Merge master into haskell-updates

2024-11-12 03:56:17 +03:00 · 2022-06-25 00:13:01 +00:00 · 2022-06-25 00:13:01 +00:00 · e866ce7680
commit e866ce7680
parent 7d3e319949 4d609b11a8
132 changed files with 2232 additions and 1675 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -6353,6 +6353,13 @@
    github = "jsierles";
    githubId = 82;
  };
+  jsimonetti = {
+    email = "jeroen+nixpkgs@simonetti.nl";
+    matrix = "@jeroen:simonetti.nl";
+    name = "Jeroen Simonetti";
+    github = "jsimonetti";
+    githubId = 5478838;
+  };
  jtcoolen = {
    email = "jtcoolen@pm.me";
    name = "Julien Coolen";
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@ -94,6 +94,16 @@ with lib.maintainers; {
    enableFeatureFreezePing = true;
  };

+  c3d2 = {
+    members = [
+      astro
+      SuperSandro2000
+    ];
+    scope = "Maintain packages used in the C3D2 hackspace";
+    shortName = "c3d2";
+    enableFeatureFreezePing = true;
+  };
+
  cinnamon = {
    members = [
      mkg20001
--- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml
@ -142,6 +142,13 @@
          <link linkend="opt-services.persistent-evdev.enable">services.persistent-evdev</link>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://schleuder.org/">schleuder</link>, a
+          mailing list manager with PGP support. Enable using
+          <link linkend="opt-services.schleuder.enable">services.schleuder</link>.
+        </para>
+      </listitem>
      <listitem>
        <para>
          <link xlink:href="https://www.expressvpn.com">expressvpn</link>,
@ -262,6 +269,12 @@
          and require manual remediation.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>zfs</literal> was updated from 2.1.4 to 2.1.5,
+          enabling it to be used with Linux kernel 5.18.
+        </para>
+      </listitem>
      <listitem>
        <para>
          memtest86+ was updated from 5.00-coreboot-002 to 6.00-beta2.
--- a/nixos/doc/manual/release-notes/rl-2211.section.md
+++ b/nixos/doc/manual/release-notes/rl-2211.section.md
@ -60,6 +60,8 @@ In addition to numerous new and upgraded packages, this release has the followin
  Available as [services.infnoise](options.html#opt-services.infnoise.enable).
 - [persistent-evdev](https://github.com/aiberia/persistent-evdev), a daemon to add virtual proxy devices that mirror a physical input device but persist even if the underlying hardware is hot-plugged. Available as [services.persistent-evdev](#opt-services.persistent-evdev.enable).

+- [schleuder](https://schleuder.org/), a mailing list manager with PGP support. Enable using [services.schleuder](#opt-services.schleuder.enable).
+
 - [expressvpn](https://www.expressvpn.com), the CLI client for ExpressVPN. Available as [services.expressvpn](#opt-services.expressvpn.enable).

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@ -102,6 +104,8 @@ Use `configure.packages` instead.

 - Matrix Synapse now requires entries in the `state_group_edges` table to be unique, in order to prevent accidentally introducing duplicate information (for example, because a database backup was restored multiple times). If your Synapse database already has duplicate rows in this table, this could fail with an error and require manual remediation.

+- `zfs` was updated from 2.1.4 to 2.1.5, enabling it to be used with Linux kernel 5.18.
+
 - memtest86+ was updated from 5.00-coreboot-002 to 6.00-beta2. It is now the upstream version from https://www.memtest.org/, as coreboot's fork is no longer available.

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -515,6 +515,7 @@
  ./services/mail/rspamd.nix
  ./services/mail/rss2email.nix
  ./services/mail/roundcube.nix
+  ./services/mail/schleuder.nix
  ./services/mail/sympa.nix
  ./services/mail/nullmailer.nix
  ./services/matrix/appservice-discord.nix
@ -893,6 +894,7 @@
  ./services/networking/redsocks.nix
  ./services/networking/resilio.nix
  ./services/networking/robustirc-bridge.nix
+  ./services/networking/routedns.nix
  ./services/networking/rpcbind.nix
  ./services/networking/rxe.nix
  ./services/networking/sabnzbd.nix
--- a/nixos/modules/services/mail/schleuder.nix
+++ b/nixos/modules/services/mail/schleuder.nix
@ -0,0 +1,162 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.services.schleuder;
+  settingsFormat = pkgs.formats.yaml { };
+  postfixMap = entries: lib.concatStringsSep "\n" (lib.mapAttrsToList (name: value: "${name} ${value}") entries);
+  writePostfixMap = name: entries: pkgs.writeText name (postfixMap entries);
+  configScript = pkgs.writeScript "schleuder-cfg" ''
+    #!${pkgs.runtimeShell}
+    set -exuo pipefail
+    umask 0077
+    ${pkgs.yq}/bin/yq \
+      --slurpfile overrides <(${pkgs.yq}/bin/yq . <${lib.escapeShellArg cfg.extraSettingsFile}) \
+      < ${settingsFormat.generate "schleuder.yml" cfg.settings} \
+      '. * $overrides[0]' \
+      > /etc/schleuder/schleuder.yml
+    chown schleuder: /etc/schleuder/schleuder.yml
+  '';
+in
+{
+  options.services.schleuder = {
+    enable = lib.mkEnableOption "Schleuder secure remailer";
+    enablePostfix = lib.mkEnableOption "automatic postfix integration" // { default = true; };
+    lists = lib.mkOption {
+      description = ''
+        List of list addresses that should be handled by Schleuder.
+
+        Note that this is only handled by the postfix integration, and
+        the setup of the lists, their members and their keys has to be
+        performed separately via schleuder's API, using a tool such as
+        schleuder-cli.
+      '';
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      example = [ "widget-team@example.com" "security@example.com" ];
+    };
+    /* maybe one day....
+      domains = lib.mkOption {
+      description = "Domains for which all mail should be handled by Schleuder.";
+      type = lib.types.listOf lib.types.str;
+      default = [];
+      example = ["securelists.example.com"];
+      };
+    */
+    settings = lib.mkOption {
+      description = ''
+        Settings for schleuder.yml.
+
+        Check the <link xlink:href="https://0xacab.org/schleuder/schleuder/blob/master/etc/schleuder.yml">example configuration</link> for possible values.
+      '';
+      type = lib.types.submodule {
+        freeformType = settingsFormat.type;
+        options.keyserver = lib.mkOption {
+          type = lib.types.str;
+          description = ''
+            Key server from which to fetch and update keys.
+
+            Note that NixOS uses a different default from upstream, since the upstream default sks-keyservers.net is deprecated.
+          '';
+          default = "keys.openpgp.org";
+        };
+      };
+      default = { };
+    };
+    extraSettingsFile = lib.mkOption {
+      description = "YAML file to merge into the schleuder config at runtime. This can be used for secrets such as API keys.";
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+    };
+    listDefaults = lib.mkOption {
+      description = ''
+        Default settings for lists (list-defaults.yml).
+
+        Check the <link xlink:href="https://0xacab.org/schleuder/schleuder/-/blob/master/etc/list-defaults.yml">example configuration</link> for possible values.
+      '';
+      type = settingsFormat.type;
+      default = { };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !(cfg.settings.api ? valid_api_keys);
+        message = ''
+          services.schleuder.settings.api.valid_api_keys is set. Defining API keys via NixOS config results in them being copied to the world-readable Nix store. Please use the extraSettingsFile option to store API keys in a non-public location.
+        '';
+      }
+      {
+        assertion = !(lib.any (db: db ? password) (lib.attrValues cfg.settings.database or {}));
+        message = ''
+          A password is defined for at least one database in services.schleuder.settings.database. Defining passwords via NixOS config results in them being copied to the world-readable Nix store. Please use the extraSettingsFile option to store database passwords in a non-public location.
+        '';
+      }
+    ];
+    users.users.schleuder.isSystemUser = true;
+    users.users.schleuder.group = "schleuder";
+    users.groups.schleuder = {};
+    environment.systemPackages = [
+      pkgs.schleuder-cli
+    ];
+    services.postfix = lib.mkIf cfg.enablePostfix {
+      extraMasterConf = ''
+        schleuder  unix  -       n       n       -       -       pipe
+          flags=DRhu user=schleuder argv=/${pkgs.schleuder}/bin/schleuder work ''${recipient}
+      '';
+      transport = lib.mkIf (cfg.lists != [ ]) (postfixMap (lib.genAttrs cfg.lists (_: "schleuder:")));
+      extraConfig = ''
+        schleuder_destination_recipient_limit = 1
+      '';
+      # review: does this make sense?
+      localRecipients = lib.mkIf (cfg.lists != [ ]) cfg.lists;
+    };
+    systemd.services = let commonServiceConfig = {
+      # We would have liked to use DynamicUser, but since the default
+      # database is SQLite and lives in StateDirectory, and that same
+      # database needs to be readable from the postfix service, this
+      # isn't trivial to do.
+      User = "schleuder";
+      StateDirectory = "schleuder";
+      StateDirectoryMode = "0700";
+    }; in
+      {
+        schleuder-init = {
+          serviceConfig = commonServiceConfig // {
+            ExecStartPre = lib.mkIf (cfg.extraSettingsFile != null) [
+              "+${configScript}"
+            ];
+            ExecStart = [ "${pkgs.schleuder}/bin/schleuder install" ];
+            Type = "oneshot";
+          };
+        };
+        schleuder-api-daemon = {
+          after = [ "local-fs.target" "network.target" "schleuder-init.service" ];
+          wantedBy = [ "multi-user.target" ];
+          requires = [ "schleuder-init.service" ];
+          serviceConfig = commonServiceConfig // {
+            ExecStart = [ "${pkgs.schleuder}/bin/schleuder-api-daemon" ];
+          };
+        };
+        schleuder-weekly-key-maintenance = {
+          after = [ "local-fs.target" "network.target" ];
+          startAt = "weekly";
+          serviceConfig = commonServiceConfig // {
+            ExecStart = [
+              "${pkgs.schleuder}/bin/schleuder refresh_keys"
+              "${pkgs.schleuder}/bin/schleuder check_keys"
+            ];
+          };
+        };
+      };
+
+    environment.etc."schleuder/schleuder.yml" = lib.mkIf (cfg.extraSettingsFile == null) {
+      source = settingsFormat.generate "schleuder.yml" cfg.settings;
+    };
+    environment.etc."schleuder/list-defaults.yml".source = settingsFormat.generate "list-defaults.yml" cfg.listDefaults;
+
+    services.schleuder = {
+      #lists_dir = "/var/lib/schleuder.lists";
+      settings.filters_dir = lib.mkDefault "/var/lib/schleuder/filters";
+      settings.keyword_handlers_dir = lib.mkDefault "/var/lib/schleuder/keyword_handlers";
+    };
+  };
+}
--- a/nixos/modules/services/networking/routedns.nix
+++ b/nixos/modules/services/networking/routedns.nix
@ -0,0 +1,84 @@
+{ config
+, lib
+, pkgs
+, ...
+}:
+
+with lib;
+
+let
+  cfg = config.services.routedns;
+  settingsFormat = pkgs.formats.toml { };
+in
+{
+  options.services.routedns = {
+    enable = mkEnableOption "RouteDNS - DNS stub resolver, proxy and router";
+
+    settings = mkOption {
+      type = settingsFormat.type;
+      example = literalExpression ''
+        {
+          resolvers.cloudflare-dot = {
+            address = "1.1.1.1:853";
+            protocol = "dot";
+          };
+          groups.cloudflare-cached = {
+            type = "cache";
+            resolvers = ["cloudflare-dot"];
+          };
+          listeners.local-udp = {
+            address = "127.0.0.1:53";
+            protocol = "udp";
+            resolver = "cloudflare-cached";
+          };
+          listeners.local-tcp = {
+            address = "127.0.0.1:53";
+            protocol = "tcp";
+            resolver = "cloudflare-cached";
+          };
+        }
+      '';
+      description = ''
+        Configuration for RouteDNS, see <link xlink:href="https://github.com/folbricht/routedns/blob/master/doc/configuration.md"/>
+        for more information.
+      '';
+    };
+
+    configFile = mkOption {
+      default = settingsFormat.generate "routedns.toml" cfg.settings;
+      defaultText = "A RouteDNS configuration file automatically generated by values from services.routedns.*";
+      type = types.path;
+      example = literalExpression ''"''${pkgs.routedns}/cmd/routedns/example-config/use-case-1.toml"'';
+      description = "Path to RouteDNS TOML configuration file.";
+    };
+
+    package = mkOption {
+      default = pkgs.routedns;
+      defaultText = literalExpression "pkgs.routedns";
+      type = types.package;
+      description = "RouteDNS package to use.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.routedns = {
+      description = "RouteDNS - DNS stub resolver, proxy and router";
+      after = [ "network.target" ]; # in case a bootstrap resolver is used, this might fail a few times until the respective server is actually reachable
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network.target" ];
+      startLimitIntervalSec = 30;
+      startLimitBurst = 5;
+      serviceConfig = {
+        Restart = "on-failure";
+        RestartSec = "5s";
+        LimitNPROC = 512;
+        LimitNOFILE = 1048576;
+        DynamicUser = true;
+        AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+        NoNewPrivileges = true;
+        ExecStart = "${getBin cfg.package}/bin/routedns -l 4 ${cfg.configFile}";
+      };
+    };
+  };
+  meta.maintainers = with maintainers; [ jsimonetti ];
+}
--- a/nixos/modules/services/web-apps/tt-rss.nix
+++ b/nixos/modules/services/web-apps/tt-rss.nix
@ -534,6 +534,7 @@ let
    services.phpfpm.pools = mkIf (cfg.pool == "${poolName}") {
      ${poolName} = {
        inherit (cfg) user;
+        phpPackage = pkgs.php80;
        settings = mapAttrs (name: mkDefault) {
          "listen.owner" = "nginx";
          "listen.group" = "nginx";
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -485,6 +485,7 @@ in {
  samba = handleTest ./samba.nix {};
  samba-wsdd = handleTest ./samba-wsdd.nix {};
  sanoid = handleTest ./sanoid.nix {};
+  schleuder = handleTest ./schleuder.nix {};
  sddm = handleTest ./sddm.nix {};
  seafile = handleTest ./seafile.nix {};
  searx = handleTest ./searx.nix {};
--- a/nixos/tests/schleuder.nix
+++ b/nixos/tests/schleuder.nix
@ -0,0 +1,128 @@
+let
+  certs = import ./common/acme/server/snakeoil-certs.nix;
+  domain = certs.domain;
+in
+import ./make-test-python.nix {
+  name = "schleuder";
+  nodes.machine = { pkgs, ... }: {
+    imports = [ ./common/user-account.nix ];
+    services.postfix = {
+      enable = true;
+      enableSubmission = true;
+      tlsTrustedAuthorities = "${certs.ca.cert}";
+      sslCert = "${certs.${domain}.cert}";
+      sslKey = "${certs.${domain}.key}";
+      inherit domain;
+      destination = [ domain ];
+      localRecipients = [ "root" "alice" "bob" ];
+    };
+    services.schleuder = {
+      enable = true;
+      # Don't do it like this in production! The point of this setting
+      # is to allow loading secrets from _outside_ the world-readable
+      # Nix store.
+      extraSettingsFile = pkgs.writeText "schleuder-api-keys.yml" ''
+        api:
+          valid_api_keys:
+            - fnord
+      '';
+      lists = [ "security@${domain}" ];
+      settings.api = {
+        tls_cert_file = "${certs.${domain}.cert}";
+        tls_key_file = "${certs.${domain}.key}";
+      };
+    };
+
+    environment.systemPackages = [
+      pkgs.gnupg
+      pkgs.msmtp
+      (pkgs.writeScriptBin "do-test" ''
+        #!${pkgs.runtimeShell}
+        set -exuo pipefail
+
+        # Generate a GPG key with no passphrase and export it
+        sudo -u alice gpg --passphrase-fd 0 --batch --yes --quick-generate-key 'alice@${domain}' rsa4096 sign,encr < <(echo)
+        sudo -u alice gpg --armor --export alice@${domain} > alice.asc
+        # Create a new mailing list with alice as the owner, and alice's key
+        schleuder-cli list new security@${domain} alice@${domain} alice.asc
+
+        # Send an email from a non-member of the list. Use --auto-from so we don't have to specify who it's from twice.
+        msmtp --auto-from security@${domain} --host=${domain} --port=25 --tls --tls-starttls <<EOF
+          Subject: really big security issue!!
+          From: root@${domain}
+
+          I found a big security problem!
+        EOF
+
+        # Wait for delivery
+        (set +o pipefail; journalctl -f -n 1000 -u postfix | grep -m 1 'delivered to maildir')
+
+        # There should be exactly one email
+        mail=(/var/spool/mail/alice/new/*)
+        [[ "''${#mail[@]}" = 1 ]]
+
+        # Find the fingerprint of the mailing list key
+        read list_key_fp address < <(schleuder-cli keys list security@${domain} | grep security@)
+        schleuder-cli keys export security@${domain} $list_key_fp > list.asc
+
+        # Import the key into alice's keyring, so we can verify it as well as decrypting
+        sudo -u alice gpg --import <list.asc
+        # And perform the decryption.
+        sudo -u alice gpg -d $mail >decrypted
+        # And check that the text matches.
+        grep "big security problem" decrypted
+      '')
+
+      # For debugging:
+      # pkgs.vim pkgs.openssl pkgs.sqliteinteractive
+    ];
+
+    security.pki.certificateFiles = [ certs.ca.cert ];
+
+    # Since we don't have internet here, use dnsmasq to provide MX records from /etc/hosts
+    services.dnsmasq = {
+      enable = true;
+      extraConfig = ''
+        selfmx
+      '';
+    };
+
+    networking.extraHosts = ''
+      127.0.0.1 ${domain}
+    '';
+
+    # schleuder-cli's config is not quite optimal in several ways:
+    # - A fingerprint _must_ be pinned, it doesn't even have an option
+    #   to trust the PKI
+    # - It compares certificate fingerprints rather than key
+    #   fingerprints, so renewals break the pin (though that's not
+    #   relevant for this test)
+    # - It compares them as strings, which means we need to match the
+    #   expected format exactly. This means removing the :s and
+    #   lowercasing it.
+    # Refs:
+    # https://0xacab.org/schleuder/schleuder-cli/-/issues/16
+    # https://0xacab.org/schleuder/schleuder-cli/-/blob/f8895b9f47083d8c7b99a2797c93f170f3c6a3c0/lib/schleuder-cli/helper.rb#L230-238
+    systemd.tmpfiles.rules = let cliconfig = pkgs.runCommand "schleuder-cli.yml"
+      {
+        nativeBuildInputs = [ pkgs.jq pkgs.openssl ];
+      } ''
+      fp=$(openssl x509 -in ${certs.${domain}.cert} -noout -fingerprint -sha256 | cut -d = -f 2 | tr -d : | tr 'A-Z' 'a-z')
+      cat > $out <<EOF
+      host: localhost
+      port: 4443
+      tls_fingerprint: "$fp"
+      api_key: fnord
+      EOF
+    ''; in
+      [
+        "L+ /root/.schleuder-cli/schleuder-cli.yml - - - - ${cliconfig}"
+      ];
+  };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_until_succeeds("nc -z localhost 4443")
+    machine.succeed("do-test")
+  '';
+}
--- a/nixos/tests/vengi-tools.nix
+++ b/nixos/tests/vengi-tools.nix
@ -23,7 +23,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
      # OCR on voxedit's window is very expensive, so we avoid wasting a try
      # by letting the window load fully first
      machine.sleep(15)
-      machine.wait_for_text("Palette")
+      machine.wait_for_text("Solid")
      machine.screenshot("screen")
    '';
 })
--- a/pkgs/applications/audio/geonkick/default.nix
+++ b/pkgs/applications/audio/geonkick/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "geonkick";
-  version = "2.9.0";
+  version = "2.9.1";

  src = fetchFromGitLab {
    owner = "iurie-sw";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-/BDK1PyRw4xOt+rzC9yX29aRQb1aDnDBIenSz+859OY=";
+    sha256 = "sha256-XSqcj8+X6QMBnIusPB9VNrgcbdiWhNMOYeFyKklGmO8=";
  };

  nativeBuildInputs = [ cmake pkg-config ];
--- a/pkgs/applications/audio/ncpamixer/default.nix
+++ b/pkgs/applications/audio/ncpamixer/default.nix
@ -24,6 +24,6 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/fulhax/ncpamixer";
    license = licenses.mit;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ StijnDW SuperSandro2000 ];
+    maintainers = with maintainers; [ StijnDW ] ++ teams.c3d2.members;
  };
 }
--- a/pkgs/applications/audio/tidal-hifi/default.nix
+++ b/pkgs/applications/audio/tidal-hifi/default.nix
@ -0,0 +1,119 @@
+{ lib
+, stdenv
+, fetchurl
+, autoPatchelfHook
+, dpkg
+, makeWrapper
+, alsa-lib
+, at-spi2-atk
+, at-spi2-core
+, atk
+, cairo
+, cups
+, dbus
+, expat
+, ffmpeg
+, fontconfig
+, freetype
+, gdk-pixbuf
+, glib
+, gtk3
+, libappindicator-gtk3
+, libdbusmenu
+, libdrm
+, libnotify
+, libpulseaudio
+, libsecret
+, libuuid
+, libxkbcommon
+, mesa
+, nss
+, pango
+, systemd
+, xdg-utils
+, xorg
+}:
+
+stdenv.mkDerivation rec {
+  pname = "tidal-hifi";
+  version = "4.0.0";
+
+  src = fetchurl {
+    url = "https://github.com/Mastermindzh/tidal-hifi/releases/download/${version}/tidal-hifi_${version}_amd64.deb";
+    sha256 = "19gx9x3v5ywlvg5vyqgj6pghzwinby0i8isavfrix798pfr98j5z";
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook dpkg makeWrapper ];
+
+  buildInputs = [
+    alsa-lib
+    at-spi2-atk
+    at-spi2-core
+    atk
+    cairo
+    cups
+    dbus
+    expat
+    ffmpeg
+    fontconfig
+    freetype
+    gdk-pixbuf
+    glib
+    gtk3
+    pango
+    systemd
+    mesa # for libgbm
+    nss
+    libuuid
+    libdrm
+    libnotify
+    libsecret
+    libpulseaudio
+    libxkbcommon
+    libappindicator-gtk3
+    xorg.libX11
+    xorg.libxcb
+    xorg.libXcomposite
+    xorg.libXcursor
+    xorg.libXdamage
+    xorg.libXext
+    xorg.libXfixes
+    xorg.libXi
+    xorg.libXrandr
+    xorg.libXrender
+    xorg.libXScrnSaver
+    xorg.libxshmfence
+    xorg.libXtst
+  ];
+
+  runtimeDependencies =
+    [ (lib.getLib systemd) libnotify libdbusmenu xdg-utils ];
+
+  unpackPhase = "dpkg-deb -x $src .";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/bin"
+    cp -R "opt" "$out"
+    cp -R "usr/share" "$out/share"
+    chmod -R g-w "$out"
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    makeWrapper $out/opt/tidal-hifi/tidal-hifi $out/bin/tidal-hifi \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath buildInputs}" \
+      "''${gappsWrapperArgs[@]}"
+  '';
+
+  meta = with lib; {
+    description = "The web version of Tidal running in electron with hifi support thanks to widevine";
+    homepage = "https://github.com/Mastermindzh/tidal-hifi";
+    changelog = "https://github.com/Mastermindzh/tidal-hifi/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ alternateved ];
+    platforms = [ "x86_64-linux" ];
+  };
+}
--- a/pkgs/applications/graphics/vengi-tools/default.nix
+++ b/pkgs/applications/graphics/vengi-tools/default.nix
@ -29,13 +29,13 @@

 stdenv.mkDerivation rec {
  pname = "vengi-tools";
-  version = "0.0.18";
+  version = "0.0.20";

  src = fetchFromGitHub {
    owner = "mgerhardy";
    repo = "vengi";
    rev = "v${version}";
-    sha256 = "sha256-Ur1X5FhOa87jbjWBXievBfCHW+qP/8bqLiyKAC8+KU4=";
+    sha256 = "sha256-WsG6mjO90QQNsAarxdupZvXubdy06JjQmVYUzygl8l4=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
+++ b/pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix
@ -27,7 +27,8 @@ in
    postInstall = ''
      patchShebangs node_modules/
      npm run build
-      ln -s $out/lib/node_modules/asf-ui/dist $out/lib/dist
+      cp -r $out/lib/node_modules/asf-ui/dist $out/lib/dist
+      rm -rf $out/lib/node_modules/
    '';

    meta = with lib; {
--- a/pkgs/applications/misc/anytype/default.nix
+++ b/pkgs/applications/misc/anytype/default.nix
@ -2,13 +2,13 @@

 let
  pname = "anytype";
-  version = "0.25.4";
+  version = "0.26.1";
  name = "Anytype-${version}";
  nameExecutable = pname;
  src = fetchurl {
    url = "https://at9412003.fra1.digitaloceanspaces.com/Anytype-${version}.AppImage";
    name = "Anytype-${version}.AppImage";
-    sha256 = "sha256-v6Zecv/m1GvPJk/SmLlxHFyeYbNbIB+x17+AKCI45AM=";
+    sha256 = "sha256-lPzeYZzerFa0T77uaavvBQkMn4PUEfVj4SPlErqM9DI=";
  };
  appimageContents = appimageTools.extractType2 { inherit name src; };
 in
--- a/pkgs/applications/misc/debian-goodies/default.nix
+++ b/pkgs/applications/misc/debian-goodies/default.nix
@ -10,14 +10,14 @@

 stdenv.mkDerivation rec {
  pname = "debian-goodies";
-  version = "0.87";
+  version = "0.88";

  src = fetchFromGitLab {
    domain = "salsa.debian.org";
    owner = "debian";
    repo = "debian-goodies";
    rev = "debian/${version}";
-    sha256 = "sha256-7O2AY7tWYiOIy4ImFBxWu6S+ljc3VmqS/j4KyEzVVIA=";
+    sha256 = "sha256-SDGWRGwRuryCJSWjuYB+Cg/Pl8q4VP4zcisUOn/GhJY=";
  };

  postPatch = ''
--- a/pkgs/applications/misc/megacmd/default.nix
+++ b/pkgs/applications/misc/megacmd/default.nix
@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "megacmd";
-  version = "1.5.0c";
+  version = "1.5.1";

  src = fetchFromGitHub {
    owner = "meganz";
    repo = "MEGAcmd";
    rev = "${version}_Linux";
-    sha256 = "sha256-JHuGkf6TBOZMvoP7Izm5/T9AWxyjaqrxR99x4bm7tVE=";
+    sha256 = "sha256-qOXw/KGt3DyWQGBe/pbMujQITCMItHobxuK+1r00ZIs=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/misc/skytemple/default.nix
+++ b/pkgs/applications/misc/skytemple/default.nix
@ -1,4 +1,12 @@
-{ lib, fetchFromGitHub, gobject-introspection, gtk3, gtksourceview3, webkitgtk, wrapGAppsHook, python3Packages }:
+{ lib
+, fetchFromGitHub
+, gobject-introspection
+, gtk3
+, gtksourceview3
+, webkitgtk
+, wrapGAppsHook
+, python3Packages
+}:

 python3Packages.buildPythonApplication rec {
  pname = "skytemple";
@ -8,7 +16,7 @@ python3Packages.buildPythonApplication rec {
    owner = "SkyTemple";
    repo = pname;
    rev = version;
-    sha256 = "sha256-CyYGTXdQsGpDR/gpqViEQO1xUPHaXTES592nRJixa1o=";
+    hash = "sha256-CyYGTXdQsGpDR/gpqViEQO1xUPHaXTES592nRJixa1o=";
  };

  buildInputs = [
@ -20,9 +28,16 @@ python3Packages.buildPythonApplication rec {
    # any Pokemon, and clicking Stats and Moves tab.
    webkitgtk
  ];
-  nativeBuildInputs = [ gobject-introspection wrapGAppsHook ];
+
+  nativeBuildInputs = [
+    gobject-introspection
+    wrapGAppsHook
+  ];
+
  propagatedBuildInputs = with python3Packages; [
+    cairosvg
    natsort
+    ndspy
    packaging
    pycairo
    pygal
@ -36,6 +51,7 @@ python3Packages.buildPythonApplication rec {
    skytemple-files
    skytemple-icons
    skytemple-ssb-debugger
+    tilequant
  ];

  doCheck = false; # there are no tests
--- a/pkgs/applications/networking/cluster/kubernetes/default.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/default.nix
@ -1,11 +1,11 @@
-{ stdenv
-, lib
+{ lib
+, buildGoModule
 , fetchFromGitHub
 , which
-, go
 , makeWrapper
 , rsync
 , installShellFiles
+, runtimeShell
 , kubectl
 , nixosTests

@ -19,7 +19,7 @@
  ]
 }:

-stdenv.mkDerivation rec {
+buildGoModule rec {
  pname = "kubernetes";
  version = "1.23.8";

@ -30,23 +30,27 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-mu+jBSypoMNxOugLbS3foH4C4AqSZnlic4Bf1v9dYc8=";
  };

-  nativeBuildInputs = [ makeWrapper which go rsync installShellFiles ];
+  vendorSha256 = null;
+
+  doCheck = false;
+
+  nativeBuildInputs = [ makeWrapper which rsync installShellFiles ];

  outputs = [ "out" "man" "pause" ];

  patches = [ ./fixup-addonmanager-lib-path.patch ];

-  postPatch = ''
-    substituteInPlace "hack/update-generated-docs.sh" --replace "make" "make SHELL=${stdenv.shell}"
-    patchShebangs ./hack
-  '';
-
  WHAT = lib.concatStringsSep " " ([
    "cmd/kubeadm"
  ] ++ components);

-  postBuild = ''
+  buildPhase = ''
+    runHook preBuild
+    substituteInPlace "hack/update-generated-docs.sh" --replace "make" "make SHELL=${runtimeShell}"
+    patchShebangs ./hack ./cluster/addons/addon-manager
+    make "SHELL=${runtimeShell}" "WHAT=$WHAT"
    ./hack/update-generated-docs.sh
+    runHook postBuild
  '';

  installPhase = ''
@ -69,7 +73,6 @@ stdenv.mkDerivation rec {
      --subst-var out

    chmod +x $out/bin/kube-addons
-    patchShebangs $out/bin/kube-addons
    wrapProgram $out/bin/kube-addons --set "KUBECTL_BIN" "$out/bin/kubectl"

    cp cluster/addons/addon-manager/kube-addons.sh $out/bin/kube-addons-lib.sh
@ -80,10 +83,6 @@ stdenv.mkDerivation rec {
    runHook postInstall
  '';

-  disallowedReferences = [ go ];
-
-  GOFLAGS = [ "-trimpath" ];
-
  meta = with lib; {
    description = "Production-Grade Container Scheduling and Management";
    license = licenses.asl20;
--- a/pkgs/applications/networking/cluster/kubernetes/kubectl.nix
+++ b/pkgs/applications/networking/cluster/kubernetes/kubectl.nix
@ -1,15 +1,14 @@
-{ lib, stdenv, kubernetes }:
+{ lib, buildGoModule, kubernetes }:

-stdenv.mkDerivation rec {
+buildGoModule rec {
  pname = "kubectl";

  inherit (kubernetes)
-    disallowedReferences
-    GOFLAGS
+    buildPhase
+    doCheck
    nativeBuildInputs
-    postBuild
-    postPatch
    src
+    vendorSha256
    version
    ;

@ -18,7 +17,7 @@ stdenv.mkDerivation rec {
  WHAT = lib.concatStringsSep " " [
    "cmd/kubectl"
    "cmd/kubectl-convert"
-    ];
+  ];

  installPhase = ''
    runHook preInstall
--- a/pkgs/applications/networking/cluster/talosctl/default.nix
+++ b/pkgs/applications/networking/cluster/talosctl/default.nix
@ -1,42 +1,21 @@
-{ lib, buildGoModule, fetchFromGitHub, installShellFiles }:
-let
-  # look for GO_LDFLAGS getting set in the Makefile
-  version = "1.0.6";
-  sha256 = "sha256-4cUaQWqVndp06eFgqInOMMGITbTdZO5BOqXW2XEpuWU=";
-  vendorSha256 = "sha256-7q35d+jbIDe7fAy6nL5FWdSovBb/f64HYLHGL+zE6bI=";
-  pkgsVersion = "v1.0.0-25-gcf9709e";
-  extrasVersion = "v1.0.0-4-g05b0920";
-in
+{ lib, stdenv, buildGoModule, fetchFromGitHub, installShellFiles }:
+
 buildGoModule rec {
  pname = "talosctl";
-  inherit version vendorSha256;
-  # nixpkgs-update: no auto update
+  version = "1.1.0";

  src = fetchFromGitHub {
    owner = "siderolabs";
    repo = "talos";
    rev = "v${version}";
-    inherit sha256;
+    sha256 = "sha256-52WzQ5LWgIX/XBJPNvWV0tAPnw1AiINDL/7D3UYvvn4=";
  };

-  ldflags =
-    let
-      versionPkg = "github.com/talos-systems/talos/pkg/version"; # VERSION_PKG
-      imagesPkgs = "github.com/talos-systems/talos/pkg/images"; # IMAGES_PKGS
-      mgmtHelpersPkg = "github.com/talos-systems/talos/cmd/talosctl/pkg/mgmt/helpers"; #MGMT_HELPERS_PKG
-    in
-    [
-      "-X ${versionPkg}.Name=Client"
-      "-X ${versionPkg}.SHA=${src.rev}" # should be the hash, but as we build from tags, this needs to do
-      "-X ${versionPkg}.Tag=${src.rev}"
-      "-X ${versionPkg}.PkgsVersion=${pkgsVersion}" # PKGS
-      "-X ${versionPkg}.ExtrasVersion=${extrasVersion}" # EXTRAS
-      "-X ${imagesPkgs}.Username=siderolabs" # USERNAME
-      "-X ${imagesPkgs}.Registry=ghcr.io" # REGISTRY
-      "-X ${mgmtHelpersPkg}.ArtifactsPath=_out" # ARTIFACTS
-      "-s"
-      "-w"
-    ];
+  vendorSha256 = "sha256-iluI4UGw5cZ70wmC9jDiGttvxZ7xFyqcL9IZX4ubJqs=";
+
+  ldflags = [ "-s" "-w" ];
+
+  GOWORK = "off";

  subPackages = [ "cmd/talosctl" ];

@ -56,5 +35,8 @@ buildGoModule rec {
    homepage = "https://www.talos.dev/";
    license = licenses.mpl20;
    maintainers = with maintainers; [ flokli ];
+    # requires >= 10.14 SDK https://github.com/NixOS/nixpkgs/issues/101229
+    # Undefined symbols for architecture x86_64: "_SecTrustEvaluateWithError"
+    broken = stdenv.isDarwin && stdenv.isx86_64;
  };
 }
--- a/pkgs/applications/networking/instant-messengers/chatty/default.nix
+++ b/pkgs/applications/networking/instant-messengers/chatty/default.nix
@ -29,7 +29,7 @@

 stdenv.mkDerivation rec {
  pname = "chatty";
-  version = "0.6.4";
+  version = "0.6.6";

  src = fetchFromGitLab {
    domain = "source.puri.sm";
@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
    repo = "chatty";
    rev = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-uDuSx+tWv6DV93/99QUcUKZaWA9kNW8phHZhetYlG/M=";
+    hash = "sha256-vwgXfoyZOCSMnRAB6bFSrtYlSrpMa9OOcmxYTqhU+lA=";
  };

  postPatch = ''
@ -83,6 +83,7 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "XMPP and SMS messaging via libpurple and ModemManager";
    homepage = "https://source.puri.sm/Librem5/chatty";
+    changelog = "https://source.puri.sm/Librem5/chatty/-/blob/${src.rev}/NEWS";
    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ dotlambda tomfitzhenry ];
    platforms = platforms.linux;
--- a/pkgs/applications/networking/instant-messengers/discord/darwin.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/darwin.nix
@ -1,4 +1,4 @@
-{ pname, version, src, meta, stdenv, binaryName, desktopName, undmg }:
+{ pname, version, src, openasar, meta, stdenv, binaryName, desktopName, lib, undmg }:

 stdenv.mkDerivation {
  inherit pname version src meta;
@ -8,7 +8,15 @@ stdenv.mkDerivation {
  sourceRoot = ".";

  installPhase = ''
+    runHook preInstall
+
    mkdir -p $out/Applications
    cp -r "${desktopName}.app" $out/Applications
+
+    runHook postInstall
+  '';
+
+  postInstall = lib.strings.optionalString (openasar != null) ''
+    cp -f ${openasar} $out/Applications/${desktopName}.app/Contents/Resources/app.asar
  '';
 }
--- a/pkgs/applications/networking/instant-messengers/discord/default.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/default.nix
@ -1,6 +1,5 @@
-{ branch ? "stable", pkgs, lib, stdenv }:
+{ branch ? "stable", callPackage, fetchurl, lib, stdenv, withOpenASAR ? false }:
 let
-  inherit (pkgs) callPackage fetchurl;
  versions = if stdenv.isLinux then {
    stable = "0.0.18";
    ptb = "0.0.29";
@ -62,8 +61,11 @@ let
      ++ lib.optionals (branch == "ptb") [ "aarch64-darwin" ];
  };
  package = if stdenv.isLinux then ./linux.nix else ./darwin.nix;
+
+  openasar = if withOpenASAR then callPackage ./openasar.nix { } else null;
+
  packages = (builtins.mapAttrs
-    (_: value: callPackage package (value // { inherit src version; meta = meta // { mainProgram = value.binaryName; }; }))
+    (_: value: callPackage package (value // { inherit src version openasar; meta = meta // { mainProgram = value.binaryName; }; }))
    {
      stable = rec {
        pname = "discord";
--- a/pkgs/applications/networking/instant-messengers/discord/linux.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/linux.nix
@ -1,4 +1,4 @@
-{ pname, version, src, meta, binaryName, desktopName, autoPatchelfHook
+{ pname, version, src, openasar, meta, binaryName, desktopName, autoPatchelfHook
 , makeDesktopItem, lib, stdenv, wrapGAppsHook, makeShellWrapper, alsa-lib, at-spi2-atk
 , at-spi2-core, atk, cairo, cups, dbus, expat, fontconfig, freetype, gdk-pixbuf
 , glib, gtk3, libcxx, libdrm, libnotify, libpulseaudio, libuuid, libX11
@ -72,6 +72,8 @@ stdenv.mkDerivation rec {
  ];

  installPhase = ''
+    runHook preInstall
+
    mkdir -p $out/{bin,opt/${binaryName},share/pixmaps,share/icons/hicolor/256x256/apps}
    mv * $out/opt/${binaryName}

@ -95,6 +97,12 @@ stdenv.mkDerivation rec {
    ln -s $out/opt/${binaryName}/discord.png $out/share/icons/hicolor/256x256/apps/${pname}.png

    ln -s "${desktopItem}/share/applications" $out/share/
+
+    runHook postInstall
+  '';
+
+  postInstall = lib.strings.optionalString (openasar != null) ''
+    cp -f ${openasar} $out/opt/${binaryName}/resources/app.asar
  '';

  desktopItem = makeDesktopItem {
--- a/pkgs/applications/networking/instant-messengers/discord/openasar.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/openasar.nix
@ -0,0 +1,42 @@
+{ lib, stdenv, fetchFromGitHub, nodejs, bash, nodePackages }:
+
+stdenv.mkDerivation rec {
+  version = "unstable-2022-06-10";
+  pname = "openasar";
+
+  src = fetchFromGitHub {
+    owner = "GooseMod";
+    repo = "OpenAsar";
+    rev = "c6f2f5eb7827fea14cb4c54345af8ff6858c633a";
+    sha256 = "m6e/WKGgkR8vjKcHSNdWE25MmDQM1Z3kgB24OJgbw/w=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    bash scripts/injectPolyfills.sh
+    substituteInPlace src/index.js --replace 'nightly' '${version}'
+    ${nodejs}/bin/node scripts/strip.js
+    ${nodePackages.asar}/bin/asar pack src app.asar
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install app.asar $out
+
+    runHook postInstall
+  '';
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Open-source alternative of Discord desktop's \"app.asar\".";
+    homepage = "https://openasar.dev";
+    license = licenses.mit;
+    maintainers = with maintainers; [ pedrohlc ];
+    platforms = nodejs.meta.platforms;
+  };
+}
--- a/pkgs/applications/networking/instant-messengers/threema-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/threema-desktop/default.nix
@ -3,13 +3,13 @@

 stdenv.mkDerivation rec {
  pname = "threema-desktop";
-  version = "1.2.0";
+  version = "1.2.13";

  src = fetchurl {
    # As Threema only offers a Latest Release url, the plan is to upload each
    # new release url to web.archive.org until their Github releases page gets populated.
-    url = "https://web.archive.org/web/20220408213031if_/https://releases.threema.ch/web-electron/v1/release/Threema-Latest.deb";
-    sha256 = "7c8e1e76ad82a0cf776eb8b0a683a41a00dc8752bb79a24b0ae9d795fdedcde6";
+    url = "https://web.archive.org/web/20220621152620id_/https://releases.threema.ch/web-electron/v1/release/Threema-Latest.deb";
+    sha256 = "sha256-X16GMxUIKUloj0FxhzWQKUBf4zwfSBVg0cwLgGxHPHE=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/networking/p2p/frostwire/frostwire-bin.nix
+++ b/pkgs/applications/networking/p2p/frostwire/frostwire-bin.nix
@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, jre, makeWrapper }:

 stdenv.mkDerivation rec {
-  version = "6.9.7";
+  version = "6.9.8";
  pname = "frostwire";

  src = fetchurl {
    url = "https://dl.frostwire.com/frostwire/${version}/frostwire-${version}.amd64.tar.gz";
-    sha256 = "sha256-LsmDfNAj10x+txJ4PugyF3Irj/N1reb3ChTvFFIucdc=";
+    sha256 = "sha256-gslNdvxA4rGKg0bjf2KWw7w9NMp3zqrii144AfKsV4s=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/applications/networking/p2p/jesec-rtorrent/default.nix
+++ b/pkgs/applications/networking/p2p/jesec-rtorrent/default.nix
@ -21,6 +21,10 @@ stdenv.mkDerivation rec {
    hash = "sha256-i7c1jSawHshj1kaXl8tdpelIKU24okeg9K5/+ht6t2k=";
  };

+  passthru = {
+    inherit libtorrent;
+  };
+
  nativeBuildInputs = [
    cmake
  ];
--- a/pkgs/applications/networking/p2p/rakshasa-rtorrent/default.nix
+++ b/pkgs/applications/networking/p2p/rakshasa-rtorrent/default.nix
@ -27,6 +27,10 @@ stdenv.mkDerivation rec {
    hash = "sha256-HTwAs8dfZVXfLRNiT6QpjKGnuahHfoMfYWqdKkedUL0=";
  };

+  passthru = {
+    inherit libtorrent;
+  };
+
  nativeBuildInputs = [
    autoconf-archive
    autoreconfHook
--- a/pkgs/applications/networking/sync/onedrive/default.nix
+++ b/pkgs/applications/networking/sync/onedrive/default.nix
@ -14,13 +14,13 @@

 stdenv.mkDerivation rec {
  pname = "onedrive";
-  version = "2.4.17";
+  version = "2.4.19";

  src = fetchFromGitHub {
    owner = "abraunegg";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-+ADAPxAZNDqLKLz6rAProqSDINDiTZhc2trxJFFMQeA=";
+    hash = "sha256-7kX7gC/1jSZGgV3ZhfebMIn/Y5gXkz22GDP2zpiwUZ4=";
  };

  nativeBuildInputs = [ autoreconfHook ldc installShellFiles pkg-config ];
--- a/pkgs/applications/radio/js8call/cmake.patch
+++ b/pkgs/applications/radio/js8call/cmake.patch
@ -0,0 +1,69 @@
+diff --git a/CMake/Modules/Findhamlib.cmake b/CMake/Modules/Findhamlib.cmake
+index 1590f05..e797851 100644
+--- a/CMake/Modules/Findhamlib.cmake
+++ b/CMake/Modules/Findhamlib.cmake
+@@ -47,7 +47,7 @@ if (NOT PC_HAMLIB_FOUND)
+ 
+   # libusb-1.0 has no pkg-config file on Windows so we have to find it
+   # ourselves
+-  find_library (LIBUSB NAMES usb-1.0 PATH_SUFFIXES MinGW32/dll)
+  find_library (LIBUSB NAMES libusb-1.0 usb-1.0 PATH_SUFFIXES MinGW32/dll)
+   if (LIBUSB)
+     set (hamlib_EXTRA_LIBRARIES ${LIBUSB} ${hamlib_EXTRA_LIBRARIES})
+     get_filename_component (hamlib_libusb_path ${LIBUSB} PATH)
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 75b80b3..7c04265 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -558,7 +558,6 @@ find_package (FFTW3 COMPONENTS double single threads REQUIRED)
+ #
+ # libhamlib setup
+ #
+-set (hamlib_STATIC 1)
+ find_package (hamlib 3 REQUIRED)
+ find_program (RIGCTL_EXE rigctl)
+ find_program (RIGCTLD_EXE rigctld)
+@@ -576,6 +576,7 @@ message (STATUS "hamlib_LIBRARY_DIRS: ${hamlib_LIBRARY_DIRS}")
+ find_package (Qt5Widgets 5 REQUIRED)
+ find_package (Qt5Multimedia 5 REQUIRED)
+ find_package (Qt5PrintSupport 5 REQUIRED)
+find_package (Qt5SerialPort 5 REQUIRED)
+ 
+ if (WIN32)
+   add_definitions (-DQT_NEEDS_QTMAIN)
+@@ -849,7 +850,7 @@ target_link_libraries (qcp Qt5::Widgets Qt5::PrintSupport)
+ add_library (wsjt_qt STATIC ${wsjt_qt_CXXSRCS} ${wsjt_qt_GENUISRCS} ${GENAXSRCS})
+ # set wsjtx_udp exports to static variants
+ target_compile_definitions (wsjt_qt PUBLIC UDP_STATIC_DEFINE)
+-target_link_libraries (wsjt_qt qcp Qt5::Widgets Qt5::Network)
+target_link_libraries (wsjt_qt qcp Qt5::Widgets Qt5::Network Qt5::SerialPort)
+ target_include_directories (wsjt_qt BEFORE PRIVATE ${hamlib_INCLUDE_DIRS})
+ if (WIN32)
+   target_link_libraries (wsjt_qt Qt5::AxContainer Qt5::AxBase)
+@@ -959,7 +960,6 @@ else ()
+       )
+   endif ()
+ endif ()
+-qt5_use_modules (js8call SerialPort) # not sure why the interface link library syntax above doesn't work
+ 
+ # if (UNIX)
+ #   if (NOT WSJT_SKIP_MANPAGES)
+@@ -1292,3 +1292,5 @@ configure_file ("${PROJECT_SOURCE_DIR}/CMakeCPackOptions.cmake.in"
+ set (CPACK_PROJECT_CONFIG_FILE "${PROJECT_BINARY_DIR}/CMakeCPackOptions.cmake")
+ 
+ include (CPack)
+
+add_definitions (-DJS8_USE_HAMLIB_THREE)
+diff --git a/Configuration.cpp b/Configuration.cpp
+index 8258f97..63a29bb 100644
+--- a/Configuration.cpp
+++ b/Configuration.cpp
+@@ -160,7 +160,7 @@
+ #include <QFont>
+ #include <QFontDialog>
+ #include <QColorDialog>
+-#include <QSerialPortInfo>
+#include <QtSerialPort/QSerialPortInfo>
+ #include <QScopedPointer>
+ #include <QDateTimeEdit>
+ #include <QProcess>
--- a/pkgs/applications/radio/js8call/default.nix
+++ b/pkgs/applications/radio/js8call/default.nix
@ -0,0 +1,65 @@
+{ lib
+, stdenv
+, fetchFromBitbucket
+, wrapQtAppsHook
+, pkg-config
+, hamlib
+, libusb1
+, cmake
+, gfortran
+, fftw
+, fftwFloat
+, qtbase
+, qtmultimedia
+, qtserialport
+}:
+
+stdenv.mkDerivation rec {
+  pname = "js8call";
+  version = "2.2.0";
+
+  src = fetchFromBitbucket {
+    owner = "widefido";
+    repo = pname;
+    rev = "v${version}-ga";
+    sha256 = "sha256-mFPhiAAibCiAkLrysAmIQalVCGd9ips2lqbAsowYprY=";
+  };
+
+  nativeBuildInputs = [
+    wrapQtAppsHook
+    gfortran
+    pkg-config
+    cmake
+  ];
+
+  buildInputs = [
+    hamlib
+    libusb1
+    fftw
+    fftwFloat
+    qtbase
+    qtmultimedia
+    qtserialport
+  ];
+
+  prePatch = ''
+    substituteInPlace CMakeLists.txt \
+        --replace "/usr/share/applications" "$out/share/applications" \
+        --replace "/usr/share/pixmaps" "$out/share/pixmaps" \
+        --replace "/usr/bin/" "$out/bin"
+  '';
+
+  patches = [ ./cmake.patch ];
+
+  meta = with lib; {
+    description = "Weak-signal keyboard messaging for amateur radio";
+    longDescription = ''
+      JS8Call is software using the JS8 Digital Mode providing weak signal
+      keyboard to keyboard messaging to Amateur Radio Operators.
+    '';
+    homepage = "http://js8call.com/";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ melling ];
+  };
+}
--- a/pkgs/applications/terminal-emulators/dterm/default.nix
+++ b/pkgs/applications/terminal-emulators/dterm/default.nix
@ -1,4 +1,8 @@
-{ lib, stdenv, fetchurl, readline }:
+{ lib
+, stdenv
+, fetchurl
+, readline
+}:

 stdenv.mkDerivation rec {
  pname = "dterm";
@ -6,20 +10,31 @@ stdenv.mkDerivation rec {

  src = fetchurl {
    url = "http://www.knossos.net.nz/downloads/dterm-${version}.tgz";
-    sha256 = "94533be79f1eec965e59886d5f00a35cb675c5db1d89419f253bb72f140abddb";
+    hash = "sha256-lFM7558e7JZeWYhtXwCjXLZ1xdsdiUGfJTu3LxQKvds=";
  };

  buildInputs = [ readline ];
+
  postPatch = ''
    substituteInPlace Makefile \
      --replace 'gcc' '${stdenv.cc.targetPrefix}cc'
  '';
+
  preInstall = "mkdir -p $out/bin";
+
  installFlags = [ "BIN=$(out)/bin/" ];

  meta = with lib; {
    homepage = "http://www.knossos.net.nz/resources/free-software/dterm/";
    description = "A simple terminal program";
+    longDescription = ''
+      dterm is a simple terminal emulator, which doesn’t actually emulate any
+      particular terminal. Mainly, it is designed for use with xterm and
+      friends, which already do a perfectly good emulation, and therefore don’t
+      need any special help; dterm simply provides a means by which keystrokes
+      are forwarded to the serial line, and data forwarded from the serial line
+      appears on the terminal.
+    '';
    license = licenses.gpl2Only;
    maintainers = with maintainers; [ auchter ];
    platforms = platforms.unix;
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "docker-compose";
-  version = "2.6.0";
+  version = "2.6.1";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "compose";
    rev = "v${version}";
-    sha256 = "sha256-Fg99ugaqH/jL3KUZ5Vh/SJnqzEyOaR/KuPFwt2oqXxM=";
+    sha256 = "sha256-D3+qDWxg3e5/3UIMz8FZDuxmQHmTv0NJVT/otGYedtw=";
  };

-  vendorSha256 = "sha256-7uNQNO+EI90J2Btz2tnumKqd+AtVWON+Csh6tkTNKNA=";
+  vendorSha256 = "sha256-WxLQfu65Gr+ao/pM8B2uiS88sNT72Klhz7ZIrEadW5g=";

  ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];

--- a/pkgs/data/misc/v2ray-domain-list-community/default.nix
+++ b/pkgs/data/misc/v2ray-domain-list-community/default.nix
@ -3,12 +3,12 @@
 let
  generator = pkgsBuildBuild.buildGoModule rec {
    pname = "v2ray-domain-list-community";
-    version = "20220528180904";
+    version = "20220624025859";
    src = fetchFromGitHub {
      owner = "v2fly";
      repo = "domain-list-community";
      rev = version;
-      sha256 = "sha256-j1Q7B/U0OADOcgJRJ269Jx9Z5dmmT4T2eaOHeGmUjmc=";
+      sha256 = "sha256-/4wfTtRsBzOCbx3I3H28tB935xDZPPwHOFFmjiV7kEI=";
    };
    vendorSha256 = "sha256-Igx8yGWWVmVEogvbrosaK13LVs+ZZuYLBNji7iSfzdo=";
    meta = with lib; {
--- a/pkgs/data/misc/v2ray-geoip/default.nix
+++ b/pkgs/data/misc/v2ray-geoip/default.nix
@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "v2ray-geoip";
-  version = "202205260055";
+  version = "202206230045";

  src = fetchFromGitHub {
    owner = "v2fly";
    repo = "geoip";
-    rev = "96f4639373709f7560ccaf374d1ff008781aa324";
-    sha256 = "sha256-aFTLeYr+JishhJ2AhGMrD02fKxci2rREkh8HN9HtXLs=";
+    rev = "2e2aba7f3dfb4139e8a882f85350045f2ef522d1";
+    sha256 = "sha256-WFvS51RmkAWivYj0HFAT6S3euJk+GSYLDTN3cmkcCNs=";
  };

  installPhase = ''
--- a/pkgs/development/compilers/hare/disable-failing-test-cases.patch
+++ b/pkgs/development/compilers/hare/disable-failing-test-cases.patch
@ -0,0 +1,37 @@
+diff --git a/math/complex/+test.ha b/math/complex/+test.ha
+index a1cc0916..705a0a41 100644
+--- a/math/complex/+test.ha
+++ b/math/complex/+test.ha
+@@ -567,8 +567,8 @@ const TEST_COSSC: [](c128, c128) = [
+ 		(math::INF, math::NAN)), // real sign unspecified
+ 	((math::INF, math::NAN),
+ 		(math::NAN, math::NAN)),
+-	((math::NAN, 0f64),
+-		(math::NAN, -0f64)), // imaginary sign unspecified
+//	((math::NAN, 0f64),
+//		(math::NAN, -0f64)), // imaginary sign unspecified
+ 	((math::NAN, 1f64),
+ 		(math::NAN, math::NAN)),
+ 	((math::NAN, math::INF),
+@@ -583,8 +583,8 @@ const TEST_COSHSC: [](c128, c128) = [
+ 		(1f64, 0f64)),
+ 	((0f64, math::INF),
+ 		(math::NAN, 0f64)), // imaginary sign unspecified
+-	((0f64, math::NAN),
+-		(math::NAN, 0f64)), // imaginary sign unspecified
+//	((0f64, math::NAN),
+//		(math::NAN, 0f64)), // imaginary sign unspecified
+ 	((1f64, math::INF),
+ 		(math::NAN, math::NAN)),
+ 	((1f64, math::NAN),
+@@ -627,8 +627,8 @@ const TEST_EXPSC: [](c128, c128) = [
+ 		(0f64, 0f64)), // real and imaginary sign unspecified
+ 	((math::INF, math::INF),
+ 		(math::INF, math::NAN)), // real sign unspecified
+-	((-math::INF, math::NAN),
+-		(0f64, 0f64)), // real and imaginary sign unspecified
+//	((-math::INF, math::NAN),
+//		(0f64, 0f64)), // real and imaginary sign unspecified
+ 	((math::INF, math::NAN),
+ 		(math::INF, math::NAN)), // real sign unspecified
+ 	((math::NAN, 0f64),
--- a/pkgs/development/compilers/hare/hare.nix
+++ b/pkgs/development/compilers/hare/hare.nix
@ -11,16 +11,18 @@

 stdenv.mkDerivation rec {
  pname = "hare";
-  version = "0.pre+date=2022-04-27";
+  version = "unstable-2022-06-18";

  src = fetchFromSourcehut {
    name = pname + "-src";
    owner = "~sircmpwn";
    repo = pname;
-    rev = "1bfb2e6dee850c675a8831b41420800d3c62c2a0";
-    hash = "sha256-1b7U5u3PM3jmnH/OnY9O++GTPyVOdFkJ0fwJBoDZgSU=";
+    rev = "ac9b2c35c09d555e09dbd81c5ed95bdfa14313ba";
+    hash = "sha256-eeS14LGkbi9IamvKzK+HF0Rvk9NFp4QVYcrHwNSNBx4=";
  };

+  patches = [ ./disable-failing-test-cases.patch ];
+
  nativeBuildInputs = [
    binutils-unwrapped
    harec
@ -35,6 +37,7 @@ stdenv.mkDerivation rec {
    qbe
  ];

+  setupHook = ./setup-hook.sh;
  strictDeps = true;

  configurePhase =
@ -59,6 +62,7 @@ stdenv.mkDerivation rec {
        runHook preConfigure

        export HARECACHE="$NIX_BUILD_TOP/.harecache"
+        export BINOUT="$NIX_BUILD_TOP/.bin"
        cat ${config-file} > config.mk

        runHook postConfigure
--- a/pkgs/development/compilers/hare/harec.nix
+++ b/pkgs/development/compilers/hare/harec.nix
@ -6,14 +6,14 @@

 stdenv.mkDerivation rec {
  pname = "harec";
-  version = "0.pre+date=2022-04-26";
+  version = "unstable-2022-06-20";

  src = fetchFromSourcehut {
    name = pname + "-src";
    owner = "~sircmpwn";
    repo = pname;
-    rev = "e5fb5176ba629e98ace5fcb3aa427b2c25d8fdf0";
-    hash = "sha256-sqt3q6sarzrpyJ/1QYM1WTukrZpflAmAYq6pQwAwe18=";
+    rev = "2eccbc4b959a590dda91143c8487edda841106d9";
+    hash = "sha256-pwy7cNxAqIbhx9kpcjfgk7sCEns9oA6zhKSQJdHLZCM=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/compilers/hare/setup-hook.sh
+++ b/pkgs/development/compilers/hare/setup-hook.sh
@ -0,0 +1,11 @@
+export HARECACHE="$NIX_BUILD_TOP/.harecache"
+
+addHarepath () {
+    for haredir in third-party stdlib; do
+        if [[ -d "$1/src/hare/$haredir" ]]; then
+            addToSearchPath HAREPATH "$1/src/hare/$haredir"
+        fi
+    done
+}
+
+addEnvHooks "$hostOffset" addHarepath
--- a/pkgs/development/libraries/egl-wayland/default.nix
+++ b/pkgs/development/libraries/egl-wayland/default.nix
@ -42,7 +42,7 @@ let

 in stdenv.mkDerivation rec {
  pname = "egl-wayland";
-  version = "1.1.9";
+  version = "1.1.10";

  outputs = [ "out" "dev" ];

@ -50,7 +50,7 @@ in stdenv.mkDerivation rec {
    owner = "Nvidia";
    repo = pname;
    rev = version;
-    sha256 = "sha256-rcmGVEcOtKTR8sVkHV7Xb+8NuKWUapYn+/Fswi4z6Mc=";
+    sha256 = "sha256-dbcEMtPnzF2t7O8YtKVUGSvJqb5WPMmmW+SyqOFnDY4=";
  };

  depsBuildBuild = [
--- a/pkgs/development/libraries/geos/default.nix
+++ b/pkgs/development/libraries/geos/default.nix
@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchurl
+, fetchpatch
 , cmake }:

 stdenv.mkDerivation rec {
@ -12,13 +13,15 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-ULvFmaw4a0wrOWLcxBHwBAph8gSq7066ciXs3Qz0VxU=";
  };

-  nativeBuildInputs = [ cmake ];
+  patches = [
+    # Fix paths with absolute CMAKE_INSTALL_*DIR
+    (fetchpatch {
+      url = "https://github.com/libgeos/geos/commit/11faa4db672ed61d64fd8a6f1a59114f5b5f2406.patch";
+      hash = "sha256-oAArwGq91Z93C6hBPQD0AlY8Q4Nnn6tA40HUPoZ5ftc=";
+    })
+  ];

-  postPatch = ''
-    substituteInPlace tools/geos-config.in \
-      --replace "@libdir@" "@prefix@/lib" \
-      --replace "@includedir@" "@prefix@/include"
-  '';
+  nativeBuildInputs = [ cmake ];

  meta = with lib; {
    description = "C++ port of the Java Topology Suite (JTS)";
--- a/pkgs/development/libraries/taskflow/default.nix
+++ b/pkgs/development/libraries/taskflow/default.nix
@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "taskflow";
-  version = "3.3.0";
+  version = "3.4.0";

  src = fetchFromGitHub {
    owner = "taskflow";
    repo = "taskflow";
    rev = "v${version}";
-    hash = "sha256-UfXGupxgtowIt3BnIVWwim3rTE57TT1C9TCx9LVyN34=";
+    hash = "sha256-5bTTV/WAxslHQ+hvATtUUA1h3MuNzwVTlYMbD/sINRM=";
  };

  patches = [
--- a/pkgs/development/node-packages/main-programs.nix
+++ b/pkgs/development/node-packages/main-programs.nix
@ -32,6 +32,7 @@
  "@webassemblyjs/wasm-strip" = "wasm-strip";
  "@webassemblyjs/wasm-text-gen" = "wasmgen";
  "@webassemblyjs/wast-refmt" = "wast-refmt";
+  aws-cdk = "cdk";
  balanceofsatoshis = "bos";
  carbon-now-cli = "carbon-now";
  cdk8s-cli = "cdk8s";
--- a/pkgs/development/ocaml-modules/ffmpeg/base.nix
+++ b/pkgs/development/ocaml-modules/ffmpeg/base.nix
@ -1,7 +1,7 @@
 { lib, fetchFromGitHub }:

 rec {
-  version = "1.1.3";
+  version = "1.1.4";

  useDune2 = true;

@ -9,7 +9,7 @@ rec {
    owner = "savonet";
    repo = "ocaml-ffmpeg";
    rev = "v${version}";
-    sha256 = "1l40dfc0v3wn2drfq0mclrc1lrlpycdjrkrw4knkwpsg0za68v4c";
+    sha256 = "sha256-IM7bzOZAZQjLz4YjRTMU5fZgrA2QTZcSDMgclDo4sn0=";
  };

  meta = with lib; {
--- a/pkgs/development/python-modules/clickgen/default.nix
+++ b/pkgs/development/python-modules/clickgen/default.nix
@ -2,7 +2,6 @@
 , stdenv
 , buildPythonPackage
 , pythonOlder
-, pythonAtLeast
 , fetchFromGitHub
 , pillow
 , libX11
@ -17,7 +16,7 @@ buildPythonPackage rec {
  version = "1.2.0";
  format = "setuptools";

-  disabled = pythonOlder "3.8" || pythonAtLeast "3.10";
+  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "ful1e5";
--- a/pkgs/development/python-modules/django-debug-toolbar/default.nix
+++ b/pkgs/development/python-modules/django-debug-toolbar/default.nix
@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "django-debug-toolbar";
-  version = "3.4";
+  version = "3.5";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "jazzband";
    repo = pname;
    rev = "refs/tags/${version}";
-    hash = "sha256-tXQZcQvdGEtcIAtER1s2HSVkGHW0sdrnC+i01+RuSXg=";
+    hash = "sha256-OZWO3tXZ+p+zKtQHCkj0kGSXpDFHFV+HqSgiJvLmMTg=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/django-oauth-toolkit/default.nix
+++ b/pkgs/development/python-modules/django-oauth-toolkit/default.nix
@ -18,14 +18,14 @@

 buildPythonPackage rec {
  pname = "django-oauth-toolkit";
-  version = "1.7.0";
+  version = "2.1.0";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "jazzband";
    repo = pname;
-    rev = version;
-    sha256 = "0rp7pjif54yvdxfxn0pnf8ha3fjxspnx1ijyr1f8npwk2x5vnvhb";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-c78QYlU/gB4Lt04TlQFjtsS6pyjDm/fURBMa9hXLpLI=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/django-prometheus/default.nix
+++ b/pkgs/development/python-modules/django-prometheus/default.nix
@ -16,8 +16,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "korfuri";
    repo = pname;
-    rev = version;
-    sha256 = "1y1cmycc545xrys41jk8kia36hwnkwhkw26mlpfdjgb63vq30x1d";
+    rev = "v${version}";
+    hash = "sha256-NE0zHnGGSrtkBLrSyBcQuyGrSfSQbdpevokg3YZhwDw=";
  };

  patches = [
--- a/pkgs/development/python-modules/django-prometheus/drop-untestable-database-backends.patch
+++ b/pkgs/development/python-modules/django-prometheus/drop-untestable-database-backends.patch
@ -1,5 +1,5 @@
 diff --git a/django_prometheus/tests/end2end/testapp/settings.py b/django_prometheus/tests/end2end/testapp/settings.py
-index 0630721..bd2190a 100644
+index cdd167f..5c6073b 100644
 --- a/django_prometheus/tests/end2end/testapp/settings.py
 +++ b/django_prometheus/tests/end2end/testapp/settings.py
@@ -53,33 +53,6 @@ DATABASES = {
@ -28,9 +28,9 @@ index 0630721..bd2190a 100644
 -    "mysql": {
 -        "ENGINE": "django_prometheus.db.backends.mysql",
 -        "NAME": "django_prometheus_1",
-        "USER": "travis",
+-        "USER": "root",
 -        "PASSWORD": "",
-        "HOST": "localhost",
+-        "HOST": "127.0.0.1",
 -        "PORT": "3306",
 -    },
     # The following databases are used by test_db.py only
--- a/pkgs/development/python-modules/django-webpack-loader/default.nix
+++ b/pkgs/development/python-modules/django-webpack-loader/default.nix
@ -2,11 +2,11 @@

 buildPythonPackage rec {
  pname = "django-webpack-loader";
-  version = "1.4.1";
+  version = "1.6.0";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "7e34085b7fc4d352e482ff9cf7d09ae4524e730675e25432ab1d25a2dd94e583";
+    sha256 = "sha256-opQY/0FpADW+ENLJSgZV2rCZAJxouJiDmBPWoQmxTXE=";
  };

  # django.core.exceptions.ImproperlyConfigured (path issue with DJANGO_SETTINGS_MODULE?)
--- a/pkgs/development/python-modules/email-validator/default.nix
+++ b/pkgs/development/python-modules/email-validator/default.nix
@ -44,10 +44,9 @@ buildPythonPackage rec {
  ];

  meta = with lib; {
-    description = "A robust email syntax and deliverability validation library for Python 2.x/3.x.";
+    description = "A robust email syntax and deliverability validation library";
    homepage    = "https://github.com/JoshData/python-email-validator";
    license     = licenses.cc0;
    maintainers = with maintainers; [ siddharthist ];
-    platforms   = platforms.unix;
  };
 }
--- a/pkgs/development/python-modules/fastapi-mail/default.nix
+++ b/pkgs/development/python-modules/fastapi-mail/default.nix
@ -3,7 +3,7 @@
 , aiosmtplib
 , blinker
 , buildPythonPackage
-, email_validator
+, email-validator
 , fakeredis
 , fastapi
 , fetchFromGitHub
@ -45,7 +45,7 @@ buildPythonPackage rec {
    aioredis
    aiosmtplib
    blinker
-    email_validator
+    email-validator
    fakeredis
    fastapi
    httpx
--- a/pkgs/development/python-modules/flask-admin/default.nix
+++ b/pkgs/development/python-modules/flask-admin/default.nix
@ -2,7 +2,7 @@
 , arrow
 , buildPythonPackage
 , colour
-, email_validator
+, email-validator
 , enum34
 , fetchPypi
 , flask
@ -45,7 +45,7 @@ buildPythonPackage rec {
  checkInputs = [
    arrow
    colour
-    email_validator
+    email-validator
    flask_sqlalchemy
    flask-babelex
    flask-mongoengine
--- a/pkgs/development/python-modules/flask-appbuilder/default.nix
+++ b/pkgs/development/python-modules/flask-appbuilder/default.nix
@ -5,7 +5,7 @@
 , apispec
 , colorama
 , click
-, email_validator
+, email-validator
 , flask
 , flask-babel
 , flask_login
@ -56,7 +56,7 @@ buildPythonPackage rec {
    apispec
    colorama
    click
-    email_validator
+    email-validator
    flask
    flask-babel
    flask_login
--- a/pkgs/development/python-modules/flask-mongoengine/default.nix
+++ b/pkgs/development/python-modules/flask-mongoengine/default.nix
@ -8,7 +8,7 @@
 , nose
 , rednose
 , coverage
-, email_validator
+, email-validator
 }:

 buildPythonPackage rec {
@ -23,7 +23,7 @@ buildPythonPackage rec {
  };

  propagatedBuildInputs = [
-    email_validator
+    email-validator
    flask
    flask-wtf
    mongoengine
--- a/pkgs/development/python-modules/flask-security-too/default.nix
+++ b/pkgs/development/python-modules/flask-security-too/default.nix
@ -23,7 +23,7 @@

 # propagates
 , blinker
-, email_validator
+, email-validator
 , flask
 , flask_login
 , flask_principal
@ -54,7 +54,7 @@ buildPythonPackage rec {

  propagatedBuildInputs = [
    blinker
-    email_validator
+    email-validator
    flask
    flask_login
    flask_principal
--- a/pkgs/development/python-modules/flask-wtf/default.nix
+++ b/pkgs/development/python-modules/flask-wtf/default.nix
@ -4,7 +4,7 @@
 , flask
 , itsdangerous
 , wtforms
-, email_validator
+, email-validator
 , pytestCheckHook
 }:

@ -25,7 +25,7 @@ buildPythonPackage rec {
  ];

  passthru.optional-dependencies = {
-    email = [ email_validator ];
+    email = [ email-validator ];
  };

  checkInputs = [
--- a/pkgs/development/python-modules/ihatemoney/default.nix
+++ b/pkgs/development/python-modules/ihatemoney/default.nix
@ -10,7 +10,7 @@
 , cachetools
 , click
 , dnspython
-, email_validator
+, email-validator
 , flask
 , flask-babel
 , flask-cors
@ -60,7 +60,7 @@ buildPythonPackage rec {
    click
    debts
    dnspython
-    email_validator
+    email-validator
    flask
    flask_mail
    flask_migrate
--- a/pkgs/development/python-modules/imap-tools/default.nix
+++ b/pkgs/development/python-modules/imap-tools/default.nix
@ -7,7 +7,7 @@

 buildPythonPackage rec {
  pname = "imap-tools";
-  version = "0.55.0";
+  version = "0.56.0";

  disabled = isPy27;

@ -16,8 +16,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "ikvk";
    repo = "imap_tools";
-    rev = "v${version}";
-    hash = "sha256-Jtuw0pYkgR1wrqPlEBOpia1rFU/+MLadOFEm2xLIFMw=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-g1m44hUtD/x7zEe/ELY6zj2hJikSmZB6S8ZHEHPrvz0=";
  };

  checkInputs = [
--- a/pkgs/development/python-modules/junos-eznc/default.nix
+++ b/pkgs/development/python-modules/junos-eznc/default.nix
@ -77,7 +77,7 @@ buildPythonPackage rec {
  pythonImportsCheck = [ "jnpr.junos" ];

  meta = with lib; {
-    homepage = "http://www.github.com/Juniper/py-junos-eznc";
+    homepage = "https://github.com/Juniper/py-junos-eznc";
    description = "Junos 'EZ' automation for non-programmers";
    license = licenses.asl20;
    maintainers = with maintainers; [ xnaveira ];
--- a/pkgs/development/python-modules/mockito/default.nix
+++ b/pkgs/development/python-modules/mockito/default.nix
@ -1,12 +1,12 @@
 { lib, buildPythonPackage, fetchPypi, isPy3k, funcsigs, pytest, numpy }:

 buildPythonPackage rec {
-  version = "1.3.1";
+  version = "1.3.3";
  pname = "mockito";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-o8Hg3UnxWbJITBu/IjsbWRHDiJ5smffKUNHAqG21170=";
+    sha256 = "sha256-mCRTdihXcyMHNPJkmGWLHcBFrTvhNCH1CMcaXHaVe8E=";
  };

  propagatedBuildInputs = lib.optionals (!isPy3k) [ funcsigs ];
--- a/pkgs/development/python-modules/mysqlclient/default.nix
+++ b/pkgs/development/python-modules/mysqlclient/default.nix
@ -2,7 +2,7 @@

 buildPythonPackage rec {
  pname = "mysqlclient";
-  version = "2.1.0";
+  version = "2.1.1";

  nativeBuildInputs = [
    libmysqlclient
@ -17,7 +17,7 @@ buildPythonPackage rec {

  src = fetchPypi {
    inherit pname version;
-    sha256 = "973235686f1b720536d417bf0a0d39b4ab3d5086b2b6ad5e6752393428c02b12";
+    sha256 = "sha256-godX5Bn7Ed1sXtJXbsksPvqpOg98OeJjWG0e53nD14I=";
  };

  meta = with lib; {
--- a/pkgs/development/python-modules/napalm/default.nix
+++ b/pkgs/development/python-modules/napalm/default.nix
@ -1,7 +1,7 @@
 { lib, buildPythonPackage, fetchFromGitHub, fetchpatch, setuptools, cffi
 , paramiko, requests, future, textfsm, jinja2, netaddr, pyyaml, pyeapi, netmiko
 , junos-eznc, ciscoconfparse, scp, lxml, ncclient, pytestCheckHook, ddt, mock
-, pythonOlder }:
+, pythonOlder, invoke }:

 buildPythonPackage rec {
  pname = "napalm";
@ -35,14 +35,13 @@ buildPythonPackage rec {
      --replace "netmiko>=3.3.0,<4.0.0" "netmiko"
  '';

-  buildInputs = [ setuptools ];
-
  propagatedBuildInputs = [
    cffi
    paramiko
    requests
    future
    textfsm
+    invoke
    jinja2
    netaddr
    pyyaml
@ -51,6 +50,7 @@ buildPythonPackage rec {
    junos-eznc
    ciscoconfparse
    scp
+    setuptools
    lxml
    ncclient
  ];
@ -62,6 +62,6 @@ buildPythonPackage rec {
      "Network Automation and Programmability Abstraction Layer with Multivendor support";
    homepage = "https://github.com/napalm-automation/napalm";
    license = licenses.asl20;
-    maintainers = [ maintainers.astro ];
+    maintainers = with maintainers; [ ] ++ teams.c3d2.members;
  };
 }
--- a/pkgs/development/python-modules/proto-plus/default.nix
+++ b/pkgs/development/python-modules/proto-plus/default.nix
@ -10,12 +10,12 @@

 buildPythonPackage rec {
  pname = "proto-plus";
-  version = "1.20.5";
+  version = "1.20.6";
  disabled = !isPy3k;

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-gXlOsb4zPGeYYzOUjfcOu4zfU44Dn4z6kv0qnXF21AU=";
+    sha256 = "sha256-RJtFN+g/R3a9aQUcTXdtuP/j+dBkHx6HsGwRbrlMkOk=";
  };

  propagatedBuildInputs = [ protobuf ];
--- a/pkgs/development/python-modules/pydantic/default.nix
+++ b/pkgs/development/python-modules/pydantic/default.nix
@ -2,7 +2,7 @@
 , buildPythonPackage
 , cython
 , devtools
-, email_validator
+, email-validator
 , fetchFromGitHub
 , pytest-mock
 , pytestCheckHook
@ -57,7 +57,7 @@ buildPythonPackage rec {

  propagatedBuildInputs = [
    devtools
-    email_validator
+    email-validator
    python-dotenv
    typing-extensions
  ];
--- a/pkgs/development/python-modules/railroad-diagrams/default.nix
+++ b/pkgs/development/python-modules/railroad-diagrams/default.nix
@ -1,24 +1,30 @@
 { lib
 , buildPythonPackage
 , fetchPypi
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "railroad-diagrams";
-  version = "1.1.1";
+  version = "2.0.3";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "8a1ec227666be2000e76794aa740f77987f1586077aae4d090d2633b3064c976";
+    hash = "sha256-wRClrA4I/DWNw/hL5rowQMn0R61c6qiNg9Ho6nXqi+4=";
  };

-  # this is a dependency of pyparsing, which is a dependency of pytest
+  # This is a dependency of pyparsing, which is a dependency of pytest
  doCheck = false;

-  pythonImportsCheck = [ "railroad" ];
+  pythonImportsCheck = [
+    "railroad"
+  ];

  meta = with lib; {
-    description = "Generate SVG railroad syntax diagrams, like on JSON.org";
+    description = "Module to generate SVG railroad syntax diagrams";
    homepage = "https://github.com/tabatkins/railroad-diagrams";
    license = licenses.cc0;
    maintainers = with maintainers; [ jonringer ];
--- a/pkgs/development/python-modules/sentry-sdk/default.nix
+++ b/pkgs/development/python-modules/sentry-sdk/default.nix
@ -46,7 +46,7 @@

 buildPythonPackage rec {
  pname = "sentry-sdk";
-  version = "1.5.12";
+  version = "1.6.0";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -55,7 +55,7 @@ buildPythonPackage rec {
    owner = "getsentry";
    repo = "sentry-python";
    rev = version;
-    hash = "sha256-8M0FWfvaGp74Fb+qJlhyiJPUVHN2ZdEleZf27d+bftE=";
+    hash = "sha256-X831uMlxvcgxQz8xWQZkJOp/fTmF62J95esJY23DZQw=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/vaa/default.nix
+++ b/pkgs/development/python-modules/vaa/default.nix
@ -9,7 +9,7 @@
 , marshmallow
 , pyschemes
 , wtforms
-, email_validator
+, email-validator
 }:

 buildPythonPackage rec {
@ -42,7 +42,7 @@ buildPythonPackage rec {
    marshmallow
    pyschemes
    wtforms
-    email_validator
+    email-validator
  ];

  pythonImportsCheck = [ "vaa" ];
--- a/pkgs/development/python-modules/wtforms/default.nix
+++ b/pkgs/development/python-modules/wtforms/default.nix
@ -4,7 +4,7 @@
 , markupsafe
 , babel
 , pytestCheckHook
-, email_validator
+, email-validator
 }:

 buildPythonPackage rec {
@ -22,7 +22,7 @@ buildPythonPackage rec {

  checkInputs = [
    pytestCheckHook
-    email_validator
+    email-validator
  ];

  pythonImportsCheck = [ "wtforms" ];
--- a/pkgs/development/python-modules/youtube-search-python/default.nix
+++ b/pkgs/development/python-modules/youtube-search-python/default.nix
@ -7,14 +7,14 @@

 buildPythonPackage rec {
  pname = "youtube-search-python";
-  version = "1.6.5";
+  version = "1.6.6";
  format = "setuptools";

  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-1B7rppa+s/oE8w91Ca7ogjkNHu5pFSnNmDyUopCWEY8=";
+    hash = "sha256-RWjR12ns1+tLuDZfBO7G42TF9w7sezdl9UPa67E1/PU=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/ruby-modules/bundled-common/gen-bin-stubs.rb
+++ b/pkgs/development/ruby-modules/bundled-common/gen-bin-stubs.rb
@ -41,6 +41,20 @@ Gem.paths = { 'GEM_HOME' => #{bundle_path.dump} }
 $LOAD_PATH.unshift #{File.join(bundler_path, "/lib").dump}

 require 'bundler'
+# Monkey-patch out the check that Bundler performs to determine
+# whether the bundler env is writable. It's not writable, even for
+# root! And for this use of Bundler, it shouldn't be necessary since
+# we're not trying to perform any package management operations, only
+# produce a Gem path. Thus, we replace it with a method that will
+# always return false, to squelch a warning from Bundler saying that
+# sudo may be required.
+module Bundler
+  class <<self
+    def requires_sudo?
+      return false
+    end
+  end
+end
 Bundler.setup(#{groups.map(&:dump).join(', ')})

 load Gem.bin_path(#{name.dump}, #{exe.dump})
--- a/pkgs/development/tools/analysis/checkov/default.nix
+++ b/pkgs/development/tools/analysis/checkov/default.nix
@ -32,14 +32,14 @@ with py.pkgs;

 buildPythonApplication rec {
  pname = "checkov";
-  version = "2.1.4";
+  version = "2.1.5";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "bridgecrewio";
    repo = pname;
    rev = version;
-    hash = "sha256-J8CpNeON2qOaU/U7LbIOaQ/DJ/7Q+kLzzw+jD1QLkik=";
+    hash = "sha256-bH7W+GZ4O32ty5YD4hfKz2R10v7zEJLU1kLzKvdx3E4=";
  };

  nativeBuildInputs = with py.pkgs; [
--- a/pkgs/development/tools/continuous-integration/jenkins/default.nix
+++ b/pkgs/development/tools/continuous-integration/jenkins/default.nix
@ -4,11 +4,11 @@

 stdenv.mkDerivation rec {
  pname = "jenkins";
-  version = "2.332.3";
+  version = "2.346.1";

  src = fetchurl {
    url = "https://get.jenkins.io/war-stable/${version}/jenkins.war";
-    sha256 = "sha256-0ZPxearfOnzrYa3rw6tRIYrEp4UriJMv8ztE/XvmAQ8=";
+    sha256 = "09rvwpywf8wc3605kc0x171kmxfigqg4dq7gkd1hng1xqbjjqvhp";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/development/tools/continuous-integration/woodpecker/agent.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker/agent.nix
@ -0,0 +1,17 @@
+{ lib, buildGoModule, callPackage, fetchFromGitHub }:
+let
+  common = callPackage ./common.nix { };
+in
+buildGoModule {
+  pname = "woodpecker-agent";
+  inherit (common) version src ldflags postBuild;
+  vendorSha256 = null;
+
+  subPackages = "cmd/agent";
+
+  CGO_ENABLED = 0;
+
+  meta = common.meta // {
+    description = "Woodpecker Continuous Integration agent";
+  };
+}
--- a/pkgs/development/tools/continuous-integration/woodpecker/cli.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker/cli.nix
@ -0,0 +1,17 @@
+{ lib, buildGoModule, callPackage, fetchFromGitHub }:
+let
+  common = callPackage ./common.nix { };
+in
+buildGoModule {
+  pname = "woodpecker-cli";
+  inherit (common) version src ldflags postBuild;
+  vendorSha256 = null;
+
+  subPackages = "cmd/cli";
+
+  CGO_ENABLED = 0;
+
+  meta = common.meta // {
+    description = "Command line client for the Woodpecker Continuous Integration server";
+  };
+}
--- a/pkgs/development/tools/continuous-integration/woodpecker/common.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
@ -0,0 +1,36 @@
+{ lib, fetchFromGitHub }:
+let
+  version = "0.15.3";
+  srcSha256 = "sha256-HOOH3H2SXLcT2oW/xL80TO+ZSI+Haulnznpb4hlCQow=";
+  yarnSha256 = "sha256-x9g0vSoexfknqLejgcNIigmkFnqYsmhcQNTOStcj68o=";
+in
+{
+  inherit version yarnSha256;
+
+  src = fetchFromGitHub {
+    owner = "woodpecker-ci";
+    repo = "woodpecker";
+    rev = "v${version}";
+    sha256 = srcSha256;
+  };
+
+  postBuild = ''
+    cd $GOPATH/bin
+    for f in *; do
+      mv -- "$f" "woodpecker-$f"
+    done
+    cd -
+  '';
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/woodpecker-ci/woodpecker/version.Version=${version}"
+  ];
+
+  meta = with lib; {
+    homepage = "https://woodpecker-ci.org/";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ ambroisie ];
+  };
+}
--- a/pkgs/development/tools/continuous-integration/woodpecker/frontend.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker/frontend.nix
@ -0,0 +1,40 @@
+{ lib, callPackage, fetchFromGitHub, fetchYarnDeps, mkYarnPackage }:
+let
+  common = callPackage ./common.nix { };
+in
+mkYarnPackage {
+  pname = "woodpecker-frontend";
+  inherit (common) version;
+
+  src = "${common.src}/web";
+
+  packageJSON = ./woodpecker-package.json;
+  offlineCache = fetchYarnDeps {
+    yarnLock = "${common.src}/web/yarn.lock";
+    sha256 = common.yarnSha256;
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    yarn build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -R deps/woodpecker-ci/dist $out
+    echo "${common.version}" > "$out/version"
+
+    runHook postInstall
+  '';
+
+  # Do not attempt generating a tarball for woodpecker-frontend again.
+  doDist = false;
+
+  meta = common.meta // {
+    description = "Woodpecker Continuous Integration server frontend";
+  };
+}
--- a/pkgs/development/tools/continuous-integration/woodpecker/server.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker/server.nix
@ -0,0 +1,27 @@
+{ lib, buildGoModule, callPackage, fetchFromGitHub, woodpecker-frontend }:
+let
+  common = callPackage ./common.nix { };
+in
+buildGoModule {
+  pname = "woodpecker-server";
+  inherit (common) version src ldflags postBuild;
+  vendorSha256 = null;
+
+  postPatch = ''
+    cp -r ${woodpecker-frontend} web/dist
+  '';
+
+  subPackages = "cmd/server";
+
+  CGO_ENABLED = 1;
+
+  passthru = {
+    inherit woodpecker-frontend;
+
+    updateScript = ./update.sh;
+  };
+
+  meta = common.meta // {
+    description = "Woodpecker Continuous Integration server";
+  };
+}
--- a/pkgs/development/tools/continuous-integration/woodpecker/update.sh
+++ b/pkgs/development/tools/continuous-integration/woodpecker/update.sh
@ -0,0 +1,50 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix wget prefetch-yarn-deps nix-prefetch-github jq
+
+# shellcheck shell=bash
+
+if [ -n "$GITHUB_TOKEN" ]; then
+    TOKEN_ARGS=(--header "Authorization: token $GITHUB_TOKEN")
+fi
+
+if [[ $# -gt 1 || $1 == -* ]]; then
+    echo "Regenerates packaging data for the woodpecker packages."
+    echo "Usage: $0 [git release tag]"
+    exit 1
+fi
+
+set -x
+
+cd "$(dirname "$0")"
+version="$1"
+
+set -euo pipefail
+
+if [ -z "$version" ]; then
+    version="$(wget -O- "${TOKEN_ARGS[@]}" "https://api.github.com/repos/woodpecker-ci/woodpecker/releases?per_page=1" | jq -r '.[0].tag_name')"
+fi
+
+# strip leading "v"
+version="${version#v}"
+
+# Woodpecker repository
+src_hash=$(nix-prefetch-github woodpecker-ci woodpecker --rev "v${version}" | jq -r .sha256)
+
+# Front-end dependencies
+woodpecker_src="https://raw.githubusercontent.com/woodpecker-ci/woodpecker/v$version"
+wget "${TOKEN_ARGS[@]}" "$woodpecker_src/web/package.json" -O woodpecker-package.json
+
+web_tmpdir=$(mktemp -d)
+trap 'rm -rf "$web_tmpdir"' EXIT
+pushd "$web_tmpdir"
+wget "${TOKEN_ARGS[@]}" "$woodpecker_src/web/yarn.lock"
+yarn_hash=$(prefetch-yarn-deps yarn.lock)
+popd
+
+# Use friendlier hashes
+src_hash=$(nix hash to-sri --type sha256 "$src_hash")
+yarn_hash=$(nix hash to-sri --type sha256 "$yarn_hash")
+
+sed -i -E -e "s#version = \".*\"#version = \"$version\"#" common.nix
+sed -i -E -e "s#srcSha256 = \".*\"#srcSha256 = \"$src_hash\"#" common.nix
+sed -i -E -e "s#yarnSha256 = \".*\"#yarnSha256 = \"$yarn_hash\"#" common.nix
--- a/pkgs/development/tools/continuous-integration/woodpecker/woodpecker-package.json
+++ b/pkgs/development/tools/continuous-integration/woodpecker/woodpecker-package.json
@ -0,0 +1,63 @@
+{
+  "name": "woodpecker-ci",
+  "author": "Woodpecker CI",
+  "version": "0.0.0",
+  "license": "Apache-2.0",
+  "engines": {
+    "node": ">=14"
+  },
+  "scripts": {
+    "start": "vite",
+    "build": "vite build",
+    "serve": "vite preview",
+    "lint": "eslint --max-warnings 0 --ext .js,.ts,.vue,.json .",
+    "formatcheck": "prettier -c .",
+    "format:fix": "prettier --write .",
+    "typecheck": "vue-tsc --noEmit",
+    "test": "echo 'No tests configured' && exit 0"
+  },
+  "dependencies": {
+    "@kyvg/vue3-notification": "2.3.4",
+    "@meforma/vue-toaster": "1.2.2",
+    "ansi-to-html": "0.7.2",
+    "dayjs": "1.10.7",
+    "floating-vue": "2.0.0-beta.5",
+    "fuse.js": "6.4.6",
+    "humanize-duration": "3.27.0",
+    "javascript-time-ago": "2.3.10",
+    "node-emoji": "1.11.0",
+    "pinia": "2.0.0",
+    "vue": "v3.2.20",
+    "vue-router": "4.0.10"
+  },
+  "devDependencies": {
+    "@iconify/json": "1.1.421",
+    "@types/humanize-duration": "3.27.0",
+    "@types/javascript-time-ago": "2.0.3",
+    "@types/node": "16.11.6",
+    "@types/node-emoji": "1.8.1",
+    "@typescript-eslint/eslint-plugin": "5.6.0",
+    "@typescript-eslint/parser": "5.6.0",
+    "@vitejs/plugin-vue": "1.9.4",
+    "@vue/compiler-sfc": "3.2.20",
+    "eslint": "7.32.0",
+    "eslint-config-airbnb-base": "15.0.0",
+    "eslint-config-airbnb-typescript": "16.1.0",
+    "eslint-config-prettier": "8.3.0",
+    "eslint-plugin-import": "2.25.3",
+    "eslint-plugin-prettier": "4.0.0",
+    "eslint-plugin-promise": "5.1.1",
+    "eslint-plugin-simple-import-sort": "7.0.0",
+    "eslint-plugin-vue": "7.18.0",
+    "eslint-plugin-vue-scoped-css": "1.3.0",
+    "prettier": "2.4.1",
+    "typescript": "4.4.4",
+    "unplugin-icons": "0.12.17",
+    "unplugin-vue-components": "0.17.0",
+    "vite": "2.6.13",
+    "vite-plugin-windicss": "1.4.12",
+    "vite-svg-loader": "3.0.0",
+    "vue-tsc": "0.28.10",
+    "windicss": "3.2.0"
+  }
+}
--- a/pkgs/development/tools/misc/hound/default.nix
+++ b/pkgs/development/tools/misc/hound/default.nix
@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "hound";
-  version = "0.5.0";
+  version = "0.5.1";

  src = fetchFromGitHub {
    owner = "hound-search";
    repo = "hound";
    rev = "v${version}";
-    sha256 = "sha256-FNK6SgISGqx+O7Vgp+KOqQyPhqzERDjeo6mQIX1SXnA=";
+    sha256 = "sha256-1URhb+ZrtP5eGS2o7lBxvAxQJR/J6oE+pCbJ7sQb0X4=";
  };

  vendorSha256 = "sha256-ZgF/PB3VTPx367JUkhOkSEK1uvqENNG0xuNXvCGENnQ=";
--- a/pkgs/development/tools/misc/terraform-ls/default.nix
+++ b/pkgs/development/tools/misc/terraform-ls/default.nix
@ -2,15 +2,15 @@

 buildGoModule rec {
  pname = "terraform-ls";
-  version = "0.26.0";
+  version = "0.28.1";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Xq9HojFjUrdThXvQ4M8o4LLmxopVErnN3WGUgI79BCw=";
+    sha256 = "sha256-6K4aOp5mjX+qhG/OS/Gs1kAOpDGUPdgRNx4zp3i/c2A=";
  };
-  vendorSha256 = "sha256-iSgK+FOD9olVN4bR2jmtWndaRHrh9pfo/42COTiIh9c=";
+  vendorSha256 = "sha256-YouAdTo7huco35er84MRfI1gmq11VbFwRGSovs1XDYo=";

  ldflags = [ "-s" "-w" "-X main.version=v${version}" "-X main.prerelease=" ];

--- a/pkgs/development/web/deno/default.nix
+++ b/pkgs/development/web/deno/default.nix
@ -16,15 +16,15 @@

 rustPlatform.buildRustPackage rec {
  pname = "deno";
-  version = "1.23.0";
+  version = "1.23.1";

  src = fetchFromGitHub {
    owner = "denoland";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-nPVghkLtXhd2/TeBeNDtA1ucgiqzZWmtxXf9bCrFh44=";
+    sha256 = "sha256-Z9dZrhH+zlYNuhFs+aicuepnUTSOfIHdLaz9sJp0LCA=";
  };
-  cargoSha256 = "sha256-bCk6zgsfyI5Nk0AHPyr29KzgltobxfD6b72N0ZaQyOU=";
+  cargoSha256 = "sha256-VIpy5vRZinFvFhyyKQwi5ThrBNwqGy1TVg5tAoxxJyQ=";

  postPatch = ''
    # upstream uses lld on aarch64-darwin for faster builds
--- a/pkgs/development/web/deno/librusty_v8.nix
+++ b/pkgs/development/web/deno/librusty_v8.nix
@ -11,11 +11,11 @@ let
  };
 in
 fetch_librusty_v8 {
-  version = "0.44.1";
+  version = "0.44.2";
  shas = {
-    x86_64-linux = "sha256-8aBjN9ukbH+lr3YPdngXxSjPjutBgWv4hEdhYmcvtO4=";
-    aarch64-linux = "sha256-h0mxzeA/wB+/zNz0ZKjSBH7lpYrCLRdTgeDGwZypuXE=";
-    x86_64-darwin = "sha256-4YXYHhYwCBnb1clxW1ziccHMWsUcGz8Rr8/anCvI1lY=";
-    aarch64-darwin = "sha256-3sBeL+YJB1HaEhM76GfABvN/6iWeST7Z6lVu3X8sRjk=";
+    x86_64-linux = "sha256-I1ad9a9FtJGGGW7Odc8HfysQyCEAb8xoEYmYti0pEkE=";
+    aarch64-linux = "sha256-KHjVMI9qiJ6q3D6t6iUKxbp1qthHSSl+2AfvL3Hvk6I=";
+    x86_64-darwin = "sha256-UO1NRpbCA5MtqeRLTGM3FIWdX/ECDW/JG52U756FIv8=";
+    aarch64-darwin = "sha256-FqakcG050m52/F6nWlS7VeW0r+77CCIzG1qvBP3Naik=";
  };
 }
--- a/pkgs/games/freeciv/default.nix
+++ b/pkgs/games/freeciv/default.nix
@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "freeciv";
-  version = "3.0.1";
+  version = "3.0.2";

  src = fetchFromGitHub {
    owner = "freeciv";
    repo = "freeciv";
    rev = "R${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-Nzc6Tirj6TKLgTYN5XjZZut9HVYLKGOp1GZeaoqEtW8=";
+    sha256 = "sha256-1QGARXIfb97aLxQ5TZ6Fjznlniznnyuc2ugiW/Drf9g=";
  };

  postPatch = ''
--- a/pkgs/games/gnonograms/default.nix
+++ b/pkgs/games/gnonograms/default.nix
@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , vala
 , meson
 , ninja
@ -19,24 +18,15 @@

 stdenv.mkDerivation rec {
  pname = "gnonograms";
-  version = "2.0.0";
+  version = "2.1.2";

  src = fetchFromGitHub {
    owner = "jeremypw";
    repo = "gnonograms";
    rev = "v${version}";
-    sha256 = "sha256-2uXaybpCAm9cr0o7bqfhgD7mMNPwtv1X/PgnFnSDOl0=";
+    sha256 = "sha256-TkEVjrwlr4Q5FsfcdY+9fxwaMq+DFs0RwGI2E+GT5Mk=";
  };

-  patches = [
-    # Fix build with meson 0.61, can be removed on next release
-    # https://github.com/jeremypw/gnonograms/pull/45
-    (fetchpatch {
-      url = "https://github.com/jeremypw/gnonograms/commit/0e90d8ff42d64a94002ec8500889bc4d7e06c1b6.patch";
-      sha256 = "sha256-G/yqsZFmOA69A3E2CROMYAS5vmok/K5l1S/M2m8DMh4=";
-    })
-  ];
-
  postPatch = ''
    patchShebangs meson/post_install.py
  '';
--- a/pkgs/games/itch-setup/default.nix
+++ b/pkgs/games/itch-setup/default.nix
@ -1,24 +0,0 @@
-{ lib, writeShellScriptBin, steam-run, fetchurl }:
-let
-
-  pname = "itch-setup";
-  version = "1.26.0";
-
-  src = fetchurl {
-    url = "https://broth.itch.ovh/itch-setup/linux-amd64/${version}/unpacked/default";
-    hash = "sha256-bcJKqhgZK42Irx12BIvbTDMb/DHEOEXljetlDokF7x8=";
-    executable = true;
-  };
-
-in
-(writeShellScriptBin pname ''exec ${steam-run}/bin/steam-run ${src} "$@"'') // {
-
-  passthru = { inherit pname version src; };
-  meta = with lib; {
-    description = "An installer for the itch.io desktop app";
-    homepage = "https://github.com/itchio/itch-setup";
-    license = licenses.mit;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ pasqui23 ];
-  };
-}
--- a/pkgs/games/itch/butler.nix
+++ b/pkgs/games/itch/butler.nix
@ -0,0 +1,29 @@
+{ lib
+, buildGoModule
+, fetchFromGitHub
+}:
+
+buildGoModule rec {
+  pname = "butler";
+  version = "15.21.0";
+
+  src = fetchFromGitHub {
+    owner = "itchio";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-vciSmXR3wI3KcnC+Uz36AgI/WUfztA05MJv1InuOjJM=";
+  };
+
+  proxyVendor = true;
+
+  vendorSha256 = "sha256-EIl0ZFDKbZopUR22hp5a2vRUu0O1h1O953NrtoNa2x8=";
+
+  doCheck = false;
+
+  meta = with lib; {
+    description = "Command-line itch.io helper";
+    homepage = "https://github.com/itchio/butler";
+    license = licenses.mit;
+    maintainers = with maintainers; [ martfont ];
+  };
+}
--- a/pkgs/games/itch/default.nix
+++ b/pkgs/games/itch/default.nix
@ -1,30 +1,56 @@
 { lib
 , stdenvNoCC
-, fetchurl
-, libnotify
-, nss
-, gtk3
+, fetchpatch
+, fetchzip
 , fetchFromGitHub
+, butler
+, electron_11
+, steam-run
+, makeWrapper
+, copyDesktopItems
 , makeDesktopItem
-, itch-setup
-, runtimeShell
 }:
-stdenvNoCC.mkDerivation rec{
+stdenvNoCC.mkDerivation rec {
  pname = "itch";
  version = "25.5.1";

-  src = fetchFromGitHub {
-    owner = "itchio";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-Pi3l3uK4kr+N3p7fGQuqckYIzycRqJHDVX00reoSbp4=";
+  src = fetchzip {
+    url = "https://broth.itch.ovh/${pname}/linux-amd64/${version}/itch.zip";
+    stripRoot = false;
+    sha256 = "sha256-ejfS+sqhacW2h8u96W4fout3V8xrBs0SrW5w/7X83m4=";
  };

+  patches = [
+    # Fixes crash while browsing the store.
+    (fetchpatch {
+      name = "itch.patch";
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/itch.patch?h=itch-bin&id=0b181454567029141749f870880b10093216e133";
+      sha256 = "sha256-gmLL/BMondSflERm0z+DuGDP56JhDXiyxEwLUavTD8Q=";
+    })
+  ];
+
+  itch-setup = fetchzip {
+    url = "https://broth.itch.ovh/itch-setup/linux-amd64/1.26.0/itch-setup.zip";
+    stripRoot = false;
+    sha256 = "sha256-5MP6X33Jfu97o5R1n6Og64Bv4ZMxVM0A8lXeQug+bNA=";
+  };
+
+  icons = let sparseCheckout = "/release/images/itch-icons"; in
+    fetchFromGitHub {
+        owner = "itchio";
+        repo = pname;
+        rev = "v${version}";
+        hash = "sha256-1L6STTBHA9xL9IaERaH2OTvurTSng1D+P3KoW0ucEJc=";
+        inherit sparseCheckout;
+      } + sparseCheckout;
+
+  nativeBuildInputs = [ copyDesktopItems makeWrapper ];
+
  desktopItems = [
    (makeDesktopItem {
      name = pname;
-      exec = pname;
-      tryExec = "itch %U";
+      exec = "itch %U";
+      tryExec = pname;
      icon = pname;
      desktopName = pname;
      mimeTypes = [ "x-scheme-handler/itchio" "x-scheme-handler/itch" ];
@ -33,23 +59,33 @@ stdenvNoCC.mkDerivation rec{
    })
  ];

-  itchBin = ''
-    #!${runtimeShell}
-    exec ${itch-setup}/bin/itch-setup --prefer-launch -- "$@"
-  '';
-
-  passAsFile = [ "itchBin" ];
-
-  # as taken from https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=itch
+  # As taken from https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=itch-bin
  installPhase = ''
-    install -Dm0777 $itchBinPath $out/bin/itch
-    for icon in release/images/itch-icons/icon*.png
+    runHook preInstall
+
+    mkdir -p $out/bin $out/share/${pname}/resources/app
+    cp -r resources/app "$out/share/${pname}/resources/"
+
+    install -Dm644 LICENSE -t "$out/share/licenses/$pkgname/"
+    install -Dm644 LICENSES.chromium.html -t "$out/share/licenses/$pkgname/"
+
+    for icon in $icons/icon*.png
    do
-      iconsize="''${icon#release/images/itch-icons/icon}"
+      iconsize="''${icon#$icons/icon}"
      iconsize="''${iconsize%.png}"
      icondir="$out/share/icons/hicolor/''${iconsize}x''${iconsize}/apps/"
      install -Dm644 "$icon" "$icondir/itch.png"
    done
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    makeWrapper ${steam-run}/bin/steam-run $out/bin/${pname} \
+      --add-flags ${electron_11}/bin/electron \
+      --add-flags $out/share/${pname}/resources/app \
+      --set BROTH_USE_LOCAL butler,itch-setup \
+      --prefix PATH : ${butler}/bin/:${itch-setup}
  '';

  meta = with lib; {
@ -57,6 +93,7 @@ stdenvNoCC.mkDerivation rec{
    homepage = "https://github.com/itchio/itch";
    license = licenses.mit;
    platforms = platforms.linux;
+    sourceProvenance = lib.sourceTypes.binaryBytecode;
    maintainers = with maintainers; [ pasqui23 ];
  };
 }
--- a/pkgs/os-specific/linux/zfs/default.nix
+++ b/pkgs/os-specific/linux/zfs/default.nix
@ -16,7 +16,7 @@
 , enablePython ? true

 # for determining the latest compatible linuxPackages
-, linuxPackages_5_15 ? pkgs.linuxKernel.packages.linux_5_15
+, linuxPackages_5_18 ? pkgs.linuxKernel.packages.linux_5_18
 }:

 let
@ -216,28 +216,28 @@ in {
  # to be adapted
  zfsStable = common {
    # check the release notes for compatible kernels
-    kernelCompatible = kernel.kernelOlder "5.18";
-    latestCompatibleLinuxPackages = linuxPackages_5_15;
+    kernelCompatible = kernel.kernelOlder "5.19";
+    latestCompatibleLinuxPackages = linuxPackages_5_18;

    # this package should point to the latest release.
-    version = "2.1.4";
+    version = "2.1.5";

-    sha256 = "sha256-pHz1N2j+d9p1xleEBwwrmK9mN5gEyM69Suy0dsrkZT4=";
+    sha256 = "sha256-a9rmuPO8R8UfxdHvwjfFuYRGn97a1MPmLZRvr3l0swE=";
  };

  zfsUnstable = common {
    # check the release notes for compatible kernels
-    kernelCompatible = kernel.kernelOlder "5.18";
-    latestCompatibleLinuxPackages = linuxPackages_5_15;
+    kernelCompatible = kernel.kernelOlder "5.19";
+    latestCompatibleLinuxPackages = linuxPackages_5_18;

    # this package should point to a version / git revision compatible with the latest kernel release
    # IMPORTANT: Always use a tagged release candidate or commits from the
    # zfs-<version>-staging branch, because this is tested by the OpenZFS
    # maintainers.
-    version = "2.1.4";
+    version = "2.1.5";
    # rev = "0000000000000000000000000000000000000000";

-    sha256 = "sha256-pHz1N2j+d9p1xleEBwwrmK9mN5gEyM69Suy0dsrkZT4=";
+    sha256 = "sha256-a9rmuPO8R8UfxdHvwjfFuYRGn97a1MPmLZRvr3l0swE=";

    isUnstable = true;
  };
--- a/pkgs/servers/dns/coredns/default.nix
+++ b/pkgs/servers/dns/coredns/default.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "coredns";
-  version = "1.9.2";
+  version = "1.9.3";

  src = fetchFromGitHub {
    owner = "coredns";
    repo = "coredns";
    rev = "v${version}";
-    sha256 = "sha256-6ABcXRuPEkzhjVZcltPoWGAc+fs6FwmgQCMRuLmhXxo=";
+    sha256 = "sha256-9lRZjY85SD1HXAWVCp8fpzV0d1Y+LbodT3Sp21CNp+k=";
  };

-  vendorSha256 = "sha256-0S77748voNlIuY6yUAa669pB09h35THojCyQKUm5VFc=";
+  vendorSha256 = "sha256-gNa+dm7n71IiSCztTO5VZ5FnGTGYfNXo/HMichNzek0=";

  postPatch = ''
    substituteInPlace test/file_cname_proxy_test.go \
--- a/pkgs/servers/geospatial/geoserver/default.nix
+++ b/pkgs/servers/geospatial/geoserver/default.nix
@ -0,0 +1,38 @@
+{ lib, stdenv, fetchurl, unzip, jre, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  pname = "geoserver";
+  version = "2.21.0";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/geoserver/GeoServer/${version}/geoserver-${version}-bin.zip";
+    sha256 = "sha256-UCr22Ffhnux6eA0w5qoaf5Hvuypsl/FGpK+emi8G0Mc=";
+  };
+
+  sourceRoot = ".";
+  nativeBuildInputs = [ unzip makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/share/geoserver
+    cp -r . $out/share/geoserver
+    rm -fr $out/share/geoserver/bin/*.bat
+
+    makeWrapper $out/share/geoserver/bin/startup.sh $out/bin/geoserver-startup \
+      --set JAVA_HOME "${jre}" \
+      --set GEOSERVER_HOME "$out/share/geoserver"
+    makeWrapper $out/share/geoserver/bin/shutdown.sh $out/bin/geoserver-shutdown \
+      --set JAVA_HOME "${jre}" \
+      --set GEOSERVER_HOME "$out/share/geoserver"
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Open source server for sharing geospatial data";
+    homepage = "https://geoserver.org/";
+    sourceProvenance = with sourceTypes; [ binaryBytecode ];
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.all;
+  };
+}
--- a/pkgs/servers/shairport-sync/default.nix
+++ b/pkgs/servers/shairport-sync/default.nix
@ -1,6 +1,12 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, openssl, avahi, alsa-lib
-, libdaemon, popt, pkg-config, libconfig, libpulseaudio, soxr }:
+{ lib, stdenv, fetchFromGitHub
+, autoreconfHook, pkg-config
+, openssl, avahi, alsa-lib, glib, libdaemon, popt, libconfig, libpulseaudio, soxr
+, enableDbus ? stdenv.isLinux
+, enableMetadata ? false
+, enableMpris ? stdenv.isLinux
+}:

+with lib;
 stdenv.mkDerivation rec {
  version = "3.3.9";
  pname = "shairport-sync";
@ -23,7 +29,12 @@ stdenv.mkDerivation rec {
    libconfig
    libpulseaudio
    soxr
-  ];
+  ] ++ optional stdenv.isLinux glib;
+
+  prePatch = ''
+    sed -i -e 's/G_BUS_TYPE_SYSTEM/G_BUS_TYPE_SESSION/g' dbus-service.c
+    sed -i -e 's/G_BUS_TYPE_SYSTEM/G_BUS_TYPE_SESSION/g' mpris-service.c
+  '';

  enableParallelBuilding = true;

@ -32,7 +43,10 @@ stdenv.mkDerivation rec {
    "--with-avahi" "--with-ssl=openssl" "--with-soxr"
    "--without-configfiles"
    "--sysconfdir=/etc"
-  ];
+  ]
+    ++ optional enableDbus "--with-dbus-interface"
+    ++ optional enableMetadata "--with-metadata"
+    ++ optional enableMpris "--with-mpris-interface";

  meta = with lib; {
    inherit (src.meta) homepage;
--- a/pkgs/servers/web-apps/snipe-it/default.nix
+++ b/pkgs/servers/web-apps/snipe-it/default.nix
@ -18,13 +18,13 @@ let

 in package.override rec {
  pname = "snipe-it";
-  version = "6.0.4";
+  version = "6.0.5";

  src = fetchFromGitHub {
    owner = "snipe";
    repo = pname;
    rev = "v${version}";
-    sha256 = "06h8rnk8q85f0z0a1q0j010kzs4z2k5sxvi06avk7ndpkrisv4wz";
+    sha256 = "15dp8y0kdjg9x4iwa5ha5w4qbwwsdg5z8337rmkkla2yjmf4lrxb";
  };

  meta = with lib; {
--- a/pkgs/shells/oh/default.nix
+++ b/pkgs/shells/oh/default.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "oh";
-  version = "0.8.0";
+  version = "0.8.1";

  src = fetchFromGitHub {
    owner = "michaelmacinnis";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0sdpk77i5mfamkdqldybl9znzz92hqgi4xvby5j28m0a5gw46kj0";
+    sha256 = "sha256-DMxC5fv5ZLDv7gMajC/eyJd2YpO+OXFdvwAPYotnczw=";
  };

-  vendorSha256 = "12vlvh37hvi8c1i9arppm5wj4v9c98s7myxra10q6qpdqssgc8a0";
+  vendorSha256 = "sha256-f4rqXOu6yXUzNsseSaV9pb8c2KXItYOalB5pfH3Acnc=";

  meta = with lib; {
    homepage = "https://github.com/michaelmacinnis/oh";
--- a/pkgs/tools/backup/zfsbackup/default.nix
+++ b/pkgs/tools/backup/zfsbackup/default.nix
@ -1,26 +1,34 @@
-{ lib, buildGoPackage, fetchFromGitHub }:
+{ lib
+, buildGoModule
+, fetchFromGitHub
+, zfs
+}:

-buildGoPackage rec {
+buildGoModule rec {
  pname = "zfsbackup";
-  version = "unstable-2020-09-30";
-  rev = "092f80846b23e02f99d2aa72d9d889eabfdcb053";
-
-  goPackagePath = "github.com/someone1/zfsbackup-go";
+  version = "unstable-2021-05-26";
+  rev = "2d4534b920d3c57552667e1c6da9978b3a9278f0";

  src = fetchFromGitHub {
    owner = "someone1";
    repo = "zfsbackup-go";
    inherit rev;
-    sha256 = "1xiacaf4r9jkx0m8wjfis14cq622yhljldwkflh9ni3khax7dlgi";
+    sha256 = "sha256-slVwXXGLvq+eAlqzD8p1fnc17CGUBY0Z68SURBBuf2k=";
  };

-  goDeps = ./deps.nix;
+  vendorSha256 = "sha256-jpxp8RKDBrkBBaY89QnKYGWFI/DUURUVX8cPJ/qoLrg=";
+
+  ldflags = [ "-w" "-s" ];
+
+  # Tests require loading the zfs kernel module.
+  doCheck = false;

  meta = with lib; {
    description = "Backup ZFS snapshots to cloud storage such as Google, Amazon, Azure, etc";
    homepage = "https://github.com/someone1/zfsbackup-go";
    license = licenses.mit;
-    maintainers = [ maintainers.xfix ];
+    maintainers = with maintainers; [ xfix ];
+    platforms = platforms.linux;
    mainProgram = "zfsbackup-go";
  };
 }
--- a/Show More
+++ b/Show More