Merge staging-next into staging

2024-12-26 04:43:09 +03:00 · 2021-01-21 01:19:31 +00:00 · 2021-01-21 01:19:31 +00:00 · e5fef074d6
commit e5fef074d6
parent 49d7c98041 3617a771ca
90 changed files with 637 additions and 213 deletions
--- a/.editorconfig
+++ b/.editorconfig
@ -90,9 +90,6 @@ insert_final_newline = unset
 indent_style = unset
 trim_trailing_whitespace = unset

-[pkgs/development/{perl-modules,ocaml-modules,tools/ocaml}/**]
-indent_style = unset
-
 [pkgs/servers/dict/wordnet_structures.py]
 trim_trailing_whitespace = unset

--- a/doc/contributing/coding-conventions.xml
+++ b/doc/contributing/coding-conventions.xml
@ -178,6 +178,12 @@ args.stdenv.mkDerivation (args // {
 </programlisting>
    </para>
   </listitem>
+   <listitem>
+    <para>
+     Arguments should be listed in the order they are used, with the
+     exception of <varname>lib</varname>, which always goes first.
+    </para>
+   </listitem>
   <listitem>
    <para>
     Prefer using the top-level <varname>lib</varname> over its alias
--- a/doc/languages-frameworks/coq.section.md
+++ b/doc/languages-frameworks/coq.section.md
@ -42,8 +42,8 @@ It also takes other standard `mkDerivation` attributes, they are added as such,
 Here is a simple package example. It is a pure Coq library, thus it depends on Coq. It builds on the Mathematical Components library, thus it also takes some `mathcomp` derivations as `extraBuildInputs`.

 ```nix
-{ coq, mkCoqDerivation, mathcomp, mathcomp-finmap, mathcomp-bigenough,
-  lib, version ? null }:
+{ lib, mkCoqDerivation, version ? null
+, coq, mathcomp, mathcomp-finmap, mathcomp-bigenough }:
 with lib; mkCoqDerivation {
  /* namePrefix leads to e.g. `name = coq8.11-mathcomp1.11-multinomials-1.5.2` */
  namePrefix = [ "coq" "mathcomp" ];
--- a/doc/languages-frameworks/idris.section.md
+++ b/doc/languages-frameworks/idris.section.md
@ -69,11 +69,11 @@ prelude
 As an example of how a Nix expression for an Idris package can be created, here is the one for `idrisPackages.yaml`:

 ```nix
-{ build-idris-package
+{ lib
+, build-idris-package
 , fetchFromGitHub
 , contrib
 , lightyear
-, lib
 }:
 build-idris-package  {
  name = "yaml";
@ -94,11 +94,11 @@ build-idris-package  {
    sha256 = "1g4pi0swmg214kndj85hj50ccmckni7piprsxfdzdfhg87s0avw7";
  };

-  meta = {
+  meta = with lib; {
    description = "Idris YAML lib";
    homepage = "https://github.com/Heather/Idris.Yaml";
-    license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.brainrape ];
+    license = licenses.mit;
+    maintainers = [ maintainers.brainrape ];
  };
 }
 ```
--- a/doc/languages-frameworks/maven.section.md
+++ b/doc/languages-frameworks/maven.section.md
@ -116,7 +116,7 @@ The first step will be to build the Maven project as a fixed-output derivation i
 > Traditionally the Maven repository is at `~/.m2/repository`. We will override this to be the `$out` directory.

 ```nix
-{ stdenv, lib, maven }:
+{ lib, stdenv, maven }:
 stdenv.mkDerivation {
  name = "maven-repository";
  buildInputs = [ maven ];
@ -168,7 +168,7 @@ If your package uses _SNAPSHOT_ dependencies or _version ranges_; there is a str
 Regardless of which strategy is chosen above, the step to build the derivation is the same.

 ```nix
-{ stdenv, lib, maven, callPackage }:
+{ stdenv, maven, callPackage }:
 # pick a repository derivation, here we will use buildMaven
 let repository = callPackage ./build-maven-repository.nix { };
 in stdenv.mkDerivation rec {
@ -222,7 +222,7 @@ We will read the Maven repository and flatten it to a single list. This list wil
 We make sure to provide this classpath to the `makeWrapper`.

 ```nix
-{ stdenv, lib, maven, callPackage, makeWrapper, jre }:
+{ stdenv, maven, callPackage, makeWrapper, jre }:
 let
  repository = callPackage ./build-maven-repository.nix { };
 in stdenv.mkDerivation rec {
@ -298,7 +298,7 @@ Main-Class: Main
 We will modify the derivation above to add a symlink to our repository so that it's accessible to our JAR during the `installPhase`.

 ```nix
-{ stdenv, lib, maven, callPackage, makeWrapper, jre }:
+{ stdenv, maven, callPackage, makeWrapper, jre }:
 # pick a repository derivation, here we will use buildMaven
 let repository = callPackage ./build-maven-repository.nix { };
 in stdenv.mkDerivation rec {
--- a/doc/languages-frameworks/ocaml.section.md
+++ b/doc/languages-frameworks/ocaml.section.md
@ -32,11 +32,11 @@ buildDunePackage rec {
  propagatedBuildInputs = [ bigstringaf result ];
  doCheck = true;

-  meta = {
+  meta = with lib; {
    homepage = "https://github.com/inhabitedtype/angstrom";
    description = "OCaml parser combinators built for speed and memory efficiency";
-    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ sternenseemann ];
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ sternenseemann ];
  };
 }
 ```
--- a/doc/languages-frameworks/perl.section.md
+++ b/doc/languages-frameworks/perl.section.md
@ -110,7 +110,7 @@ ClassC3Componentised = buildPerlPackage rec {
 On Darwin, if a script has too many `-Idir` flags in its first line (its “shebang line”), it will not run. This can be worked around by calling the `shortenPerlShebang` function from the `postInstall` phase:

 ```nix
-{ stdenv, lib, buildPerlPackage, fetchurl, shortenPerlShebang }:
+{ lib, stdenv, buildPerlPackage, fetchurl, shortenPerlShebang }:

 ImageExifTool = buildPerlPackage {
  pname = "Image-ExifTool";
--- a/doc/languages-frameworks/qt.section.md
+++ b/doc/languages-frameworks/qt.section.md
@ -8,7 +8,7 @@ There are primarily two problems which the Qt infrastructure is designed to addr

 ```{=docbook}
 <programlisting>
-{ mkDerivation, lib, qtbase }: <co xml:id='qt-default-nix-co-1' />
+{ mkDerivation, qtbase }: <co xml:id='qt-default-nix-co-1' />

 mkDerivation { <co xml:id='qt-default-nix-co-2' />
  pname = "myapp";
--- a/doc/languages-frameworks/r.section.md
+++ b/doc/languages-frameworks/r.section.md
@ -32,14 +32,12 @@ However, if you'd like to add a file to your project source to make the
 environment available for other contributors, you can create a `default.nix`
 file like so:
 ```nix
-let
-  pkgs = import <nixpkgs> {};
-  stdenv = pkgs.stdenv;
-in with pkgs; {
+with import <nixpkgs> {};
+{
  myProject = stdenv.mkDerivation {
    name = "myProject";
    version = "1";
-    src = if pkgs.lib.inNixShell then null else nix;
+    src = if lib.inNixShell then null else nix;

    buildInputs = with rPackages; [
      R
--- a/doc/languages-frameworks/ruby.section.md
+++ b/doc/languages-frameworks/ruby.section.md
@ -232,7 +232,7 @@ If you want to package a specific version, you can use the standard Gemfile synt
 Now you can also also make a `default.nix` that looks like this:

 ```nix
-{ lib, bundlerApp }:
+{ bundlerApp }:

 bundlerApp {
  pname = "mdl";
--- a/doc/languages-frameworks/rust.section.md
+++ b/doc/languages-frameworks/rust.section.md
@ -19,6 +19,8 @@ or use Mozilla's [Rust nightlies overlay](#using-the-rust-nightlies-overlay).
 Rust applications are packaged by using the `buildRustPackage` helper from `rustPlatform`:

 ```
+{ lib, rustPlatform }:
+
 rustPlatform.buildRustPackage rec {
  pname = "ripgrep";
  version = "12.1.1";
@ -226,8 +228,6 @@ source code in a reproducible way. If it is missing or out-of-date one can use
 the `cargoPatches` attribute to update or add it.

 ```
-{ lib, rustPlatform, fetchFromGitHub }:
-
 rustPlatform.buildRustPackage rec {
  (...)
  cargoPatches = [
@ -263,7 +263,7 @@ Now, the file produced by the call to `carnix`, called `hello.nix`, looks like:

 ```
 # Generated by carnix 0.6.5: carnix -o hello.nix --src ./. Cargo.lock --standalone
-{ lib, stdenv, buildRustCrate, fetchgit }:
+{ stdenv, buildRustCrate, fetchgit }:
 let kernel = stdenv.buildPlatform.parsed.kernel.name;
    # ... (content skipped)
 in
@ -292,7 +292,7 @@ following nix file:

 ```
 # Generated by carnix 0.6.5: carnix -o hello.nix --src ./. Cargo.lock --standalone
-{ lib, stdenv, buildRustCrate, fetchgit }:
+{ stdenv, buildRustCrate, fetchgit }:
 let kernel = stdenv.buildPlatform.parsed.kernel.name;
    # ... (content skipped)
 in
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -5138,6 +5138,12 @@
    githubId = 42153076;
    name = "Alexey Nikashkin";
  };
+  lesuisse = {
+    email = "thomas@gerbet.me";
+    github = "LeSuisse";
+    githubId = 737767;
+    name = "Thomas Gerbet";
+  };
  lethalman = {
    email = "lucabru@src.gnome.org";
    github = "lethalman";
--- a/nixos/modules/system/boot/binfmt.nix
+++ b/nixos/modules/system/boot/binfmt.nix
@ -20,8 +20,14 @@ let
                 optionalString fixBinary "F";
  in ":${name}:${type}:${offset'}:${magicOrExtension}:${mask'}:${interpreter}:${flags}";

-  activationSnippet = name: { interpreter, ... }:
-    "ln -sf ${interpreter} /run/binfmt/${name}";
+  activationSnippet = name: { interpreter, ... }: ''
+    rm -f /run/binfmt/${name}
+    cat > /run/binfmt/${name} << 'EOF'
+    #!/usr/bin/env sh
+    exec -- ${interpreter} "$@"
+    EOF
+    chmod +x /run/binfmt/${name}
+  '';

  getEmulator = system: (lib.systems.elaborate { inherit system; }).emulator pkgs;

--- a/nixos/tests/chromium.nix
+++ b/nixos/tests/chromium.nix
@ -1,10 +1,14 @@
 { system ? builtins.currentSystem
 , config ? {}
 , pkgs ? import ../.. { inherit system config; }
-, channelMap ? {
-    stable = pkgs.chromium;
-    beta   = pkgs.chromiumBeta;
-    dev    = pkgs.chromiumDev;
+, channelMap ? { # Maps "channels" to packages
+    stable        = pkgs.chromium;
+    beta          = pkgs.chromiumBeta;
+    dev           = pkgs.chromiumDev;
+    ungoogled     = pkgs.ungoogled-chromium;
+    chrome-stable = pkgs.google-chrome;
+    chrome-beta   = pkgs.google-chrome-beta;
+    chrome-dev    = pkgs.google-chrome-dev;
  }
 }:

@ -14,7 +18,7 @@ with pkgs.lib;
 mapAttrs (channel: chromiumPkg: makeTest rec {
  name = "chromium-${channel}";
  meta = {
-    maintainers = with maintainers; [ aszlig ];
+    maintainers = with maintainers; [ aszlig primeos ];
    # https://github.com/NixOS/hydra/issues/591#issuecomment-435125621
    inherit (chromiumPkg.meta) timeout;
  };
@ -58,6 +62,19 @@ mapAttrs (channel: chromiumPkg: makeTest rec {
        return "su - ${user} -c " + shlex.quote(cmd)


+    def get_browser_binary():
+        """Returns the name of the browser binary."""
+        pname = "${getName chromiumPkg.name}"
+        if pname.find("chromium") != -1:
+            return "chromium"  # Same name for all channels and ungoogled-chromium
+        if pname == "google-chrome":
+            return "google-chrome-stable"
+        if pname == "google-chrome-dev":
+            return "google-chrome-unstable"
+        # For google-chrome-beta and as fallback:
+        return pname
+
+
    def create_new_win():
        with machine.nested("Creating a new Chromium window"):
            machine.execute(
@ -153,7 +170,14 @@ mapAttrs (channel: chromiumPkg: makeTest rec {
    machine.wait_for_x()

    url = "file://${startupHTML}"
-    machine.succeed(ru(f'ulimit -c unlimited; chromium "{url}" & disown'))
+    machine.succeed(ru(f'ulimit -c unlimited; "{get_browser_binary()}" "{url}" & disown'))
+
+    if get_browser_binary().startswith("google-chrome"):
+        # Need to click away the first window:
+        machine.wait_for_text("Make Google Chrome the default browser")
+        machine.screenshot("google_chrome_default_browser_prompt")
+        machine.send_key("ret")
+
    machine.wait_for_text("startup done")
    machine.wait_until_succeeds(
        ru(
--- a/nixos/tests/cifs-utils.nix
+++ b/nixos/tests/cifs-utils.nix
@ -0,0 +1,12 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "cifs-utils";
+
+  machine = { pkgs, ... }: { environment.systemPackages = [ pkgs.cifs-utils ]; };
+
+  testScript = ''
+    machine.succeed("smbinfo -h")
+    machine.succeed("smb2-quota -h")
+    assert "${pkgs.cifs-utils.version}" in machine.succeed("cifs.upcall -v")
+    assert "${pkgs.cifs-utils.version}" in machine.succeed("mount.cifs -V")
+  '';
+})
--- a/nixos/tests/opentabletdriver.nix
+++ b/nixos/tests/opentabletdriver.nix
@ -1,4 +1,6 @@
-import ./make-test-python.nix ( { pkgs, ... }: {
+import ./make-test-python.nix ( { pkgs, ... }: let
+  testUser = "alice";
+in {
  name = "opentabletdriver";
  meta = {
    maintainers = with pkgs.lib.maintainers; [ thiagokokada ];
@ -10,7 +12,7 @@ import ./make-test-python.nix ( { pkgs, ... }: {
        ./common/user-account.nix
        ./common/x11.nix
      ];
-      test-support.displayManager.auto.user = "alice";
+      test-support.displayManager.auto.user = testUser;
      hardware.opentabletdriver.enable = true;
    };

@ -18,10 +20,11 @@ import ./make-test-python.nix ( { pkgs, ... }: {
    ''
      machine.start()
      machine.wait_for_x()
-      machine.wait_for_unit("opentabletdriver.service", "alice")
+      machine.wait_for_unit("opentabletdriver.service", "${testUser}")

-      machine.succeed("cat /etc/udev/rules.d/30-opentabletdriver.rules")
+      machine.succeed("cat /etc/udev/rules.d/99-opentabletdriver.rules")
      # Will fail if service is not running
-      machine.succeed("otd detect")
+      # Needs to run as the same user that started the service
+      machine.succeed("su - ${testUser} -c 'otd detect'")
    '';
 })
--- a/nixos/tests/podman.nix
+++ b/nixos/tests/podman.nix
@ -61,6 +61,20 @@ import ./make-test-python.nix (
          podman.succeed("podman stop sleeping")
          podman.succeed("podman rm sleeping")

+      # create systemd session for rootless
+      podman.succeed("loginctl enable-linger alice")
+
+      with subtest("Run container rootless with runc"):
+          podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
+          podman.succeed(
+              su_cmd(
+                  "podman run --runtime=runc -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+              )
+          )
+          podman.succeed(su_cmd("podman ps | grep sleeping"))
+          podman.succeed(su_cmd("podman stop sleeping"))
+          podman.succeed(su_cmd("podman rm sleeping"))
+
      with subtest("Run container rootless with crun"):
          podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
          podman.succeed(
@ -71,7 +85,6 @@ import ./make-test-python.nix (
          podman.succeed(su_cmd("podman ps | grep sleeping"))
          podman.succeed(su_cmd("podman stop sleeping"))
          podman.succeed(su_cmd("podman rm sleeping"))
-      # As of 2020-11-20, the runc backend doesn't work with cgroupsv2 yet, so we don't run that test.

      with subtest("Run container rootless with the default backend"):
          podman.succeed(su_cmd("tar cv --files-from /dev/null | podman import - scratchimg"))
--- a/pkgs/applications/audio/mympd/default.nix
+++ b/pkgs/applications/audio/mympd/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "mympd";
-  version = "6.8.3";
+  version = "6.10.0";

  src = fetchFromGitHub {
    owner = "jcorporation";
    repo = "myMPD";
    rev = "v${version}";
-    sha256 = "1a3jrqslxk2a9h5gj6kch108lg9z0i5zwr0j9yd5viyfhr3ka4cq";
+    sha256 = "sha256-QGJti1tKKJlumLgABPmROplF0UVGMWMnyRXLb2cEieQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/graphics/fig2dev/default.nix
+++ b/pkgs/applications/graphics/fig2dev/default.nix
@ -1,26 +1,32 @@
-{ lib, stdenv, fetchurl, ghostscript, libpng } :
+{ lib, stdenv, fetchurl, ghostscript, libpng, makeWrapper
+, coreutils, bc, gnugrep, gawk, gnused } :

-let
-  version = "3.2.7b";
-
-in stdenv.mkDerivation {
+stdenv.mkDerivation rec {
  pname = "fig2dev";
-  inherit version;
+  version = "3.2.8";

  src = fetchurl {
    url = "mirror://sourceforge/mcj/fig2dev-${version}.tar.xz";
-    sha256 = "1ck8gnqgg13xkxq4hrdy706i4xdgrlckx6bi6wxm1g514121pp27";
+    sha256 = "0zg29yqknfafyzmmln4k7kydfb2dapk3r8ffvlqhj3cm8fp5h4lk";
  };

+  nativeBuildInputs = [ makeWrapper ];
  buildInputs = [ libpng ];

  GSEXE="${ghostscript}/bin/gs";

+  postInstall = ''
+    wrapProgram $out/bin/fig2ps2tex \
+        --set PATH ${lib.makeBinPath [ coreutils bc gnugrep gawk ]}
+    wrapProgram $out/bin/pic2tpic \
+        --set PATH ${lib.makeBinPath [ gnused ]}
+  '';
+
  meta = with lib; {
    description = "Tool to convert Xfig files to other formats";
    homepage = "http://mcj.sourceforge.net/";
    license = licenses.xfig;
    platforms = platforms.linux;
+    maintainers = with maintainers; [ lesuisse ];
  };
 }
-
--- a/pkgs/applications/graphics/pdfcpu/default.nix
+++ b/pkgs/applications/graphics/pdfcpu/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "pdfcpu";
-  version = "0.3.7";
+  version = "0.3.8";

  src = fetchFromGitHub {
    owner = "pdfcpu";
    repo = pname;
    rev = "v${version}";
-    sha256 = "13b1ncpx189ca0h70j5cdp0jwlj95kasysryz1l6g13cwn9n6mii";
+    sha256 = "sha256-Rx/LUp5s2DhEKuLUklYXjtTXjqBju+5YzK1hNfBCnIE=";
  };

-  vendorSha256 = "11w9i1829hk1qb9w24dyxv1bi49358a274g60x11fp5x5cw7bqa7";
+  vendorSha256 = "sha256-/SsDDFveovJfuEdnOkxHAWccS8PJW5k9IHSxSJAgHMQ=";

  # No tests
  doCheck = false;
--- a/pkgs/applications/networking/browsers/chromium/README.md
+++ b/pkgs/applications/networking/browsers/chromium/README.md
@ -36,6 +36,21 @@ update `upstream-info.json`. After updates it is important to test at least
 `nixosTests.chromium` (or basic manual testing) and `google-chrome` (which
 reuses `upstream-info.json`).

+To run all automated NixOS VM tests for Chromium, ungoogled-chromium,
+and Google Chrome (not recommended, currently 6x tests!):
+```
+nix-build nixos/tests/chromium.nix
+```
+
+A single test can be selected, e.g. to test `ungoogled-chromium` (see
+`channelMap` in `nixos/tests/chromium.nix` for all available options):
+```
+nix-build nixos/tests/chromium.nix -A ungoogled
+```
+(Note: Testing Google Chrome requires `export NIXPKGS_ALLOW_UNFREE=1`.)
+
+For custom builds it's possible to "override" `channelMap`.
+
 ## Backports

 All updates are considered security critical and should be ported to the stable
--- a/pkgs/applications/networking/cluster/nerdctl/default.nix
+++ b/pkgs/applications/networking/cluster/nerdctl/default.nix
@ -14,16 +14,16 @@ let
 in
 buildGoModule rec {
  pname = "nerdctl";
-  version = "0.4.0";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "AkihiroSuda";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0vjcbvd5yrasw97hd5mrn6cdjvfv2r03z7g1wczlszlcs8gr6nxw";
+    sha256 = "sha256-lSvYiTh67gK9kJls7VsayV8T3H6RzFEEKe49BOWnUBw=";
  };

-  vendorSha256 = "181lp9l4i0qpiqm8wbxa4ldi1j5bm3ygmanz1xh3mkjanl0pwqjr";
+  vendorSha256 = "sha256-qywiaNoO3pI7sfyPbwWR8BLd86RvJ2xSWwCJUsm3RkM=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/applications/networking/instant-messengers/nheko/default.nix
+++ b/pkgs/applications/networking/instant-messengers/nheko/default.nix
@ -57,6 +57,10 @@ mkDerivation rec {
    qtgraphicaleffects
  ] ++ lib.optional stdenv.isDarwin qtmacextras;

+  cmakeFlags = [
+    "-DCOMPILE_QML=ON" # see https://github.com/Nheko-Reborn/nheko/issues/389
+  ];
+
  meta = with lib; {
    description = "Desktop client for the Matrix protocol";
    homepage = "https://github.com/Nheko-Reborn/nheko";
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@ -25,7 +25,7 @@ let
      else "");
 in stdenv.mkDerivation rec {
  pname = "signal-desktop";
-  version = "1.39.5"; # Please backport all updates to the stable channel.
+  version = "1.39.6"; # Please backport all updates to the stable channel.
  # All releases have a limited lifetime and "expire" 90 days after the release.
  # When releases "expire" the application becomes unusable until an update is
  # applied. The expiration date for the current release can be extracted with:
@ -35,7 +35,7 @@ in stdenv.mkDerivation rec {

  src = fetchurl {
    url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "1x29ri4jxd1q2wbv5gf26x986x9sms4rxnhj7d5rhm6pz2ihzb2a";
+    sha256 = "04fd81vc0dxk0b47crm5zacf4x79pdn483xicygnc1z6v7mnrmgk";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/printing/pappl/default.nix
+++ b/pkgs/applications/printing/pappl/default.nix
@ -12,13 +12,13 @@

 stdenv.mkDerivation rec {
  pname = "pappl";
-  version = "1.0.0";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "michaelrsweet";
    repo = pname;
    rev = "v${version}";
-    sha256 = "1cg06v8hxska0hnybnmfda1v4h3ifjir24nx2iqx80kb6jq0hayb";
+    sha256 = "sha256-4evyOrPd8zb5y00L8h2t++ayW1S8WQ5P+6MXe6eju68=";
  };

  outputs = [ "out" "dev" ];
--- a/pkgs/applications/science/biology/picard-tools/default.nix
+++ b/pkgs/applications/science/biology/picard-tools/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "picard-tools";
-  version = "2.23.9";
+  version = "2.24.0";

  src = fetchurl {
    url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "1ygdl590sbcsxpk0qwr0bx163nx51h0545n1xxkbc3pk2r6n51lk";
+    sha256 = "sha256-cOkQObzMb222DxjEFxMhiozfRfWR8CwQEsBiFSsnzXs=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/terminal-emulators/mrxvt/default.nix
+++ b/pkgs/applications/terminal-emulators/mrxvt/default.nix
@ -30,8 +30,8 @@ stdenv.mkDerivation {
  meta = with lib; {
    description = "Lightweight multitabbed feature-rich X11 terminal emulator";
    longDescription = "
-    	Multitabbed lightweight terminal emulator based on rxvt.
-	Supports transparency, backgroundimages, freetype fonts, ...
+      Multitabbed lightweight terminal emulator based on rxvt.
+      Supports transparency, backgroundimages, freetype fonts, ...
    ";
    homepage = "https://sourceforge.net/projects/materm";
    license = licenses.gpl2;
--- a/pkgs/applications/version-management/commitizen/node-packages.nix
+++ b/pkgs/applications/version-management/commitizen/node-packages.nix
@ -9068,4 +9068,4 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
-}
+}
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@ -65,6 +65,7 @@ let
    && libcxx == null
    && !(stdenv.targetPlatform.useLLVM or false)
    && !(stdenv.targetPlatform.useAndroidPrebuilt or false)
+    && !(stdenv.targetPlatform.isiOS or false)
    && gccForLibs != null;

  # older compilers (for example bootstrap's GCC 5) fail with -march=too-modern-cpu
--- a/pkgs/development/compilers/elm/packages/node-composition.nix
+++ b/pkgs/development/compilers/elm/packages/node-composition.nix
@ -14,4 +14,4 @@ in
 import ./node-packages.nix {
  inherit (pkgs) fetchurl fetchgit;
  inherit nodeEnv;
-}
+}
--- a/pkgs/development/compilers/elm/packages/node-packages.nix
+++ b/pkgs/development/compilers/elm/packages/node-packages.nix
@ -15513,4 +15513,4 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
-}
+}
--- a/pkgs/development/compilers/gleam/default.nix
+++ b/pkgs/development/compilers/gleam/default.nix
@ -2,13 +2,13 @@

 rustPlatform.buildRustPackage rec {
  pname = "gleam";
-  version = "0.12.1";
+  version = "0.13.2";

  src = fetchFromGitHub {
    owner = "gleam-lang";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0n23pn7jk4i2waczw5cczsb7v4lal4x6xqmp01y280hb2vk176fg";
+    sha256 = "sha256-ka1GxukX3HR40fMeiiXHguyPKrpGngG2tXDColR7eQA=";
  };

  nativeBuildInputs = [ pkg-config ];
@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
  buildInputs = [ openssl ] ++
    stdenv.lib.optionals stdenv.isDarwin [ Security ];

-  cargoSha256 = "0rnf9agpzlvk53x8zrg32w6r0gxcbank3fs32ydv53frvqv1spj3";
+  cargoSha256 = "sha256-/l54ezS68loljKNh7AdYMIuCiyIbsMI3jqD9ktjZLfc=";

  meta = with stdenv.lib; {
    description = "A statically typed language for the Erlang VM";
--- a/pkgs/development/compilers/go/1.14.nix
+++ b/pkgs/development/compilers/go/1.14.nix
@ -36,11 +36,11 @@ in

 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.14.13";
+  version = "1.14.14";

  src = fetchurl {
    url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "0xxins5crcgghgvnzplmp0qyv2gbmh36v1fpl15d03jwdd6287ds";
+    sha256 = "0vx7r0bb1a500znnnh7v3wgw22ly3p2x06vzyi9hiblgylrby132";
  };

  # perl is used for testing go vet
--- a/pkgs/development/compilers/go/1.15.nix
+++ b/pkgs/development/compilers/go/1.15.nix
@ -36,11 +36,11 @@ in

 stdenv.mkDerivation rec {
  pname = "go";
-  version = "1.15.6";
+  version = "1.15.7";

  src = fetchurl {
    url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "05sqcx4fm1nxfm46j6xriq0fnnah4bm8bqw027xrzcg2qmrvl2w9";
+    sha256 = "1g1a39y1cnvw3y0bjwjms55cz0s9icm8myrgxi295jwfznmb6cc6";
  };

  # perl is used for testing go vet
--- a/pkgs/development/libraries/libmodule/default.nix
+++ b/pkgs/development/libraries/libmodule/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "libmodule";
-  version = "5.0.0";
+  version = "5.0.1";

  src = fetchFromGitHub {
    owner = "FedeDP";
    repo = "libmodule";
    rev = version;
-    sha256 = "1cf81sl33xmfn5g150iqcdrjn0lpjlgp53mganwi6x7jda2qk7r6";
+    sha256 = "sha256-wkRiDWO9wUyxkAeqvm99u22Jq4xnQJx6zS7Sb+R8iMg=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/libwpe/default.nix
+++ b/pkgs/development/libraries/libwpe/default.nix
@ -0,0 +1,39 @@
+{ stdenv
+, lib
+, fetchurl
+, meson
+, pkg-config
+, libxkbcommon
+, libGL
+, ninja
+, libX11 }:
+
+stdenv.mkDerivation rec {
+  pname = "libwpe";
+  version = "1.7.1";
+
+  src = fetchurl {
+    url = "https://wpewebkit.org/releases/${pname}-${version}.tar.xz";
+    sha256 = "0h6kh8wy2b370y705pl2vp6vp18dkdsgdxh0243ji2v51kxbg157";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    meson
+    ninja
+  ];
+
+  buildInputs = [
+    libxkbcommon
+    libGL
+    libX11
+  ];
+
+  meta = with lib; {
+    description = "General-purpose library for WPE WebKit";
+    license = licenses.bsd2;
+    homepage = "https://wpewebkit.org";
+    maintainers = with maintainers; [ matthewbauer ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/development/libraries/libwpe/fdo.nix
+++ b/pkgs/development/libraries/libwpe/fdo.nix
@ -0,0 +1,52 @@
+{ stdenv
+, lib
+, fetchurl
+, meson
+, pkg-config
+, ninja
+, wayland
+, epoxy
+, glib
+, libwpe
+, libxkbcommon
+, libGL
+, libX11 }:
+
+stdenv.mkDerivation rec {
+  pname = "wpebackend-fdo";
+  version = "1.7.1";
+
+  src = fetchurl {
+    url = "https://wpewebkit.org/releases/${pname}-${version}.tar.xz";
+    sha256 = "1xf6akagvpyh0nyxkfijrx5avp6ravnivy28dhk64dsfx9rhm64v";
+  };
+
+  depsBuildBuild = [
+    pkg-config
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    meson
+    ninja
+    wayland
+  ];
+
+  buildInputs = [
+    wayland
+    epoxy
+    glib
+    libwpe
+    libxkbcommon
+    libGL
+    libX11
+  ];
+
+  meta = with lib; {
+    description = "Freedesktop.org backend for WPE WebKit";
+    license = licenses.bsd2;
+    homepage = "https://wpewebkit.org";
+    maintainers = with maintainers; [ matthewbauer ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/development/libraries/webkitgtk/default.nix
+++ b/pkgs/development/libraries/webkitgtk/default.nix
@ -51,6 +51,8 @@
 , xdg-dbus-proxy
 , substituteAll
 , glib
+, libwpe
+, libwpe-fdo
 }:

 assert enableGeoLocation -> geoclue2 != null;
@ -120,6 +122,8 @@ stdenv.mkDerivation rec {
    libsecret
    libtasn1
    libwebp
+    libwpe
+    libwpe-fdo
    libxkbcommon
    libxml2
    libxslt
@ -154,7 +158,6 @@ stdenv.mkDerivation rec {
    "-DENABLE_INTROSPECTION=ON"
    "-DPORT=GTK"
    "-DUSE_LIBHYPHEN=OFF"
-    "-DUSE_WPE_RENDERER=OFF"
  ] ++ optionals stdenv.isDarwin [
    "-DENABLE_GRAPHICS_CONTEXT_3D=OFF"
    "-DENABLE_GTKDOC=OFF"
--- a/pkgs/development/misc/google-clasp/google-clasp.nix
+++ b/pkgs/development/misc/google-clasp/google-clasp.nix
@ -14,4 +14,4 @@ in
 import ./node-packages.nix {
  inherit (pkgs) fetchurl fetchgit;
  inherit nodeEnv;
-}
+}
--- a/pkgs/development/misc/google-clasp/node-packages.nix
+++ b/pkgs/development/misc/google-clasp/node-packages.nix
@ -2102,4 +2102,4 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
-}
+}
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@ -110969,4 +110969,4 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
-}
+}
--- a/pkgs/development/ocaml-modules/optint/default.nix
+++ b/pkgs/development/ocaml-modules/optint/default.nix
@ -2,11 +2,11 @@

 buildDunePackage rec {
  minimumOCamlVersion = "4.03";
-  version = "0.0.3";
+  version = "0.0.4";
  pname = "optint";
  src = fetchurl {
    url = "https://github.com/mirage/optint/releases/download/v${version}/optint-v${version}.tbz";
-    sha256 = "0c7r3s6lal9xkixngkj25nqncj4s33ka40bjdi7fz7mly08djycj";
+    sha256 = "1a7gabxqmfvii8qnxq1clx43md2h9glskxhac8y8r0rhzblx3s1a";
  };

  meta = {
--- a/pkgs/development/php-packages/phpstan/default.nix
+++ b/pkgs/development/php-packages/phpstan/default.nix
@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, pkgs, lib, php }:
 let
  pname = "phpstan";
-  version = "0.12.59";
+  version = "0.12.68";
 in
 mkDerivation {
  inherit pname version;

  src = pkgs.fetchurl {
    url = "https://github.com/phpstan/phpstan/releases/download/${version}/phpstan.phar";
-    sha256 = "0lp25d9b7w8lk4ffrd17mjw93i234qnfpwz42k8lww1lrk5abnfa";
+    sha256 = "sha256-qplQi12ecZjtaM8XawiO+qSwEdTXByrxWZLf3N7gfNc=";
  };

  phases = [ "installPhase" ];
--- a/pkgs/development/php-packages/psalm/default.nix
+++ b/pkgs/development/php-packages/psalm/default.nix
@ -1,14 +1,14 @@
 { mkDerivation, fetchurl, pkgs, lib, php }:
 let
  pname = "psalm";
-  version = "4.3.1";
+  version = "4.4.1";
 in
 mkDerivation {
  inherit pname version;

  src = fetchurl {
    url = "https://github.com/vimeo/psalm/releases/download/${version}/psalm.phar";
-    sha256 = "1hv9r5m1mdywm7qi9rs9054jp77cpip3jyw048iq3l7s0vpslkc5";
+    sha256 = "sha256-4hqgAPflzNmeQQaxQATpWYBB5Pz7jKu8Vlw3BiMyhtw=";
  };

  phases = [ "installPhase" ];
--- a/pkgs/development/python-modules/azure-synapse-artifacts/default.nix
+++ b/pkgs/development/python-modules/azure-synapse-artifacts/default.nix
@ -23,8 +23,8 @@ buildPythonPackage rec {
  pythonImportsCheck = [ "azure.synapse.artifacts" ];

  meta = with lib; {
-    description = "CHANGE";
-    homepage = "https://github.com/CHANGE/azure-synapse-artifacts/";
+    description = "Microsoft Azure Synapse Artifacts Client Library for Python";
+    homepage = "https://github.com/Azure/azure-sdk-for-python";
    license = licenses.mit;
    maintainers = with maintainers; [ jonringer ];
  };
--- a/pkgs/development/python-modules/bellows/default.nix
+++ b/pkgs/development/python-modules/bellows/default.nix
@ -1,26 +1,27 @@
-{ lib, stdenv, buildPythonPackage, fetchPypi
+{ lib, stdenv, buildPythonPackage, fetchFromGitHub
 , click, click-log, pure-pcapy3
-, pyserial, pyserial-asyncio, voluptuous, zigpy
-, asynctest, pytest, pytest-asyncio }:
+, pyserial-asyncio, voluptuous, zigpy
+, asynctest, pytestCheckHook, pytest-asyncio }:

-let
+buildPythonPackage rec {
  pname = "bellows";
  version = "0.21.0";

-in buildPythonPackage rec {
-  inherit pname version;
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "fd2ac40c1f3550580dc561ae58d7d15cfa12e6a7cc5d35ee80e7a1cb6a4cda4f";
+  src = fetchFromGitHub {
+    owner = "zigpy";
+    repo = "bellows";
+    rev = version;
+    sha256 = "1gja7cb1cyzbi19k8awa2gyc3bjam0adapalpk5slxny0vxlc73a";
  };

  propagatedBuildInputs = [
-    click click-log pure-pcapy3 pyserial pyserial-asyncio voluptuous zigpy
+    click click-log pure-pcapy3 pyserial-asyncio voluptuous zigpy
  ];

  checkInputs = [
-    asynctest pytest pytest-asyncio
+    asynctest
+    pytestCheckHook
+    pytest-asyncio
  ];

  prePatch = ''
--- a/pkgs/development/python-modules/bidict/default.nix
+++ b/pkgs/development/python-modules/bidict/default.nix
@ -3,7 +3,7 @@
 , sphinx
 , hypothesis
 , py
-, pytest
+, pytestCheckHook
 , pytest-benchmark
 , sortedcollections
 , sortedcontainers
@ -23,23 +23,14 @@ buildPythonPackage rec {
  nativeBuildInputs = [ setuptools_scm ];
  propagatedBuildInputs = [ sphinx ];

-  # this can be removed >0.19.0
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "setuptools_scm < 4" "setuptools_scm"
-  '';
-
  checkInputs = [
    hypothesis
    py
-    pytest
+    pytestCheckHook
    pytest-benchmark
    sortedcollections
    sortedcontainers
  ];
-  checkPhase = ''
-    pytest tests
-  '';

  meta = with lib; {
    homepage = "https://github.com/jab/bidict";
--- a/pkgs/development/python-modules/google-music/default.nix
+++ b/pkgs/development/python-modules/google-music/default.nix
@ -19,11 +19,6 @@ buildPythonPackage rec {
    sha256 = "0fsp491ifsw0i1r98l8xr41m8d00nw9n5bin8k3laqzq1p65d6dp";
  };

-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "audio-metadata>=0.8,<0.9" "audio-metadata"
-  '';
-
  propagatedBuildInputs = [
    appdirs
    audio-metadata
--- a/pkgs/development/python-modules/mxnet/default.nix
+++ b/pkgs/development/python-modules/mxnet/default.nix
@ -20,9 +20,7 @@ buildPythonPackage {

  postPatch = ''
    substituteInPlace python/setup.py \
-      --replace "graphviz<0.9.0," "graphviz" \
-      --replace "numpy<=1.15.2," "numpy" \
-      --replace "requests<2.19.0," "requests"
+      --replace "graphviz<0.9.0," "graphviz"
  '';

  preConfigure = ''
--- a/pkgs/development/python-modules/spyder/default.nix
+++ b/pkgs/development/python-modules/spyder/default.nix
@ -44,8 +44,7 @@ buildPythonPackage rec {
    sed -i /pyqtwebengine/d setup.py
    substituteInPlace setup.py \
      --replace "pyqt5<5.13" "pyqt5" \
-      --replace "parso==0.7.0" "parso" \
-      --replace "jedi==0.17.1" "jedi"
+      --replace "parso==0.7.0" "parso"
  '';

  postInstall = ''
--- a/pkgs/development/tools/operator-sdk/default.nix
+++ b/pkgs/development/tools/operator-sdk/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "operator-sdk";
-  version = "1.2.0";
+  version = "1.3.0";

  src = fetchFromGitHub {
    owner = "operator-framework";
    repo = pname;
    rev = "v${version}";
-    sha256 = "03iy4a5jlsmmzn8cpyp35sc2kgz6shg18ah0qdzkadqqalqlldy8";
+    sha256 = "sha256-xYG605Z8WGFH5byJA+sHPBjBmWi8b+TTtWRnQnmYN/4=";
  };

-  vendorSha256 = "0dls086lw3sbal4rf0l3xb0sp6g393n9ylkpzppp75myj7v900vv";
+  vendorSha256 = "sha256-0ZowddIiVHVg1OKhaCFo+vQKcUe6wZ6L0J8RdMvZyGk=";

  doCheck = false;

--- a/pkgs/development/web/cog/default.nix
+++ b/pkgs/development/web/cog/default.nix
@ -0,0 +1,70 @@
+{ stdenv
+, lib
+, fetchpatch
+, fetchFromGitHub
+, cmake
+, pkg-config
+, wayland
+, wayland-protocols
+, libwpe
+, libwpe-fdo
+, glib
+, glib-networking
+, webkitgtk
+, makeWrapper
+, wrapGAppsHook
+, gnome3
+, gdk-pixbuf
+}:
+
+stdenv.mkDerivation rec {
+  pname = "cog";
+  version = "0.6.0";
+
+  src = fetchFromGitHub {
+    owner = "igalia";
+    repo = "cog";
+    rev = "v${version}";
+    sha256 = "0a0zpdki1whm5gb6ycbazvwmm1fz094mkfwjfy4a7zz0pk54h1jw";
+  };
+
+  buildInputs = [
+    wayland-protocols
+    wayland
+    libwpe
+    libwpe-fdo
+    webkitgtk
+    glib-networking
+    gdk-pixbuf
+    gnome3.adwaita-icon-theme
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wayland
+    makeWrapper
+    wrapGAppsHook
+  ];
+
+  depsBuildsBuild = [
+    pkg-config
+  ];
+
+  cmakeFlags = [
+    "-DCOG_USE_WEBKITGTK=ON"
+  ];
+
+  # not ideal, see https://github.com/WebPlatformForEmbedded/libwpe/issues/59
+  preFixup = ''
+    wrapProgram $out/bin/cog \
+      --prefix LD_LIBRARY_PATH : ${libwpe-fdo}/lib
+  '';
+
+  meta = with lib; {
+    description = "A small single “window” launcher for the WebKit WPE port";
+    license = licenses.mit;
+    maintainers = [ maintainers.matthewbauer ];
+    platforms = platforms.linux;
+  };
+}
--- a/pkgs/development/web/newman/node-composition.nix
+++ b/pkgs/development/web/newman/node-composition.nix
@ -14,4 +14,4 @@ in
 import ./node-packages.nix {
  inherit (pkgs) fetchurl fetchgit;
  inherit nodeEnv;
-}
+}
--- a/pkgs/development/web/newman/node-packages.nix
+++ b/pkgs/development/web/newman/node-packages.nix
@ -5727,4 +5727,4 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
-}
+}
--- a/pkgs/development/web/remarkjs/nodepkgs.nix
+++ b/pkgs/development/web/remarkjs/nodepkgs.nix
@ -14,4 +14,4 @@ in
 import ./node-packages.nix {
  inherit (pkgs) fetchurl fetchgit;
  inherit nodeEnv;
-}
+}
--- a/pkgs/games/0ad/default.nix
+++ b/pkgs/games/0ad/default.nix
@ -1,14 +1,14 @@
-{ wxGTK, newScope }:
-
+{ wxGTK, stdenv, newScope }:
 let
  callPackage = newScope self;

  self = {
-    zeroad-unwrapped = callPackage ./game.nix { inherit wxGTK; };
+    zeroad-unwrapped = callPackage ./game.nix { inherit wxGTK stdenv; };

-    zeroad-data = callPackage ./data.nix { };
+    zeroad-data = callPackage ./data.nix { inherit stdenv; };

    zeroad = callPackage ./wrapper.nix { };
  };

-in self
+in
+self
--- a/pkgs/games/0ad/game.nix
+++ b/pkgs/games/0ad/game.nix
@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
    # Workaround invalid pkg-config name for mozjs
    mkdir pkg-config
    ln -s ${spidermonkey_38}/lib/pkgconfig/* pkg-config/mozjs-38.pc
-    PKG_CONFIG_PATH="$PWD/pkgconfig:$PKG_CONFIG_PATH"
+    PKG_CONFIG_PATH="$PWD/pkg-config:$PKG_CONFIG_PATH"

    # Update Makefiles
    pushd build/workspaces
--- a/pkgs/games/crispy-doom/default.nix
+++ b/pkgs/games/crispy-doom/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "crispy-doom";
-  version = "5.9.2";
+  version = "5.10.0";

  src = fetchFromGitHub {
    owner = "fabiangreffrath";
    repo = pname;
    rev = "${pname}-${version}";
-    sha256 = "0fkw9z66sjcz7k528wyla6mgi4impqimn93yhqmc194ycrjirraa";
+    sha256 = "sha256-hRdd5ZrcVBU7tn1juvrLdbenULzu6OsXefG0oLjjFIg=";
  };

  postPatch = ''
--- a/pkgs/misc/base16-builder/node-packages-generated.nix
+++ b/pkgs/misc/base16-builder/node-packages-generated.nix
@ -1634,4 +1634,4 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
-}
+}
--- a/pkgs/misc/base16-builder/node-packages.nix
+++ b/pkgs/misc/base16-builder/node-packages.nix
@ -18,4 +18,4 @@ in
 import ./node-packages-generated.nix {
  inherit (pkgs) fetchurl fetchgit;
  inherit nodeEnv globalBuildInputs;
-}
+}
--- a/pkgs/misc/base16-builder/supplement.nix
+++ b/pkgs/misc/base16-builder/supplement.nix
@ -690,4 +690,4 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
-}
+}
--- a/pkgs/misc/emulators/mednaffe/default.nix
+++ b/pkgs/misc/emulators/mednaffe/default.nix
@ -1,7 +1,13 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper, autoreconfHook, pkg-config, wrapGAppsHook
-, gtk2 ? null, gtk3 ? null, mednafen }:
-
-with lib;
+{ stdenv
+, lib
+, fetchFromGitHub
+, autoreconfHook
+, pkg-config
+, mednafen
+, gtk2 ? null
+, gtk3 ? null
+, wrapGAppsHook
+}:

 stdenv.mkDerivation rec {
  pname = "mednaffe";
@ -14,13 +20,20 @@ stdenv.mkDerivation rec {
    sha256 = "15qk3a3l1phr8bap2ayh3c0vyvw2jwhny1iz1ajq2adyjpm9fhr7";
  };

-  nativeBuildInputs = [ autoreconfHook makeWrapper pkg-config wrapGAppsHook ];
+  nativeBuildInputs = [ autoreconfHook pkg-config wrapGAppsHook ];
  buildInputs = [ gtk2 gtk3 mednafen ];

-  configureFlags = [ (enableFeature (gtk3 != null) "gtk3") ];
-  postInstall = "wrapProgram $out/bin/mednaffe --set PATH ${mednafen}/bin";
+  configureFlags = [ (lib.enableFeature (gtk3 != null) "gtk3") ];

-  meta = {
+  dontWrapGApps = true;
+
+  postInstall = ''
+    wrapProgram $out/bin/mednaffe \
+      --prefix PATH ':' "${mednafen}/bin" \
+      "''${gappsWrapperArgs[@]}"
+   '';
+
+  meta = with lib; {
    description = "GTK-based frontend for mednafen emulator";
    homepage = "https://github.com/AmatCoder/mednaffe";
    license = licenses.gpl3Plus;
--- a/pkgs/os-specific/darwin/duti/default.nix
+++ b/pkgs/os-specific/darwin/duti/default.nix
@ -1,17 +1,25 @@
-{stdenv, lib, fetchFromGitHub, autoreconfHook, darwin}:
+{stdenv, lib, fetchFromGitHub, autoreconfHook, ApplicationServices}:

 stdenv.mkDerivation rec {
  pname = "duti";
-  version = "1.5.4pre";
+  version = "1.5.5pre";
  src = fetchFromGitHub {
    owner = "moretension";
    repo = pname;
-    rev = "7dbcae86f99fedef5a6c4311f032a0f1ca0539cc";
-    sha256 = "1z9sa0yk87vs57d5338y6lvm1v1vvynxb7dy1x5aqzkcr0imhljl";
+    rev = "fe3d3dc411bcea6af7a8cbe53c0e08ed5ecacdb2";
+    sha256 = "1pg4i6ghpib2gy1sqpml7dbnhr1vbr43fs2pqkd09i4w3nmgpic9";
  };
+
  nativeBuildInputs = [autoreconfHook];
-  buildInputs = [darwin.apple_sdk.frameworks.ApplicationServices];
-  configureFlags = ["--with-macosx-sdk=/homeless-shelter"];
+  buildInputs = [ApplicationServices];
+  configureFlags = [
+    "--with-macosx-sdk=/homeless-shelter"
+
+    # needed to prevent duti from trying to guess our sdk
+    # NOTE: this is different than stdenv.hostPlatform.config!
+    "--host=x86_64-apple-darwin18"
+  ];
+
  meta = with lib; {
    description = "A command-line tool to select default applications for document types and URL schemes on Mac OS X";
    longDescription = ''
--- a/pkgs/os-specific/linux/cifs-utils/default.nix
+++ b/pkgs/os-specific/linux/cifs-utils/default.nix
@ -1,5 +1,5 @@
 { stdenv, lib, fetchurl, autoreconfHook, docutils, pkg-config
-, kerberos, keyutils, pam, talloc }:
+, kerberos, keyutils, pam, talloc, python3 }:

 stdenv.mkDerivation rec {
  pname = "cifs-utils";
@ -12,7 +12,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ autoreconfHook docutils pkg-config ];

-  buildInputs = [ kerberos keyutils pam talloc ];
+  buildInputs = [ kerberos keyutils pam talloc python3 ];

  configureFlags = [ "ROOTSBINDIR=$(out)/sbin" ] ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
    # AC_FUNC_MALLOC is broken on cross builds.
--- a/pkgs/os-specific/linux/sysklogd/default.nix
+++ b/pkgs/os-specific/linux/sysklogd/default.nix
@ -8,7 +8,7 @@ stdenv.mkDerivation {
    sha256 = "00f2wy6f0qng7qzga4iicyzl9j8b7mp6mrpfky5jxj93ms2w2rji";
  };

-  patches = [ ./systemd.patch ./union-wait.patch ];
+  patches = [ ./systemd.patch ./union-wait.patch ./fix-includes-for-musl.patch ];

  NIX_CFLAGS_COMPILE = "-DSYSV";

--- a/pkgs/os-specific/linux/sysklogd/fix-includes-for-musl.patch
+++ b/pkgs/os-specific/linux/sysklogd/fix-includes-for-musl.patch
@ -0,0 +1,120 @@
+# this patch both fixes some include paths as well as removes glibc
+# gates around defines that musl-libc also depends on.
+diff -u sysklogd-1.5.1.orig/klogd.c sysklogd-1.5.1/klogd.c
+--- sysklogd-1.5.1.orig/klogd.c	2014-10-04 15:47:18.000000000 -0400
+++ sysklogd-1.5.1/klogd.c	2021-01-18 23:09:23.000000000 -0500
+@@ -260,11 +260,8 @@
+ #include <unistd.h>
+ #include <signal.h>
+ #include <errno.h>
+-#include <sys/fcntl.h>
+#include <fcntl.h>
+ #include <sys/stat.h>
+-#if !defined(__GLIBC__)
+-#include <linux/time.h>
+-#endif /* __GLIBC__ */
+ #include <stdarg.h>
+ #include <paths.h>
+ #include <stdlib.h>
+@@ -277,13 +274,8 @@
+ 
+ #define __LIBRARY__
+ #include <linux/unistd.h>
+-#if !defined(__GLIBC__)
+-# define __NR_ksyslog __NR_syslog
+-_syscall3(int,ksyslog,int, type, char *, buf, int, len);
+-#else
+ #include <sys/klog.h>
+ #define ksyslog klogctl
+-#endif
+ 
+ #define LOG_BUFFER_SIZE 4096
+ #define LOG_LINE_LENGTH 1000
+diff -u sysklogd-1.5.1.orig/ksym_mod.c sysklogd-1.5.1/ksym_mod.c
+--- sysklogd-1.5.1.orig/ksym_mod.c	2014-10-04 15:47:18.000000000 -0400
+++ sysklogd-1.5.1/ksym_mod.c	2021-01-18 23:09:57.000000000 -0500
+@@ -113,12 +113,9 @@
+ #include <unistd.h>
+ #include <signal.h>
+ #include <errno.h>
+-#include <sys/fcntl.h>
+#include <fcntl.h>
+ #include <sys/stat.h>
+ #include "module.h"
+-#if !defined(__GLIBC__)
+-#include <linux/time.h>
+-#endif /* __GLIBC__ */
+ #include <stdarg.h>
+ #include <paths.h>
+ #include <linux/version.h>
+diff -u sysklogd-1.5.1.orig/pidfile.c sysklogd-1.5.1/pidfile.c
+--- sysklogd-1.5.1.orig/pidfile.c	2014-10-04 15:47:18.000000000 -0400
+++ sysklogd-1.5.1/pidfile.c	2021-01-18 23:23:55.000000000 -0500
+@@ -25,6 +25,7 @@
+  */
+ 
+ #include <stdio.h>
+#include <fcntl.h>
+ #include <unistd.h>
+ #include <sys/stat.h>
+ #include <sys/file.h>
+diff -u sysklogd-1.5.1.orig/syslog.c sysklogd-1.5.1/syslog.c
+--- sysklogd-1.5.1.orig/syslog.c	2014-10-04 15:47:18.000000000 -0400
+++ sysklogd-1.5.1/syslog.c	2021-01-18 23:11:45.000000000 -0500
+@@ -55,7 +55,6 @@
+ #include <sys/types.h>
+ #include <sys/socket.h>
+ #include <sys/file.h>
+-#include <sys/signal.h>
+ #include <sys/syslog.h>
+ #if 0
+ #include "syslog.h"
+@@ -64,6 +63,8 @@
+ 
+ #include <sys/uio.h>
+ #include <sys/wait.h>
+#include <signal.h>
+#include <fcntl.h>
+ #include <netdb.h>
+ #include <string.h>
+ #include <time.h>
+diff -u sysklogd-1.5.1.orig/syslogd.c sysklogd-1.5.1/syslogd.c
+--- sysklogd-1.5.1.orig/syslogd.c	2014-10-04 15:47:18.000000000 -0400
+++ sysklogd-1.5.1/syslogd.c	2021-01-18 23:13:25.000000000 -0500
+@@ -519,9 +519,9 @@
+ #include <time.h>
+ 
+ #define SYSLOG_NAMES
+#include <errno.h>
+ #include <sys/syslog.h>
+ #include <sys/param.h>
+-#include <sys/errno.h>
+ #include <sys/ioctl.h>
+ #include <sys/stat.h>
+ #include <sys/wait.h>
+@@ -818,9 +818,7 @@
+ void init();
+ void cfline(char *line, register struct filed *f);
+ int decode(char *name, struct code *codetab);
+-#if defined(__GLIBC__)
+ #define dprintf mydprintf
+-#endif /* __GLIBC__ */
+ static void dprintf(char *, ...);
+ static void allocate_log(void);
+ void sighup_handler();
+@@ -840,15 +838,9 @@
+ 	register char *p;
+ #ifndef TESTING
+ 	ssize_t msglen;
+-#endif
+-#if !defined(__GLIBC__)
+-	int len, num_fds;
+-#else /* __GLIBC__ */
+-#ifndef TESTING
+ 	socklen_t len;
+ #endif
+ 	int num_fds;
+-#endif /* __GLIBC__ */
+ 	/*
+ 	 * It took me quite some time to figure out how this is
+ 	 * supposed to work so I guess I should better write it down.
--- a/pkgs/os-specific/linux/sysklogd/systemd.patch
+++ b/pkgs/os-specific/linux/sysklogd/systemd.patch
@ -71,9 +71,9 @@ diff -ruN -x '*~' sysklogd-1.5-old/sd-daemon.c sysklogd-1.5/sd-daemon.c
 +#include <sys/stat.h>
 +#include <sys/socket.h>
 +#include <sys/un.h>
-+#include <sys/fcntl.h>
 +#include <netinet/in.h>
 +#include <stdlib.h>
+#include <fcntl.h>
 +#include <errno.h>
 +#include <unistd.h>
 +#include <string.h>
--- a/pkgs/servers/dns/knot-dns/default.nix
+++ b/pkgs/servers/dns/knot-dns/default.nix
@ -7,11 +7,11 @@ let inherit (lib) optional optionals; in

 stdenv.mkDerivation rec {
  pname = "knot-dns";
-  version = "3.0.3";
+  version = "3.0.4";

  src = fetchurl {
    url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "fbc51897ef0ed0639ebad59b988a91382b9544288a2db8254f0b1de433140e38";
+    sha256 = "451d8913a769b7e4bcb3e250a3181b448e28a82cfc58cea6f2509475d7327983";
  };

  outputs = [ "bin" "out" "dev" ];
--- a/pkgs/servers/matrix-synapse/matrix-appservice-slack/node-composition.nix
+++ b/pkgs/servers/matrix-synapse/matrix-appservice-slack/node-composition.nix
@ -14,4 +14,4 @@ in
 import ./node-packages.nix {
  inherit (pkgs) fetchurl fetchgit;
  inherit nodeEnv;
-}
+}
--- a/pkgs/servers/monitoring/prometheus/sql-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/sql-exporter.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "sql_exporter";
-  version = "0.3.0";
+  version = "0.4.0";

  vendorSha256 = null;

  src = fetchFromGitHub {
    owner = "justwatchcom";
-    repo = "sql_exporter";
+    repo = pname;
    rev = "v${version}";
-    sha256 = "125brlxgwhkn3z5v0522gpm0sk6v905ghh05c4c3wf1hlm7bhnrc";
+    sha256 = "0dxzcd3b430xby741fdc85k4d2380jrh34xxskmdzxbf2kqdc5k8";
  };

  meta = with lib; {
--- a/pkgs/servers/plex/raw.nix
+++ b/pkgs/servers/plex/raw.nix
@ -12,16 +12,16 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.21.1.3842-b0c7a97d9";
+  version = "1.21.1.3876-3c3adfcb4";
  pname = "plexmediaserver";

  # Fetch the source
  src = if stdenv.hostPlatform.system == "aarch64-linux" then fetchurl {
    url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-    sha256 = "0wq8q9dvdwciazidvh9plxjzngjr6ibg077yksxhy41dv14vkw7s";
+    sha256 = "1xpsmk5l0f0blqp5ba9n1w0npsk692p07hp4ipkq7yz3mfag50p0";
  } else fetchurl {
    url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-    sha256 = "14pa50kvgi4m5hbw4a0q7y3s4xn9ghvnm4vdim9g18p1khfmwmwp";
+    sha256 = "0dyw84x9h295428l7r8iqfb2vxkv0f1d68z1j2ka3wsw7cj1yq78";
  };

  outputs = [ "out" "basedb" ];
--- a/pkgs/servers/web-apps/cryptpad/node-packages-generated.nix
+++ b/pkgs/servers/web-apps/cryptpad/node-packages-generated.nix
@ -741,4 +741,4 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
-}
+}
--- a/pkgs/servers/web-apps/cryptpad/node-packages.nix
+++ b/pkgs/servers/web-apps/cryptpad/node-packages.nix
@ -14,4 +14,4 @@ in
 import ./node-packages-generated.nix {
  inherit (pkgs) fetchurl fetchgit;
  inherit nodeEnv;
-}
+}
--- a/pkgs/servers/web-apps/whitebophir/node-packages-generated.nix
+++ b/pkgs/servers/web-apps/whitebophir/node-packages-generated.nix
@ -1492,4 +1492,4 @@ in
    bypassCache = true;
    reconstructLock = true;
  };
-}
+}
--- a/pkgs/servers/zigbee2mqtt/node-packages.nix
+++ b/pkgs/servers/zigbee2mqtt/node-packages.nix
@ -10090,4 +10090,4 @@ in
  tarball = nodeEnv.buildNodeSourceDist args;
  package = nodeEnv.buildNodePackage args;
  shell = nodeEnv.buildNodeShell args;
-}
+}
--- a/pkgs/servers/zigbee2mqtt/node.nix
+++ b/pkgs/servers/zigbee2mqtt/node.nix
@ -14,4 +14,4 @@ in
 import ./node-packages.nix {
  inherit (pkgs) fetchurl fetchgit;
  inherit nodeEnv;
-}
+}
--- a/pkgs/tools/X11/opentabletdriver/default.nix
+++ b/pkgs/tools/X11/opentabletdriver/default.nix
@ -23,18 +23,18 @@

 stdenv.mkDerivation rec {
  pname = "OpenTabletDriver";
-  version = "0.4.2";
+  version = "0.5.0";

  src = fetchFromGitHub {
    owner = "InfinityGhost";
    repo = "OpenTabletDriver";
    rev = "v${version}";
-    sha256 = "048y7gjlk2yw4vh62px1d9w0va6ap1a0cndcpbirlyj9q6b8jxax";
+    sha256 = "1xi97nn5zb4fs3pyyqznvxnz07j30j3p967s7jigjmlm9321vkqp";
  };

  debPkg = fetchurl {
    url = "https://github.com/InfinityGhost/OpenTabletDriver/releases/download/v${version}/OpenTabletDriver.deb";
-    sha256 = "13gg0dhvjy88h9lhcrp30fjiwgb9dzjsgk1k760pi1ki71a5vz2r";
+    sha256 = "06m2g5qvc02ga9f98f2ssa7wr2b7b2qm90qwaf17fz5z8rr0qmp0";
  };

  nativeBuildInputs = [
@ -134,8 +134,8 @@ stdenv.mkDerivation rec {
    install -Dm644 $src/OpenTabletDriver.UX/Assets/otd.png -t $out/share/pixmaps

    # TODO: Ideally this should be build from OpenTabletDriver/OpenTabletDriver-udev instead
-    dpkg-deb --fsys-tarfile ${debPkg} | tar xf - ./usr/lib/udev/rules.d/30-opentabletdriver.rules
-    install -Dm644 ./usr/lib/udev/rules.d/30-opentabletdriver.rules -t $out/lib/udev/rules.d
+    dpkg-deb --fsys-tarfile ${debPkg} | tar xf - ./usr/lib/udev/rules.d/99-opentabletdriver.rules
+    install -Dm644 ./usr/lib/udev/rules.d/99-opentabletdriver.rules -t $out/lib/udev/rules.d

    runHook postInstall
  '';
@ -155,8 +155,11 @@ stdenv.mkDerivation rec {
  dontWrapGApps = true;
  dontStrip = true;

-  passthru.tests = {
-    otd-runs = nixosTests.opentabletdriver;
+  passthru = {
+    updateScript = ./update.sh;
+    tests = {
+      otd-runs = nixosTests.opentabletdriver;
+    };
  };

  meta = with lib; {
--- a/pkgs/tools/X11/opentabletdriver/deps.nix
+++ b/pkgs/tools/X11/opentabletdriver/deps.nix
@ -11,13 +11,13 @@
  })
  (fetchNuGet {
    name = "Eto.Forms";
-    version = "2.5.6";
-    sha256 = "035ny8jlanchwq16gcq0xb6ywabjl71c7qbpv26sjwg96na8vz51";
+    version = "2.5.10";
+    sha256 = "1d71wglk4ixfqfbm6sxmj753x5iwbar8i9zzjy3bh64fy1dn8lz7";
  })
  (fetchNuGet {
    name = "Eto.Platform.Gtk";
-    version = "2.5.6";
-    sha256 = "1ijkjd3lc7x59yk369kxipzgk1zhyr9g6k319wc0n033vij26mwl";
+    version = "2.5.10";
+    sha256 = "1pkqvlfx7bzracnw19bl50i9jg4ym376vihmy9qq7m5z5nfdqn4g";
  })
  (fetchNuGet {
    name = "GdkSharp";
@ -41,8 +41,8 @@
  })
  (fetchNuGet {
    name = "HidSharpCore";
-    version = "1.1.0";
-    sha256 = "122s5j3wrv8hcgnbxrnjqydvcfz7gdm8xq0wlwzrgwdjk44lr45a";
+    version = "1.2.1";
+    sha256 = "0vcw38skr9g691gxbzv3cf6y9rk11vh5pvcyjshdgii2z1z8a4g2";
  })
  (fetchNuGet {
    name = "MessagePack.Annotations";
@ -120,9 +120,9 @@
    sha256 = "0w2fbji1smd2y7x25qqibf1qrznmv4s6s0jvrbvr6alb7mfyqvh5";
  })
  (fetchNuGet {
-    name = "Newtonsoft.Json";
-    version = "12.0.3";
-    sha256 = "17dzl305d835mzign8r15vkmav2hq8l6g7942dfjpnzr17wwl89x";
+    name = "Octokit";
+    version = "0.48.0";
+    sha256 = "17ria1shx04rb6knbaswpqndmwam6v3r3lsfsd486q584798ccn8";
  })
  (fetchNuGet {
    name = "PangoSharp";
@ -204,6 +204,11 @@
    version = "4.3.2";
    sha256 = "1x0g58pbpjrmj2x2qw17rdwwnrcl0wvim2hdwz48lixvwvp22n9c";
  })
+  (fetchNuGet {
+    name = "SharpZipLib";
+    version = "1.3.1";
+    sha256 = "09zypjfils38143da507s5fi4hzvdlz32wfav219hksnpl35y8x0";
+  })
  (fetchNuGet {
    name = "StreamJsonRpc";
    version = "2.6.121";
@ -229,11 +234,6 @@
    version = "2.0.0-beta1.20253.1";
    sha256 = "16saf1fm9q80bb624fkqz0ksrwpnbw9617d7xg3jib7a2wgagm2r";
  })
-  (fetchNuGet {
-    name = "System.CommandLine";
-    version = "2.0.0-beta1.20303.1";
-    sha256 = "0isnz8ipqlqim06hf56zlaq2vnsy5facvf5nvq6kzm5h1dm3l2vn";
-  })
  (fetchNuGet {
    name = "System.ComponentModel.Annotations";
    version = "4.7.0";
@ -319,11 +319,6 @@
    version = "4.3.0";
    sha256 = "1gfj800078kggcgl0xyl00a6y5k4wwh2k2qm69rjy22wbmq7fy4p";
  })
-  (fetchNuGet {
-    name = "System.Numerics.Vectors";
-    version = "4.5.0";
-    sha256 = "1kzrj37yzawf1b19jq0253rcs8hsq1l2q8g69d7ipnhzb0h97m59";
-  })
  (fetchNuGet {
    name = "System.Reflection.Emit.Lightweight";
    version = "4.6.0";
--- a/pkgs/tools/X11/opentabletdriver/update.sh
+++ b/pkgs/tools/X11/opentabletdriver/update.sh
@ -14,6 +14,14 @@ if [[ "$new_version" == "$old_version" ]]; then
  [[ "${1}" != "--force" ]] && exit 0
 fi

+# Updating the hash of deb package manually since there seems to be no way to do it automatically
+oldDebPkgUrl="https://github.com/InfinityGhost/OpenTabletDriver/releases/download/v${old_version}/OpenTabletDriver.deb";
+newDebPkgUrl="https://github.com/InfinityGhost/OpenTabletDriver/releases/download/v${new_version}/OpenTabletDriver.deb";
+oldDebSha256=$(nix-prefetch-url "$oldDebPkgUrl")
+newDebSha256=$(nix-prefetch-url "$newDebPkgUrl")
+echo "oldDebSha256: $oldDebSha256 newDebSha256: $newDebSha256"
+sed -i ./default.nix -re "s|\"$oldDebSha256\"|\"$newDebSha256\"|"
+
 cd ../../../..
 update-source-version opentabletdriver "$new_version"
 store_src="$(nix-build . -A opentabletdriver.src --no-out-link)"
--- a/pkgs/tools/compression/zdelta/default.nix
+++ b/pkgs/tools/compression/zdelta/default.nix
@ -9,7 +9,7 @@ stdenv.mkDerivation rec {
  };

  meta = with lib; {
-	  homepage = "http://cis.poly.edu/zdelta";
+    homepage = "http://cis.poly.edu/zdelta";
    platforms = platforms.linux;
    license = licenses.zlib;
  };
--- a/pkgs/tools/graphics/ldgallery/viewer/node-composition.nix
+++ b/pkgs/tools/graphics/ldgallery/viewer/node-composition.nix
@ -14,4 +14,4 @@ in
 import ./node-packages.nix {
  inherit (pkgs) fetchurl fetchgit;
  inherit nodeEnv;
-}
+}
--- a/pkgs/tools/graphics/ldgallery/viewer/node-packages.nix
+++ b/pkgs/tools/graphics/ldgallery/viewer/node-packages.nix
@ -13266,4 +13266,4 @@ in
  tarball = nodeEnv.buildNodeSourceDist args;
  package = nodeEnv.buildNodePackage args;
  shell = nodeEnv.buildNodeShell args;
-}
+}
--- a/pkgs/tools/graphics/pdfredacttools/default.nix
+++ b/pkgs/tools/graphics/pdfredacttools/default.nix
@ -22,8 +22,8 @@ python2Packages.buildPythonApplication rec {
  meta = with lib; {
    description = "Redact and strip metadata from documents before publishing";
    longDescription = ''
-	PDF Redact Tools helps with securely redacting and stripping metadata
-	from documents before publishing. Note that this is not a security tool.
+        PDF Redact Tools helps with securely redacting and stripping metadata
+        from documents before publishing. Note that this is not a security tool.
        It uses ImageMagick to parse PDFs.  While ImageMagick is a versatile tool, it has
        a history of several security bugs. A malicious PDF could exploit a bug in
        ImageMagick to take over your computer. If you're working with potentially
--- a/pkgs/tools/misc/disfetch/default.nix
+++ b/pkgs/tools/misc/disfetch/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "disfetch";
-  version = "1.13";
+  version = "1.14";

  src = fetchFromGitHub {
    owner = "llathasa-veleth";
    repo = "disfetch";
    rev = version;
-    sha256 = "14vccp1z0g2hr9alx2ydz29hfa4xfv9irdjsvqm94fbyi5fa87k0";
+    sha256 = "0p5pj8d761gz95ar35s8q6lrybrg9jik33kwnsxvb14n990kya0p";
  };

  dontBuild = true;
--- a/pkgs/tools/security/bitwarden/default.nix
+++ b/pkgs/tools/security/bitwarden/default.nix
@ -17,11 +17,11 @@ let
  pname = "bitwarden";

  version = {
-    x86_64-linux = "1.23.0";
+    x86_64-linux = "1.23.1";
  }.${system} or "";

  sha256 = {
-    x86_64-linux = "1z1r8327xymqf2h98wb2fb02s41pxc6fh5w4bxmdgpx7k1jx5kvg";
+    x86_64-linux = "1jv6w1g6b9c4xa5zy7pgzrkn8k4pyy3cdkh0nw2czn1cw2gaccs1";
  }.${system} or "";

  meta = with lib; {
--- a/pkgs/tools/security/chkrootkit/default.nix
+++ b/pkgs/tools/security/chkrootkit/default.nix
@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl }:

 stdenv.mkDerivation rec {
-  name = "chkrootkit-0.53";
+  name = "chkrootkit-0.54";

  src = fetchurl {
    url = "ftp://ftp.pangeia.com.br/pub/seg/pac/${name}.tar.gz";
-    sha256 = "1da5ry3p7jb6xs6xlfml1ly09q2rs5q6n5axif17d29k7gixlqkj";
+    sha256 = "sha256-FUySaSH1PbYHKKfLyXyohli2lMFLfSiO/jg+CEmRVgc=";
  };

  # TODO: a lazy work-around for linux build failure ...
--- a/pkgs/tools/security/sigurlx/default.nix
+++ b/pkgs/tools/security/sigurlx/default.nix
@ -0,0 +1,25 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+}:
+
+buildGoModule rec {
+  pname = "sigurlx";
+  version = "2.1.0";
+
+  src = fetchFromGitHub {
+    owner = "drsigned";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1q5vy05387qx7h4xcccvn2z2ks1kiff3mfbd2w3w0l0a4qgz74xs";
+  };
+
+  vendorSha256 = "1bp6bf99rxlyg91pn1y228q18lawpykmvkl22cydmclms0q0n238";
+
+  meta = with lib; {
+    description = "Tool to map the attack surface of web applications";
+    homepage = "https://github.com/drsigned/sigurlx";
+    license = with licenses; [ mit ];
+    maintainers = with maintainers; [ fab ];
+  };
+}
--- a/pkgs/tools/system/monit/default.nix
+++ b/pkgs/tools/system/monit/default.nix
@ -6,11 +6,11 @@
 }:

 stdenv.mkDerivation rec {
-  name = "monit-5.27.1";
+  name = "monit-5.27.2";

  src = fetchurl {
    url = "${meta.homepage}dist/${name}.tar.gz";
-    sha256 = "0lgdhif6x11fcpli0qn138rpdvrfnwmkzsy4lc9pas45c78hhx7m";
+    sha256 = "sha256-2ICceNXcHtenujKlpVxRFIVRMsxNpIBfjTqvjPRuqkw=";
  };

  nativeBuildInputs = [ bison flex ];
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -11626,6 +11626,7 @@ in
  bingrep = callPackage ../development/tools/analysis/bingrep { };

  binutils-unwrapped = callPackage ../development/tools/misc/binutils {
+    autoreconfHook = if targetPlatform.isiOS then autoreconfHook269 else autoreconfHook;
    # FHS sys dirs presumably only have stuff for the build platform
    noSysDirs = (stdenv.targetPlatform != stdenv.hostPlatform) || noSysDirs;
  };
@ -13183,6 +13184,8 @@ in

  cointop = callPackage ../applications/misc/cointop { };

+  cog = callPackage ../development/web/cog { };
+
  ctl = callPackage ../development/libraries/ctl { };

  ctpp2 = callPackage ../development/libraries/ctpp2 { };
@ -15455,6 +15458,10 @@ in

  libixp_hg = callPackage ../development/libraries/libixp-hg { };

+  libwpe = callPackage ../development/libraries/libwpe { };
+
+  libwpe-fdo = callPackage ../development/libraries/libwpe/fdo.nix { };
+
  libyaml = callPackage ../development/libraries/libyaml { };

  libyamlcpp = callPackage ../development/libraries/libyaml-cpp { };
@ -18231,6 +18238,8 @@ in

  sickrage = callPackage ../servers/sickbeard/sickrage.nix { };

+  sigurlx = callPackage ../tools/security/sigurlx { };
+
  sipwitch = callPackage ../servers/sip/sipwitch { };

  slimserver = callPackage ../servers/slimserver { };
@ -27097,6 +27106,7 @@ in

  zeroadPackages = dontRecurseIntoAttrs (callPackage ../games/0ad {
    wxGTK = wxGTK30;
+    stdenv = gcc9Stdenv;
  });

  zeroad = zeroadPackages.zeroad;
@ -29510,7 +29520,9 @@ in

  phonetisaurus = callPackage ../development/libraries/phonetisaurus {};

-  duti = callPackage ../os-specific/darwin/duti {};
+  duti = callPackage ../os-specific/darwin/duti {
+    inherit (darwin.apple_sdk.frameworks) ApplicationServices;
+  };

  dnstracer = callPackage ../tools/networking/dnstracer {
    inherit (darwin) libresolv;
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@ -19038,6 +19038,7 @@ let
      description = "lib/Safe/Hole.pm";
      license = with lib.licenses; [ artistic1 gpl1Plus ];
      homepage = "https://github.com/toddr/Safe-Hole";
+      broken = stdenv.isDarwin;
    };
  };