBIN"
-+"D{.bindnow}if ";
--- a/pkgs/tools/typesetting/tex/texlive/poppler84.patch
+++ b/pkgs/tools/typesetting/tex/texlive/poppler84.patch
@ -1,43 +0,0 @@
-From cf05aae9685e5c6a46b4313e7bfce49edc6f51f9 Mon Sep 17 00:00:00 2001
-From: Mikle Kolyada <zlogene@gentoo.org>
-Date: Tue, 31 Dec 2019 11:29:30 +0300
-Subject: [PATCH] poppler-0.84 compat
-
-Upstream report: https://tug.org/pipermail/tex-k/2019-December/003096.html
-
-Signed-off-by: Mikle Kolyada <zlogene@gentoo.org>
---
- texk/web2c/pdftexdir/utils.c    | 1 -
- texk/web2c/xetexdir/XeTeX_ext.c | 3 +++
- 2 files changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/texk/web2c/pdftexdir/utils.c b/texk/web2c/pdftexdir/utils.c
-index c93a8781..6f866e76 100644
--- a/texk/web2c/pdftexdir/utils.c
-+++ b/texk/web2c/pdftexdir/utils.c
-@@ -33,7 +33,6 @@ with this program.  If not, see <http://www.gnu.org/licenses/>.
- #include "ptexlib.h"
- #include <png.h>
- #ifdef POPPLER_VERSION
-#include <poppler-config.h>
- #define xpdfVersion POPPLER_VERSION
- #define xpdfString "poppler"
- #else
-diff --git a/texk/web2c/xetexdir/XeTeX_ext.c b/texk/web2c/xetexdir/XeTeX_ext.c
-index 4968ee41..0aee4ee3 100644
--- a/texk/web2c/xetexdir/XeTeX_ext.c
-+++ b/texk/web2c/xetexdir/XeTeX_ext.c
-@@ -38,7 +38,10 @@ authorization from the copyright holders.
- 
- #include <w2c/config.h>
- 
-+#ifndef POPPLER_VERSION
- #include <poppler-config.h>
-+#endif
-+
- #include <png.h>
- #include <zlib.h>
- #include <graphite2/Font.h>
-- 
-2.24.1
-
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -7114,6 +7114,8 @@ in
    inherit (darwin.apple_sdk.frameworks) Security;
  };

+  sonar-scanner-cli = callPackage ../tools/security/sonar-scanner-cli { };
+
  solr = callPackage ../servers/search/solr { };
  solr_7 = solr;
  solr_8 = solr;
@ -14607,6 +14609,8 @@ in

  nanomsg = callPackage ../development/libraries/nanomsg { };

+  nanovna-saver = libsForQt5.callPackage ../applications/science/electronics/nanovna-saver { };
+
  ndpi = callPackage ../development/libraries/ndpi { };

  nifticlib = callPackage ../development/libraries/science/biology/nifticlib { };
@ -14783,7 +14787,9 @@ in

  opensaml-cpp = callPackage ../development/libraries/opensaml-cpp { };

-  openscenegraph = callPackage ../development/libraries/openscenegraph { };
+  openscenegraph = callPackage ../development/libraries/openscenegraph {
+    inherit (darwin.apple_sdk.frameworks) AGL Carbon Cocoa Foundation;
+  };

  openslp = callPackage ../development/libraries/openslp {};

@ -17054,6 +17060,7 @@ in
  prometheus-pushgateway = callPackage ../servers/monitoring/prometheus/pushgateway.nix { };
  prometheus-redis-exporter = callPackage ../servers/monitoring/prometheus/redis-exporter.nix { };
  prometheus-rabbitmq-exporter = callPackage ../servers/monitoring/prometheus/rabbitmq-exporter.nix { };
+  prometheus-rtl_433-exporter = callPackage ../servers/monitoring/prometheus/rtl_433-exporter.nix { };
  prometheus-snmp-exporter = callPackage ../servers/monitoring/prometheus/snmp-exporter.nix { };
  prometheus-tor-exporter = callPackage ../servers/monitoring/prometheus/tor-exporter.nix { };
  prometheus-statsd-exporter = callPackage ../servers/monitoring/prometheus/statsd-exporter.nix { };
@ -22725,8 +22732,8 @@ in
    ffmpeg = ffmpeg_2;
  };

-  pcsx2 = pkgsi686Linux.callPackage ../misc/emulators/pcsx2 {
-    wxGTK = pkgsi686Linux.wxGTK30;
+  pcsx2 = callPackage ../misc/emulators/pcsx2 {
+    wxGTK = wxGTK30-gtk3;
  };

  pekwm = callPackage ../applications/window-managers/pekwm { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -2874,6 +2874,8 @@ in {
  else
    callPackage ../development/python-modules/imbalanced-learn { };

+  imdbpy = callPackage ../development/python-modules/imdbpy { };
+
  img2pdf = callPackage ../development/python-modules/img2pdf { };

  imgaug = callPackage ../development/python-modules/imgaug { };
@ -6399,6 +6401,16 @@ in {
    disabled = !isPy3k;
  });

+  scipy_1_4 = self.scipy.overridePythonAttrs (oldAttrs: rec {
+    version = "1.4.1";
+    src = oldAttrs.src.override {
+      inherit version;
+      sha256 = "0ndw7zyxd2dj37775mc75zm4fcyiipnqxclc45mkpxy8lvrvpqfy";
+    };
+    doCheck = false;
+    disabled = !isPy3k;
+  });
+
  scipy = let
    scipy_ = callPackage ../development/python-modules/scipy { };
    scipy_1_2 = scipy_.overridePythonAttrs (oldAttrs: rec {