Merge staging-next into staging

2024-10-07 21:18:05 +03:00 · 2022-04-20 18:01:53 +00:00 · 2022-04-20 18:01:53 +00:00 · f8e9f3cd9a
commit f8e9f3cd9a
parent 116fc660c7 173afb6be7
63 changed files with 1075 additions and 845 deletions
--- a/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
+++ b/nixos/doc/manual/from_md/release-notes/rl-2205.section.xml
@ -1263,6 +1263,15 @@
          <literal>true</literal>.
        </para>
      </listitem>
+      <listitem>
+        <para>
+          <literal>services.github-runner</literal> has been hardened.
+          Notably address families and system calls have been
+          restricted, which may adversely affect some kinds of testing,
+          e.g. using <literal>AF_BLUETOOTH</literal> to test bluetooth
+          devices.
+        </para>
+      </listitem>
      <listitem>
        <para>
          The terraform 0.12 compatibility has been removed and the
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@ -498,6 +498,10 @@ In addition to numerous new and upgraded packages, this release has the followin

 - The Tor SOCKS proxy is now actually disabled if `services.tor.client.enable` is set to `false` (the default). If you are using this functionality but didn't change the setting or set it to `false`, you now need to set it to `true`.

+- `services.github-runner` has been hardened.  Notably address families and
+  system calls have been restricted, which may adversely affect some kinds of
+  testing, e.g. using `AF_BLUETOOTH` to test bluetooth devices.
+
 - The terraform 0.12 compatibility has been removed and the `terraform.withPlugins` and `terraform-providers.mkProvider` implementations simplified. Providers now need to be stored under
 `$out/libexec/terraform-providers/<registry>/<owner>/<name>/<version>/<os>_<arch>/terraform-provider-<name>_v<version>` (which mkProvider does).

--- a/nixos/modules/services/continuous-integration/github-runner.nix
+++ b/nixos/modules/services/continuous-integration/github-runner.nix
@ -299,6 +299,16 @@ in
        RestrictRealtime = true;
        RestrictSUIDSGID = true;
        UMask = "0066";
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        SystemCallFilter = [
+          "~@debug"
+          "~@mount"
+          "~@privileged"
+          "~@cpu-emulation"
+          "~@obsolete"
+        ];
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" "AF_NETLINK" ];

        # Needs network access
        PrivateNetwork = false;
--- a/nixos/modules/services/mail/mailman.nix
+++ b/nixos/modules/services/mail/mailman.nix
@ -318,7 +318,9 @@ in {
    systemd.services = {
      mailman = {
        description = "GNU Mailman Master Process";
-        after = [ "network.target" ];
+        before = lib.optional cfg.enablePostfix "postfix.service";
+        after = [ "network.target" ]
+          ++ lib.optional cfg.enablePostfix "postfix-setup.service";
        restartTriggers = [ config.environment.etc."mailman.cfg".source ];
        wantedBy = [ "multi-user.target" ];
        serviceConfig = {
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@ -723,23 +723,10 @@ in
        { ${setgidGroup}.gid = config.ids.gids.postdrop;
        };

-      systemd.services.postfix =
-        { description = "Postfix mail server";
-
-          wantedBy = [ "multi-user.target" ];
-          after = [ "network.target" ];
-          path = [ pkgs.postfix ];
-
-          serviceConfig = {
-            Type = "forking";
-            Restart = "always";
-            PIDFile = "/var/lib/postfix/queue/pid/master.pid";
-            ExecStart = "${pkgs.postfix}/bin/postfix start";
-            ExecStop = "${pkgs.postfix}/bin/postfix stop";
-            ExecReload = "${pkgs.postfix}/bin/postfix reload";
-          };
-
-          preStart = ''
+      systemd.services.postfix-setup =
+        { description = "Setup for Postfix mail server";
+          serviceConfig.Type = "oneshot";
+          script = ''
            # Backwards compatibility
            if [ ! -d /var/lib/postfix ] && [ -d /var/postfix ]; then
              mkdir -p /var/lib
@ -777,6 +764,24 @@ in
          '';
        };

+      systemd.services.postfix =
+        { description = "Postfix mail server";
+
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network.target" "postfix-setup.service" ];
+          requires = [ "postfix-setup.service" ];
+          path = [ pkgs.postfix ];
+
+          serviceConfig = {
+            Type = "forking";
+            Restart = "always";
+            PIDFile = "/var/lib/postfix/queue/pid/master.pid";
+            ExecStart = "${pkgs.postfix}/bin/postfix start";
+            ExecStop = "${pkgs.postfix}/bin/postfix stop";
+            ExecReload = "${pkgs.postfix}/bin/postfix reload";
+          };
+        };
+
      services.postfix.config = (mapAttrs (_: v: mkDefault v) {
        compatibility_level  = pkgs.postfix.version;
        mail_owner           = cfg.user;
--- a/nixos/modules/services/networking/bird.nix
+++ b/nixos/modules/services/networking/bird.nix
@ -68,8 +68,7 @@ in
    systemd.services.bird2 = {
      description = "BIRD Internet Routing Daemon";
      wantedBy = [ "multi-user.target" ];
-      reloadIfChanged = true;
-      restartTriggers = [ config.environment.etc."bird/bird2.conf".source ];
+      reloadTriggers = [ config.environment.etc."bird/bird2.conf".source ];
      serviceConfig = {
        Type = "forking";
        Restart = "on-failure";
--- a/pkgs/applications/editors/cudatext/default.nix
+++ b/pkgs/applications/editors/cudatext/default.nix
@ -38,13 +38,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "cudatext";
-  version = "1.161.0";
+  version = "1.162.0";

  src = fetchFromGitHub {
    owner = "Alexey-T";
    repo = "CudaText";
    rev = version;
-    sha256 = "sha256-FxeJpKc++fDHdYuYmjL6qY/rilA++ljcB/9U54+/+P0=";
+    sha256 = "sha256-lAH0HXtzWs1iFVzM/tvnBT1s1Mt0AGs4TqdtFu1NeMw=";
  };

  postPatch = ''
--- a/pkgs/applications/editors/cudatext/deps.json
+++ b/pkgs/applications/editors/cudatext/deps.json
@ -1,23 +1,23 @@
 {
  "EncConv": {
    "owner": "Alexey-T",
-    "rev": "2022.03.02",
-    "sha256": "sha256-fBN6Ix5CqhzMbNrWGn6nw6+JRDmEfqe6o8JGHERkiPE="
+    "rev": "2022.04.18",
+    "sha256": "sha256-UV07a9qNzd0JQWCq/eD0K9fA7kxAKj5OP7dOpECo8xw="
  },
  "ATBinHex-Lazarus": {
    "owner": "Alexey-T",
-    "rev": "2021.11.17",
-    "sha256": "sha256-wdYH0sISFNx42zt07gLn9ANxcyrq3WrbRhWfTFgPQWw="
+    "rev": "2022.04.16",
+    "sha256": "sha256-7ye73KSpoPvvxBNwBC3uloufFE+448RDyNScumk1ViE="
  },
  "ATFlatControls": {
    "owner": "Alexey-T",
-    "rev": "2022.03.17",
-    "sha256": "sha256-zpirFZcqIT53tZhgxQGdwVB6pA98SQLr1o3f+Lhq2QY="
+    "rev": "2022.04.18",
+    "sha256": "sha256-Bp/pkbTPLiVaDSstzTaNjKb+msPw8Tuny75n/aYBpUc="
  },
  "ATSynEdit": {
    "owner": "Alexey-T",
-    "rev": "2022.04.11",
-    "sha256": "sha256-CoNjxQSQJhtVvvO9fJBGmfjbWhwZJ31Jk0YcISKqKiU="
+    "rev": "2022.04.18",
+    "sha256": "sha256-tvFESbamCt7A6Xv8WGh0dKzr9neelYMM7guySOunfvk="
  },
  "ATSynEdit_Cmp": {
    "owner": "Alexey-T",
@ -26,8 +26,8 @@
  },
  "EControl": {
    "owner": "Alexey-T",
-    "rev": "2022.04.11.1",
-    "sha256": "sha256-QwxnP7zY5AaMBqe2qH2l8lrfD6JQ+RNY5sucwL+o1Ts="
+    "rev": "2022.04.18",
+    "sha256": "sha256-Wp+/f/z2H/WANq9u8mRDn0BaeyFWiPpLrW0YqyT+ezw="
  },
  "ATSynEdit_Ex": {
    "owner": "Alexey-T",
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
--- a/pkgs/applications/misc/copyq/default.nix
+++ b/pkgs/applications/misc/copyq/default.nix
@ -17,13 +17,13 @@

 mkDerivation rec {
  pname = "CopyQ";
-  version = "6.0.1";
+  version = "6.1.0";

  src = fetchFromGitHub {
    owner = "hluk";
    repo = "CopyQ";
    rev = "v${version}";
-    sha256 = "sha256-edrRgnjbszqJLbGLE4anCJSGApymvK0O+2ks5jWe8aw=";
+    sha256 = "sha256-2BWyLVxH50G+S/Hp8E5hWG64DcIamtZPGm0nSMwEhY4=";
  };

  nativeBuildInputs = [
--- a/pkgs/applications/misc/hello/default.nix
+++ b/pkgs/applications/misc/hello/default.nix
@ -3,7 +3,7 @@
 , fetchurl
 , nixos
 , testVersion
-, testEqualDerivation
+, testers
 , hello
 }:

@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
    version = testVersion { package = hello; };

    invariant-under-noXlibs =
-      testEqualDerivation
+      testers.testEqualDerivation
        "hello must not be rebuilt when environment.noXlibs is set."
        hello
        (nixos { environment.noXlibs = true; }).pkgs.hello;
--- a/pkgs/applications/networking/cluster/fluxcd/default.nix
+++ b/pkgs/applications/networking/cluster/fluxcd/default.nix
@ -1,9 +1,9 @@
 { lib, buildGoModule, fetchFromGitHub, fetchzip, installShellFiles }:

 let
-  version = "0.28.5";
-  sha256 = "11k8sb8pjhrg8ar256rfdw736cg32m6n8xcfhyqc3r4pkj3ksli8";
-  manifestsSha256 = "1gjya8xcmx065ywx7bc2xdsp3qj2y47b7l1dlr4y0hzp19pclmcw";
+  version = "0.29.1";
+  sha256 = "0sqavlylkbcgk9yfblh85rfi3lxv23rlcrq8cw1ikn832gncg7dk";
+  manifestsSha256 = "1ph0qbjc1l3h5n0myza3dw71x30iva34nx6f7vfiy8fpapcf1qbi";

  manifests = fetchzip {
    url =
@ -23,7 +23,7 @@ in buildGoModule rec {
    inherit sha256;
  };

-  vendorSha256 = "sha256-kxI2sOaY66XLIRMT1l3VLQh1XR4nvvsYvsdZbVLxbHM=";
+  vendorSha256 = "sha256-v208yuWWPzLxrbkgXikE2PiFv9NXNEG4K1zrLHyaleI=";

  postUnpack = ''
    cp -r ${manifests} source/cmd/flux/manifests
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@ -192,9 +192,9 @@ rec {
  };

  terraform_1 = mkTerraform {
-    version = "1.1.8";
-    sha256 = "sha256-U3RuLnDQD1EbPZG/wPuVMbSKmR3EqspkoK0Ky8aZb7k=";
-    vendorSha256 = "sha256-Jy9o0O80OjagrHG25CSPblI49zKx0N8pwvEotk9qm3s=";
+    version = "1.1.9";
+    sha256 = "sha256-6dyP3Y5cK+/qLoC2QPZW3QNgqOeVXegC06Pa7pSv1iE=";
+    vendorSha256 = "sha256-YI/KeoOIxgCAS3Q6SXaW8my0PyFD+pyksshQEAknsz4=";
    patches = [ ./provider-path-0_15.patch ];
    passthru = { inherit plugins; };
  };
--- a/pkgs/applications/networking/instant-messengers/franz/default.nix
+++ b/pkgs/applications/networking/instant-messengers/franz/default.nix
@ -3,10 +3,10 @@
 mkFranzDerivation rec {
  pname = "franz";
  name = "Franz";
-  version = "5.6.1";
+  version = "5.9.2";
  src = fetchurl {
    url = "https://github.com/meetfranz/franz/releases/download/v${version}/franz_${version}_amd64.deb";
-    sha256 = "1gn0n1hr6z2gsdnpxysyq6sm8y7cjr9jafhsam8ffw0bq74kph7p";
+    sha256 = "sha256-W/60g5CbSUZcNASjdbiS7DNv9375GiesEG60QLLAh1g=";
  };
  meta = with lib; {
    description = "A free messaging app that combines chat & messaging services into one application";
--- a/pkgs/applications/science/logic/isabelle/default.nix
+++ b/pkgs/applications/science/logic/isabelle/default.nix
@ -1,7 +1,33 @@
-{ lib, stdenv, fetchurl, coreutils, nettools, java, scala, polyml, z3, veriT, vampire, eprover-ho, naproche, rlwrap, perl, makeDesktopItem, isabelle-components, isabelle, symlinkJoin }:
+{ lib, stdenv, fetchurl, coreutils, nettools, java, scala, polyml, z3, veriT, vampire, eprover-ho, naproche, rlwrap, perl, makeDesktopItem, isabelle-components, isabelle, symlinkJoin, fetchhg }:
 # nettools needed for hostname

-stdenv.mkDerivation rec {
+let
+  sha1 = stdenv.mkDerivation {
+    pname = "isabelle-sha1";
+    version = "2021-1";
+
+    src = fetchhg {
+      url = "https://isabelle.sketis.net/repos/sha1";
+      rev = "e0239faa6f42";
+      sha256 = "sha256-4sxHzU/ixMAkSo67FiE6/ZqWJq9Nb9OMNhMoXH2bEy4=";
+    };
+
+    buildPhase = (if stdenv.isDarwin then ''
+      LDFLAGS="-dynamic -undefined dynamic_lookup -lSystem"
+    '' else ''
+      LDFLAGS="-fPIC -shared"
+    '') + ''
+      CFLAGS="-fPIC -I."
+      $CC $CFLAGS -c sha1.c -o sha1.o
+      $LD $LDFLAGS sha1.o -o libsha1.so
+    '';
+
+    installPhase = ''
+      mkdir -p $out/lib
+      cp libsha1.so $out/lib/
+    '';
+  };
+in stdenv.mkDerivation rec {
  pname = "isabelle";
  version = "2021-1";

@ -82,6 +108,9 @@ stdenv.mkDerivation rec {
      --replace 'cmd.add("/usr/bin/env");' "" \
      --replace 'cmd.add("bash");' "cmd.add(\"$SHELL\");"

+    substituteInPlace src/Pure/General/sha1.ML \
+      --replace '"$ML_HOME/" ^ (if ML_System.platform_is_windows then "sha1.dll" else "libsha1.so")' '"${sha1}/lib/libsha1.so"'
+
    rm -r heaps
  '' + (if ! stdenv.isLinux then "" else ''
    arch=${if stdenv.hostPlatform.system == "x86_64-linux" then "x86_64-linux" else "x86-linux"}
--- a/pkgs/applications/virtualization/qemu/allow-virtfs-on-darwin.patch
+++ b/pkgs/applications/virtualization/qemu/allow-virtfs-on-darwin.patch
@ -1,77 +0,0 @@
-From 4ca09b7cd1d42eb6b1587fed74cd4d684e31bfbe Mon Sep 17 00:00:00 2001
-From: Keno Fischer <keno@juliacomputing.com>
-Date: Sun, 27 Feb 2022 17:35:22 -0500
-Subject: [PATCH] 9p: darwin: meson: Allow VirtFS on Darwin
-
-To allow VirtFS on darwin, we need to check that pthread_fchdir_np is
-available, which has only been available since macOS 10.12.
-
-Additionally, virtfs_proxy_helper is disabled on Darwin. This patch
-series does not currently provide an implementation of the proxy-helper,
-but this functionality could be implemented later on.
-
-Signed-off-by: Keno Fischer <keno@juliacomputing.com>
-[Michael Roitzsch: - Rebase for NixOS]
-Signed-off-by: Michael Roitzsch <reactorcontrol@icloud.com>
-[Will Cohen: - Rebase to master]
-Signed-off-by: Will Cohen <wwcohen@gmail.com>
-Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
-[Will Cohen: - Add check for pthread_fchdir_np to virtfs
-             - Add comments to patch commit
-             - Note that virtfs_proxy_helper does not work
-               on macOS
-             - Fully adjust meson virtfs error note to specify
-               macOS
-             - Rebase to master]
-Signed-off-by: Will Cohen <wwcohen@gmail.com>
-Message-Id: <20220227223522.91937-12-wwcohen@gmail.com>
-Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
-Acked-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
---
- fsdev/meson.build |  1 +
- meson.build       | 17 +++++++++++------
- 2 files changed, 12 insertions(+), 6 deletions(-)
-
-diff --git a/fsdev/meson.build b/fsdev/meson.build
-index adf57cc43e..b632b66348 100644
--- a/fsdev/meson.build
-+++ b/fsdev/meson.build
-@@ -7,6 +7,7 @@ fsdev_ss.add(when: ['CONFIG_FSDEV_9P'], if_true: files(
-   'qemu-fsdev.c',
- ), if_false: files('qemu-fsdev-dummy.c'))
- softmmu_ss.add_all(when: 'CONFIG_LINUX', if_true: fsdev_ss)
-+softmmu_ss.add_all(when: 'CONFIG_DARWIN', if_true: fsdev_ss)
- 
- if have_virtfs_proxy_helper
-   executable('virtfs-proxy-helper',
-diff --git a/meson.build b/meson.build
-index 2265fa409a..6d73c02903 100644
--- a/meson.build
-+++ b/meson.build
-@@ -1383,12 +1383,17 @@ endif
- have_host_block_device = (targetos != 'darwin' or
-     cc.has_header('IOKit/storage/IOMedia.h'))
- 
-have_virtfs = (targetos == 'linux' and
-    have_system and
-    libattr.found() and
-    libcap_ng.found())
-
-have_virtfs_proxy_helper = have_virtfs and have_tools
-+have_virtfs = get_option('virtfs') \
-+    .require(targetos == 'linux' or targetos == 'darwin',
-+             error_message: 'virtio-9p (virtfs) requires Linux or macOS') \
-+    .require(targetos == 'linux' or cc.has_function('pthread_fchdir_np'),
-+             error_message: 'virtio-9p (virtfs) on macOS requires the presence of pthread_fchdir_np') \
-+    .require(targetos == 'darwin' or (libattr.found() and libcap_ng.found()),
-+             error_message: 'virtio-9p (virtfs) on Linux requires libcap-ng-devel and libattr-devel') \
-+    .disable_auto_if(not have_tools and not have_system) \
-+    .allowed()
-+
-+have_virtfs_proxy_helper = targetos != 'darwin' and have_virtfs and have_tools
- 
- if get_option('virtfs').enabled()
-   if not have_virtfs
-- 
-2.35.1
-
--- a/pkgs/applications/virtualization/qemu/default.nix
+++ b/pkgs/applications/virtualization/qemu/default.nix
@ -4,6 +4,7 @@
 , makeWrapper, runtimeShell, removeReferencesTo
 , attr, libcap, libcap_ng, socat
 , CoreServices, Cocoa, Hypervisor, rez, setfile
+, guestAgentSupport ? with stdenv.hostPlatform; isLinux || isSunOS || isWindows
 , numaSupport ? stdenv.isLinux && !stdenv.isAarch32, numactl
 , seccompSupport ? stdenv.isLinux, libseccomp
 , alsaSupport ? lib.hasSuffix "linux" stdenv.hostPlatform.system && !nixosTestRunner
@ -40,11 +41,11 @@ stdenv.mkDerivation rec {
    + lib.optionalString xenSupport "-xen"
    + lib.optionalString hostCpuOnly "-host-cpu-only"
    + lib.optionalString nixosTestRunner "-for-vm-tests";
-  version = "6.2.0";
+  version = "7.0.0";

  src = fetchurl {
    url= "https://download.qemu.org/qemu-${version}.tar.xz";
-    sha256 = "0iavlsy9hin8k38230j8lfmyipx3965zljls1dp34mmc8n75vqb8";
+    sha256 = "sha256-9rN1x5UfcoQCeYsLqrsthkeMpT1Eztvvq74cRr9G+Dk=";
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ];
@ -82,80 +83,26 @@ stdenv.mkDerivation rec {

  dontUseMesonConfigure = true; # meson's configurePhase isn't compatible with qemu build

-  outputs = [ "out" "ga" ];
+  outputs = [ "out" ] ++ lib.optional guestAgentSupport "ga";
  # On aarch64-linux we would shoot over the Hydra's 2G output limit.
  separateDebugInfo = !(stdenv.isAarch64 && stdenv.isLinux);

  patches = [
    ./fix-qemu-ga.patch
-    # MTP Devices were broken in QEMU 6.1.0, this patch fixes that.
-     (fetchpatch {
-       url = "https://gitlab.com/qemu-project/qemu/-/commit/9d30c78c7d3b994825cbe63fa277279ae3ef4248.patch";
-       sha256 = "sha256-AChB9HMEShrM+2UW2aOT9+MqlAm568sG3HxHK3nDC/M=";
-     })
-    # Cocoa clipboard support only works on macOS 10.14+
-    (fetchpatch {
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/7e3e20d89129614f4a7b2451fe321cc6ccca3b76.diff";
-      sha256 = "09xz06g57wxbacic617pq9c0qb7nly42gif0raplldn5lw964xl2";
-      revert = true;
-    })
-    # 9p-darwin for 7.0 backported to 6.2.0
-    #
-    # Can generally be removed when updating derivation to 7.0. Nine of the
-    # patches can be drawn directly from QEMU upstream, but the second commit
-    # and the eleventh commit had to be modified when rebasing back to 6.2.0.
-    (fetchpatch {
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/e0bd743bb2dd4985791d4de880446bdbb4e04fed.patch";
-      sha256 = "sha256-c6QYL3zig47fJwm6rqkqGp3E1PakVTaihvXDRebbBlQ=";
-    })
-    ./rename-9p-util.patch
-    (fetchpatch {
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/f41db099c71151291c269bf48ad006de9cbd9ca6.patch";
-      sha256 = "sha256-70/rrhZw+02JJbJ3CoW8B1GbdM4Lwb2WkUdwstYAoIQ=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/6b3b279bd670c6a2fa23c9049820c814f0e2c846.patch";
-      sha256 = "sha256-7WqklSvLirEuxTXTIMQDQhWpXnwMseJ1RumT+faq/Y8=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/67a71e3b71a2834d028031a92e76eb9444e423c6.patch";
-      sha256 = "sha256-COFm/SwfJSoSl9YDpL6ceAE8CcE4mGhsGxw1HMuL++o=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/38d7fd68b0c8775b5253ab84367419621aa032e6.patch";
-      sha256 = "sha256-iwGIzq9FWW6zpbDg/IKrp5OZpK9cgQqTRWWq8WBIHRQ=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/57b3910bc3513ab515296692daafd1c546f3c115.patch";
-      sha256 = "sha256-ybl9+umZAcQKHYL7NkGJQC0W7bccTagA9KQiFaR2LYA=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/b5989326f558faedd2511f29459112cced2ca8f5.patch";
-      sha256 = "sha256-s+O9eCgj2Ev+INjL9LY9MJBdISIdZLslI3lue2DICGM=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/029ed1bd9defa33a80bb40cdcd003699299af8db.patch";
-      sha256 = "sha256-mGqcRWcEibDJdhTRrN7ZWrMuCfUWW8vWiFj7sb2/RYo=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/d3671fd972cd185a6923433aa4802f54d8b62112.patch";
-      sha256 = "sha256-GUh5o7mbFTm/dm6CqcGdoMlC+YrV8RlcEwu/mxrfTzo=";
-    })
-    # The next two commits are to make Linux v5.17 work on aarch64-darwin. These are included in QEMU v7.
-    (fetchpatch {
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/ad99f64f1cfff7c5e7af0e697523d9b7e45423b6.patch";
-      sha256 = "sha256-e6WtfQIPEiXhWucd5ab7UIoccbWEAv3bwksn4hR85CY=";
-    })
-    (fetchpatch {
-      url = "https://gitlab.com/qemu-project/qemu/-/commit/7f6c295cdfeaa229c360cac9a36e4e595aa902ae.patch";
-      sha256 = "sha256-mORtgfU1CYQFKO5UrXgM9cJyZxeF2bz8iAoq0UlFQeY=";
-    })
-    ./allow-virtfs-on-darwin.patch
+
    # QEMU upstream does not demand compatibility to pre-10.13, so 9p-darwin
    # support on nix requires utimensat fallback. The patch adding this fallback
    # set was removed during the process of upstreaming this functionality, and
    # will still be needed in nix until the macOS SDK reaches 10.13+.
    ./provide-fallback-for-utimensat.patch
+    # Cocoa clipboard support only works on macOS 10.14+
+    ./revert-ui-cocoa-add-clipboard-support.patch
+    # Standard about panel requires AppKit and macOS 10.13+
+    (fetchpatch {
+      url = "https://gitlab.com/qemu-project/qemu/-/commit/99eb313ddbbcf73c1adcdadceba1423b691c6d05.diff";
+      sha256 = "sha256-gTRf9XENAfbFB3asYCXnw4OV4Af6VE1W56K2xpYDhgM=";
+      revert = true;
+    })
  ]
    ++ lib.optional nixosTestRunner ./force-uid0-on-9p.patch;

@ -194,7 +141,6 @@ stdenv.mkDerivation rec {
    "--disable-strip" # We'll strip ourselves after separating debug info.
    "--enable-docs"
    "--enable-tools"
-    "--enable-guest-agent"
    "--localstatedir=/var"
    "--sysconfdir=/etc"
    # Always use our Meson, not the bundled version, which doesn't
@ -202,6 +148,7 @@ stdenv.mkDerivation rec {
    "--meson=meson"
    "--cross-prefix=${stdenv.cc.targetPrefix}"
    "--cpu=${stdenv.hostPlatform.uname.processor}"
+    (lib.enableFeature guestAgentSupport "guest-agent")
  ] ++ lib.optional numaSupport "--enable-numa"
    ++ lib.optional seccompSupport "--enable-seccomp"
    ++ lib.optional smartcardSupport "--enable-smartcard"
@ -233,7 +180,7 @@ stdenv.mkDerivation rec {
  postFixup = ''
    # the .desktop is both invalid and pointless
    rm -f $out/share/applications/qemu.desktop
-
+  '' + lib.optionalString guestAgentSupport ''
    # move qemu-ga (guest agent) to separate output
    mkdir -p $ga/bin
    mv $out/bin/qemu-ga $ga/bin/
--- a/pkgs/applications/virtualization/qemu/provide-fallback-for-utimensat.patch
+++ b/pkgs/applications/virtualization/qemu/provide-fallback-for-utimensat.patch
@ -1,4 +1,4 @@
-From 70328c307001f4bb75d30d93c5bba3c3cd790c88 Mon Sep 17 00:00:00 2001
+From 747a741772cde6bb340eb8bdb493390280de8d16 Mon Sep 17 00:00:00 2001
 From: Keno Fischer <keno@juliacomputing.com>
 Date: Sat, 16 Jun 2018 20:56:54 -0400
 Subject: [PATCH] 9p: darwin: Provide fallback impl for utimensat
@ -160,7 +160,7 @@ index db451b0784..320697f347 100644
 +    return utimensat(dirfd, filename, times, AT_SYMLINK_NOFOLLOW);
 +}
 diff --git a/hw/9pfs/9p-util.h b/hw/9pfs/9p-util.h
-index 1f74d37558..a4b002d1b5 100644
+index 97e681e167..fd50d6243a 100644
 --- a/hw/9pfs/9p-util.h
 +++ b/hw/9pfs/9p-util.h
@@ -36,6 +36,12 @@ static inline int qemu_lsetxattr(const char *path, const char *name,
@ -176,14 +176,14 @@ index 1f74d37558..a4b002d1b5 100644
 static inline void close_preserve_errno(int fd)
 {
     int serrno = errno;
-@@ -96,6 +102,8 @@ ssize_t flistxattrat_nofollow(int dirfd, const char *filename,
+@@ -98,6 +104,8 @@ ssize_t flistxattrat_nofollow(int dirfd, const char *filename,
                               char *list, size_t size);
 ssize_t fremovexattrat_nofollow(int dirfd, const char *filename,
                                 const char *name);
 +int utimensat_nofollow(int dirfd, const char *filename,
 +                       const struct timespec times[2]);
 
- /**
+ /*
  * Darwin has d_seekoff, which appears to function similarly to d_off.
 -- 
 2.35.1
--- a/pkgs/applications/virtualization/qemu/rename-9p-util.patch
+++ b/pkgs/applications/virtualization/qemu/rename-9p-util.patch
@ -1,54 +0,0 @@
-From 011b121d7f84c8974f03a81582cf1107249245bb Mon Sep 17 00:00:00 2001
-From: Keno Fischer <keno@juliacomputing.com>
-Date: Sun, 27 Feb 2022 17:35:13 -0500
-Subject: [PATCH] 9p: Rename 9p-util -> 9p-util-linux
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The current file only has the Linux versions of these functions.
-Rename the file accordingly and update the Makefile to only build
-it on Linux. A Darwin version of these will follow later in the
-series.
-
-Signed-off-by: Keno Fischer <keno@juliacomputing.com>
-[Michael Roitzsch: - Rebase for NixOS]
-Signed-off-by: Michael Roitzsch <reactorcontrol@icloud.com>
-Signed-off-by: Will Cohen <wwcohen@gmail.com>
-Reviewed-by: Greg Kurz <groug@kaod.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-Id: <20220227223522.91937-3-wwcohen@gmail.com>
-Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
---
- hw/9pfs/{9p-util.c => 9p-util-linux.c} | 0
- hw/9pfs/meson.build                    | 2 +-
- 2 files changed, 1 insertion(+), 1 deletion(-)
- rename hw/9pfs/{9p-util.c => 9p-util-linux.c} (100%)
-
-diff --git a/hw/9pfs/9p-util.c b/hw/9pfs/9p-util-linux.c
-similarity index 100%
-rename from hw/9pfs/9p-util.c
-rename to hw/9pfs/9p-util-linux.c
-diff --git a/hw/9pfs/meson.build b/hw/9pfs/meson.build
-index 99be5d9119..1b28e70040 100644
--- a/hw/9pfs/meson.build
-+++ b/hw/9pfs/meson.build
-@@ -4,7 +4,6 @@ fs_ss.add(files(
-   '9p-posix-acl.c',
-   '9p-proxy.c',
-   '9p-synth.c',
-  '9p-util.c',
-   '9p-xattr-user.c',
-   '9p-xattr.c',
-   '9p.c',
-@@ -14,6 +13,7 @@ fs_ss.add(files(
-   'coth.c',
-   'coxattr.c',
- ))
-+fs_ss.add(when: 'CONFIG_LINUX', if_true: files('9p-util-linux.c'))
- fs_ss.add(when: 'CONFIG_XEN', if_true: files('xen-9p-backend.c'))
- softmmu_ss.add_all(when: 'CONFIG_FSDEV_9P', if_true: fs_ss)
- 
-- 
-2.35.1
-
--- a/pkgs/applications/virtualization/qemu/revert-ui-cocoa-add-clipboard-support.patch
+++ b/pkgs/applications/virtualization/qemu/revert-ui-cocoa-add-clipboard-support.patch
@ -0,0 +1,208 @@
+From 19b0952b36b6b5c4bd2665cc0bd4e55a85f81b55 Mon Sep 17 00:00:00 2001
+From: Will Cohen <willcohen@users.noreply.github.com>
+Date: Tue, 29 Mar 2022 14:00:56 -0400
+Subject: [PATCH] Revert "ui/cocoa: Add clipboard support"
+
+This reverts commit 7e3e20d89129614f4a7b2451fe321cc6ccca3b76.
+---
+ include/ui/clipboard.h |   2 +-
+ ui/clipboard.c         |   2 +-
+ ui/cocoa.m             | 121 -----------------------------------------
+ 3 files changed, 2 insertions(+), 123 deletions(-)
+
+diff --git a/include/ui/clipboard.h b/include/ui/clipboard.h
+index ce76aa451f..c4e1dc4ff4 100644
+--- a/include/ui/clipboard.h
+++ b/include/ui/clipboard.h
+@@ -269,7 +269,7 @@ void qemu_clipboard_set_data(QemuClipboardPeer *peer,
+                              QemuClipboardInfo *info,
+                              QemuClipboardType type,
+                              uint32_t size,
+-                             const void *data,
+                             void *data,
+                              bool update);
+ 
+ G_DEFINE_AUTOPTR_CLEANUP_FUNC(QemuClipboardInfo, qemu_clipboard_info_unref)
+diff --git a/ui/clipboard.c b/ui/clipboard.c
+index 9079ef829b..6b9ed59e1b 100644
+--- a/ui/clipboard.c
+++ b/ui/clipboard.c
+@@ -140,7 +140,7 @@ void qemu_clipboard_set_data(QemuClipboardPeer *peer,
+                              QemuClipboardInfo *info,
+                              QemuClipboardType type,
+                              uint32_t size,
+-                             const void *data,
+                             void *data,
+                              bool update)
+ {
+     if (!info ||
+diff --git a/ui/cocoa.m b/ui/cocoa.m
+index c4e5468f9e..cd3bdf0cec 100644
+--- a/ui/cocoa.m
+++ b/ui/cocoa.m
+@@ -28,7 +28,6 @@
+ #include <crt_externs.h>
+ 
+ #include "qemu-common.h"
+-#include "ui/clipboard.h"
+ #include "ui/console.h"
+ #include "ui/input.h"
+ #include "ui/kbd-state.h"
+@@ -107,10 +106,6 @@ static void cocoa_switch(DisplayChangeListener *dcl,
+ static QemuSemaphore app_started_sem;
+ static bool allow_events;
+ 
+-static NSInteger cbchangecount = -1;
+-static QemuClipboardInfo *cbinfo;
+-static QemuEvent cbevent;
+-
+ // Utility functions to run specified code block with iothread lock held
+ typedef void (^CodeBlock)(void);
+ typedef bool (^BoolCodeBlock)(void);
+@@ -1805,105 +1800,6 @@ static void addRemovableDevicesMenuItems(void)
+     qapi_free_BlockInfoList(pointerToFree);
+ }
+ 
+-@interface QemuCocoaPasteboardTypeOwner : NSObject<NSPasteboardTypeOwner>
+-@end
+-
+-@implementation QemuCocoaPasteboardTypeOwner
+-
+-- (void)pasteboard:(NSPasteboard *)sender provideDataForType:(NSPasteboardType)type
+-{
+-    if (type != NSPasteboardTypeString) {
+-        return;
+-    }
+-
+-    with_iothread_lock(^{
+-        QemuClipboardInfo *info = qemu_clipboard_info_ref(cbinfo);
+-        qemu_event_reset(&cbevent);
+-        qemu_clipboard_request(info, QEMU_CLIPBOARD_TYPE_TEXT);
+-
+-        while (info == cbinfo &&
+-               info->types[QEMU_CLIPBOARD_TYPE_TEXT].available &&
+-               info->types[QEMU_CLIPBOARD_TYPE_TEXT].data == NULL) {
+-            qemu_mutex_unlock_iothread();
+-            qemu_event_wait(&cbevent);
+-            qemu_mutex_lock_iothread();
+-        }
+-
+-        if (info == cbinfo) {
+-            NSData *data = [[NSData alloc] initWithBytes:info->types[QEMU_CLIPBOARD_TYPE_TEXT].data
+-                                           length:info->types[QEMU_CLIPBOARD_TYPE_TEXT].size];
+-            [sender setData:data forType:NSPasteboardTypeString];
+-            [data release];
+-        }
+-
+-        qemu_clipboard_info_unref(info);
+-    });
+-}
+-
+-@end
+-
+-static QemuCocoaPasteboardTypeOwner *cbowner;
+-
+-static void cocoa_clipboard_notify(Notifier *notifier, void *data);
+-static void cocoa_clipboard_request(QemuClipboardInfo *info,
+-                                    QemuClipboardType type);
+-
+-static QemuClipboardPeer cbpeer = {
+-    .name = "cocoa",
+-    .notifier = { .notify = cocoa_clipboard_notify },
+-    .request = cocoa_clipboard_request
+-};
+-
+-static void cocoa_clipboard_update_info(QemuClipboardInfo *info)
+-{
+-    if (info->owner == &cbpeer || info->selection != QEMU_CLIPBOARD_SELECTION_CLIPBOARD) {
+-        return;
+-    }
+-
+-    if (info != cbinfo) {
+-        NSAutoreleasePool * pool = [[NSAutoreleasePool alloc] init];
+-        qemu_clipboard_info_unref(cbinfo);
+-        cbinfo = qemu_clipboard_info_ref(info);
+-        cbchangecount = [[NSPasteboard generalPasteboard] declareTypes:@[NSPasteboardTypeString] owner:cbowner];
+-        [pool release];
+-    }
+-
+-    qemu_event_set(&cbevent);
+-}
+-
+-static void cocoa_clipboard_notify(Notifier *notifier, void *data)
+-{
+-    QemuClipboardNotify *notify = data;
+-
+-    switch (notify->type) {
+-    case QEMU_CLIPBOARD_UPDATE_INFO:
+-        cocoa_clipboard_update_info(notify->info);
+-        return;
+-    case QEMU_CLIPBOARD_RESET_SERIAL:
+-        /* ignore */
+-        return;
+-    }
+-}
+-
+-static void cocoa_clipboard_request(QemuClipboardInfo *info,
+-                                    QemuClipboardType type)
+-{
+-    NSData *text;
+-
+-    switch (type) {
+-    case QEMU_CLIPBOARD_TYPE_TEXT:
+-        text = [[NSPasteboard generalPasteboard] dataForType:NSPasteboardTypeString];
+-        if (text) {
+-            qemu_clipboard_set_data(&cbpeer, info, type,
+-                                    [text length], [text bytes], true);
+-            [text release];
+-        }
+-        break;
+-    default:
+-        break;
+-    }
+-}
+-
+ /*
+  * The startup process for the OSX/Cocoa UI is complicated, because
+  * OSX insists that the UI runs on the initial main thread, and so we
+@@ -1938,7 +1834,6 @@ static void cocoa_clipboard_request(QemuClipboardInfo *info,
+     COCOA_DEBUG("Second thread: calling qemu_main()\n");
+     status = qemu_main(gArgc, gArgv, *_NSGetEnviron());
+     COCOA_DEBUG("Second thread: qemu_main() returned, exiting\n");
+-    [cbowner release];
+     exit(status);
+ }
+ 
+@@ -2054,18 +1949,6 @@ static void cocoa_refresh(DisplayChangeListener *dcl)
+             [cocoaView setAbsoluteEnabled:YES];
+         });
+     }
+-
+-    if (cbchangecount != [[NSPasteboard generalPasteboard] changeCount]) {
+-        qemu_clipboard_info_unref(cbinfo);
+-        cbinfo = qemu_clipboard_info_new(&cbpeer, QEMU_CLIPBOARD_SELECTION_CLIPBOARD);
+-        if ([[NSPasteboard generalPasteboard] availableTypeFromArray:@[NSPasteboardTypeString]]) {
+-            cbinfo->types[QEMU_CLIPBOARD_TYPE_TEXT].available = true;
+-        }
+-        qemu_clipboard_update(cbinfo);
+-        cbchangecount = [[NSPasteboard generalPasteboard] changeCount];
+-        qemu_event_set(&cbevent);
+-    }
+-
+     [pool release];
+ }
+ 
+@@ -2105,10 +1988,6 @@ static void cocoa_display_init(DisplayState *ds, DisplayOptions *opts)
+ 
+     // register vga output callbacks
+     register_displaychangelistener(&dcl);
+-
+-    qemu_event_init(&cbevent, false);
+-    cbowner = [[QemuCocoaPasteboardTypeOwner alloc] init];
+-    qemu_clipboard_peer_register(&cbpeer);
+ }
+ 
+ static QemuDisplay qemu_display_cocoa = {
+-- 
+2.35.1
+
--- a/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
+++ b/pkgs/applications/virtualization/virtualbox/guest-additions/default.nix
@ -5,13 +5,9 @@ let
  version = virtualbox.version;
  xserverVListFunc = builtins.elemAt (lib.splitVersion xorg.xorgserver.version);

-  # Forced to 1.18 in <nixpkgs/nixos/modules/services/x11/xserver.nix>
-  # as it even fails to build otherwise.  Still, override this even here,
-  # in case someone does just a standalone build
-  # (not via videoDrivers = ["vboxvideo"]).
-  # It's likely to work again in some future update.
-  xserverABI = let abi = xserverVListFunc 0 + xserverVListFunc 1;
-    in if abi == "119" || abi == "120" then "118" else abi;
+  # Forced to 1.18; vboxvideo doesn't seem to provide any newer ABI,
+  # and nixpkgs doesn't support older ABIs anymore.
+  xserverABI = "118";

  # Specifies how to patch binaries to make sure that libraries loaded using
  # dlopen are found. We grep binaries for specific library names and patch
--- a/pkgs/build-support/testers/default.nix
+++ b/pkgs/build-support/testers/default.nix
@ -0,0 +1,4 @@
+{ pkgs, lib, callPackage }:
+{
+  testEqualDerivation = callPackage ./test-equal-derivation.nix { };
+}
--- a/pkgs/build-support/testers/test-equal-derivation.nix
+++ b/pkgs/build-support/testers/test-equal-derivation.nix
--- a/pkgs/data/misc/wireless-regdb/default.nix
+++ b/pkgs/data/misc/wireless-regdb/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "wireless-regdb";
-  version = "2021.08.28";
+  version = "2022.02.18";

  src = fetchurl {
    url = "https://www.kernel.org/pub/software/network/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-z/NwxBDR5tMWrgp/qKxieP3x78pdPWZKynz9Kq+lREY=";
+    sha256 = "sha256-iCjCWk7iUCAEQAT1c3S7nerIUoCfrXD409AXcL+ayX8=";
  };

  dontBuild = true;
--- a/pkgs/desktops/gnome/extensions/extensions.json
+++ b/pkgs/desktops/gnome/extensions/extensions.json
--- a/pkgs/development/beam-modules/erlang-ls/default.nix
+++ b/pkgs/development/beam-modules/erlang-ls/default.nix
@ -1,7 +1,7 @@
 { fetchFromGitHub, fetchgit, fetchHex, rebar3Relx, buildRebar3, rebar3-proper
 , stdenv, writeScript, lib }:
 let
-  version = "0.23.1";
+  version = "0.24.0";
  owner = "erlang-ls";
  repo = "erlang_ls";
  deps = import ./rebar-deps.nix {
@ -19,7 +19,7 @@ rebar3Relx {
  inherit version;
  src = fetchFromGitHub {
    inherit owner repo;
-    sha256 = "sha256-N0jkdzwNi9dx0dmN4qL+mb8S60OII4C/MnR/y8G3GUY=";
+    sha256 = "sha256-fKe6vsY40lexnkUP4PEsc53WFaUAw5LGLEC/zJauogg=";
    rev = version;
  };
  releaseType = "escript";
--- a/pkgs/development/compilers/cudatoolkit/versions.toml
+++ b/pkgs/development/compilers/cudatoolkit/versions.toml
@ -44,16 +44,16 @@ gcc = "gcc9"
 version = "11.4.2"
 url = "https://developer.download.nvidia.com/compute/cuda/11.4.2/local_installers/cuda_11.4.2_470.57.02_linux.run"
 sha256 = "sha256-u9h8oOkT+DdFSnljZ0c1E83e9VUILk2G7Zo4ZZzIHwo="
-gcc = "gcc10" # can bump to 11 along with stdenv.cc
+gcc = "gcc11"

 ["11.5"]
 version = "11.5.0"
 url = "https://developer.download.nvidia.com/compute/cuda/11.5.0/local_installers/cuda_11.5.0_495.29.05_linux.run"
 sha256 = "sha256-rgoWk9lJfPPYHmlIlD43lGNpANtxyY1Y7v2sr38aHkw="
-gcc = "gcc10" # can bump to 11 along with stdenv.cc
+gcc = "gcc11"

 ["11.6"]
 version = "11.6.1"
 url = "https://developer.download.nvidia.com/compute/cuda/11.6.1/local_installers/cuda_11.6.1_510.47.03_linux.run"
 sha256 = "sha256-qyGa/OALdCABEyaYZvv/derQN7z8I1UagzjCaEyYTX4="
-gcc = "gcc10" # can bump to 11 along with stdenv.cc
+gcc = "gcc11"
--- a/pkgs/development/libraries/faudio/default.nix
+++ b/pkgs/development/libraries/faudio/default.nix
@ -4,13 +4,13 @@

 stdenv.mkDerivation rec {
  pname = "faudio";
-  version = "21.10";
+  version = "22.02";

  src = fetchFromGitHub {
    owner = "FNA-XNA";
    repo = "FAudio";
    rev = version;
-    sha256 = "sha256-gh/QYH25j9A+XalW6ajRjs+yOYEfkZmw11CHjR6LK1E=";
+    sha256 = "sha256-qjXFpxoFF70aOaEq9/JfI2DtFxxHjyK2OnDaXMiqQMM=";
  };

  nativeBuildInputs = [cmake];
--- a/pkgs/development/ocaml-modules/ctypes/default.nix
+++ b/pkgs/development/ocaml-modules/ctypes/default.nix
@ -6,13 +6,13 @@ else

 stdenv.mkDerivation rec {
  pname = "ocaml${ocaml.version}-ctypes";
-  version = "0.18.0";
+  version = "0.20.0";

  src = fetchFromGitHub {
    owner = "ocamllabs";
    repo = "ocaml-ctypes";
    rev = version;
-    sha256 = "sha256-eu5RAuPYC97IM4XUsUw3HQ1BJlEHQ+eBpsdUE6hd+Q8=";
+    sha256 = "sha256-fr60H/hiSVjEg11qM8LF1Y5CotS3FEyFdCcIh0A0uI4=";
  };

  nativeBuildInputs = [ pkg-config ocaml findlib ];
--- a/pkgs/development/python-modules/aiohomekit/default.nix
+++ b/pkgs/development/python-modules/aiohomekit/default.nix
@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "aiohomekit";
-  version = "0.7.16";
+  version = "0.7.17";
  format = "pyproject";

  disabled = pythonOlder "3.7";
@ -20,8 +20,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "Jc2k";
    repo = pname;
-    rev = version;
-    sha256 = "sha256-dakxPhnI1m6KiOj6oQkfQ0UVA7NEBTHFGYnF6L6c8Ck=";
+    rev = "refs/tags/${version}";
+    sha256 = "sha256-vgRiqA3xNvuw3nIzl45RXdmcbDW6OTxvReSH5SVcNEs=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
+++ b/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
@ -18,7 +18,7 @@

 buildPythonPackage rec {
  pname = "cyclonedx-python-lib";
-  version = "2.2.0";
+  version = "2.3.0";
  format = "pyproject";

  disabled = pythonOlder "3.9";
@ -26,8 +26,8 @@ buildPythonPackage rec {
  src = fetchFromGitHub {
    owner = "CycloneDX";
    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-QylA3bf0P65prR74H5+Sm51xWjjhOYpe4jHX7m/f6mI=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-eZy+m6AkSlZM/i64FyFL+ZgeW86MOSM6sDYPT4ckaHE=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/dragonfly/default.nix
+++ b/pkgs/development/python-modules/dragonfly/default.nix
@ -24,13 +24,13 @@

 buildPythonPackage rec {
  pname = "dragonfly";
-  version = "0.32.0";
+  version = "0.35.0";

  src = fetchFromGitHub {
    owner = "dictation-toolbox";
    repo = pname;
    rev = version;
-    sha256 = "BUbIhc8as/DVx8/4VeQS9emOLGcWFujNCxesSEEBqKQ=";
+    sha256 = "sha256-sqEEEr5/KG3cn4rmOGJt9zMNAjeLO6h3NJgg0EyewrM=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/faraday-plugins/default.nix
+++ b/pkgs/development/python-modules/faraday-plugins/default.nix
@ -16,14 +16,14 @@

 buildPythonPackage rec {
  pname = "faraday-plugins";
-  version = "1.6.2";
+  version = "1.6.3";
  format = "setuptools";

  src = fetchFromGitHub {
    owner = "infobyte";
    repo = "faraday_plugins";
-    rev = "v${version}";
-    sha256 = "sha256-1YROdQvwfV5Wp7vsNYCy2X6yR6mplunchD0U4xGUNBc=";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-oynDX1miBvBmiN22ILQH1Q2y+PmWOfBunjZmVSnlvKk=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/flask-admin/default.nix
+++ b/pkgs/development/python-modules/flask-admin/default.nix
@ -62,6 +62,11 @@ buildPythonPackage rec {
    wtf-peewee
  ];

+  disabledTests = [
+    # Incompatible with werkzeug 2.1
+    "test_mockview"
+  ];
+
  disabledTestPaths = [
    # Tests have additional requirements
    "flask_admin/tests/geoa/test_basic.py"
--- a/pkgs/development/python-modules/flask-bcrypt/default.nix
+++ b/pkgs/development/python-modules/flask-bcrypt/default.nix
@ -8,13 +8,13 @@

 buildPythonPackage rec {
  pname = "flask-bcrypt";
-  version = "0.7.1";
+  version = "1.0.1";

  src = fetchFromGitHub {
    owner = "maxcountryman";
    repo = pname;
    rev = version;
-    sha256 = "0036gag3nj7fzib23lbbpwhlrn1s0kkrfwk5pd90y4cjcfqh8z9x";
+    sha256 = "sha256-WlIholi/nzq6Ikc0LS6FhG0Q5Kz0kvvAlA2YJ7EksZ4=";
  };

  propagatedBuildInputs = [
@ -23,9 +23,15 @@ buildPythonPackage rec {
  ];

  checkPhase = ''
-    ${python.interpreter} test_bcrypt.py
+    runHook preCheck
+    ${python.interpreter} -m unittest discover
+    runHook postCheck
  '';

+  pythonImportsCheck = [
+    "flask_bcrypt"
+  ];
+
  meta = with lib; {
    description = "Brcrypt hashing for Flask";
    homepage = "https://github.com/maxcountryman/flask-bcrypt";
--- a/pkgs/development/python-modules/flask-seasurf/default.nix
+++ b/pkgs/development/python-modules/flask-seasurf/default.nix
@ -1,19 +1,29 @@
-{ lib, fetchFromGitHub, buildPythonPackage, isPy3k, flask }:
+{ lib, fetchFromGitHub, buildPythonPackage, isPy3k, flask, mock, python }:

 buildPythonPackage rec {
  pname = "Flask-SeaSurf";
-  version = "0.3.0";
+  version = "1.1.1";
  disabled = !isPy3k;

  src = fetchFromGitHub {
    owner = "maxcountryman";
    repo = "flask-seasurf";
    rev = version;
-    sha256 = "02hsvppsz1d93v641f14fdnd22gbc12ilc9k9kn7wl119n5s3pd8";
+    sha256 = "sha256-L/ZUEqqHmsyXG5eShcITII36ttwQlZN5GBngo+GcCdw=";
  };

  propagatedBuildInputs = [ flask ];

+  checkInputs = [
+    mock
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+    ${python.interpreter} -m unittest discover
+    runHook postCheck
+  '';
+
  pythonImportsCheck = [ "flask_seasurf" ];

  meta = with lib; {
--- a/pkgs/development/python-modules/flask-security-too/default.nix
+++ b/pkgs/development/python-modules/flask-security-too/default.nix
@ -43,12 +43,12 @@

 buildPythonPackage rec {
  pname = "flask-security-too";
-  version = "4.1.3";
+  version = "4.1.4";

  src = fetchPypi {
    pname = "Flask-Security-Too";
    inherit version;
-    sha256 = "sha256-mW2NKGeJpyR4Ri7m+KE3ElSg3E+P7qbzNTTCo3cskc8=";
+    sha256 = "sha256-j6My1CD+GY2InHlN0IXPcNqfq+ytdoDD3y+5s2o3WRI=";
  };

  propagatedBuildInputs = [
@ -98,28 +98,6 @@ buildPythonPackage rec {
  ++ passthru.extras-require.fsqla
  ++ passthru.extras-require.mfa;

-  disabledTests = [
-    # flask 2.1.0 incompatibilities https://github.com/Flask-Middleware/flask-security/issues/594
-    "test_admin_setup_reset"
-    "test_authn_freshness"
-    "test_authn_freshness_nc"
-    "test_bad_sender"
-    "test_change_invalidates_auth_token"
-    "test_change_invalidates_session"
-    "test_default_authn_bp"
-    "test_default_unauthn"
-    "test_default_unauthn_bp"
-    "test_email_not_identity"
-    "test_next"
-    "test_post_security_with_application_root"
-    "test_post_security_with_application_root_and_views"
-    "test_recover_invalidates_session"
-    "test_two_factor_flag"
-    "test_unauthorized_access_with_referrer"
-    "test_verify"
-    "test_verify_link"
-    "test_view_configuration"
-  ];

  pythonImportsCheck = [ "flask_security" ];

--- a/pkgs/development/python-modules/geoalchemy2/default.nix
+++ b/pkgs/development/python-modules/geoalchemy2/default.nix
@ -34,6 +34,12 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

+  pytestFlagsArray = [
+    # tests require live postgis database
+    "--deselect=tests/test_pickle.py::TestPickle::test_pickle_unpickle"
+    "--deselect=tests/gallery/test_specific_compilation.py::test_specific_compilation"
+  ];
+
  disabledTestPaths = [
    # tests require live postgis database
    "tests/gallery/test_decipher_raster.py"
@ -41,6 +47,11 @@ buildPythonPackage rec {
    "tests/gallery/test_summarystatsagg.py"
    "tests/gallery/test_type_decorator.py"
    "tests/test_functional.py"
+    "tests/test_functional_postgresql.py"
+  ];
+
+  pythonImportsCheck = [
+    "geoalchemy2"
  ];

  meta = with lib; {
--- a/pkgs/development/python-modules/gym/default.nix
+++ b/pkgs/development/python-modules/gym/default.nix
@ -7,13 +7,13 @@

 buildPythonPackage rec {
  pname = "gym";
-  version = "0.22.0";
+  version = "0.21.0";

  src = fetchFromGitHub {
    owner = "openai";
    repo = pname;
-    rev = version;
-    sha256 = "sha256-JbPWLuQGo+fErUlCKKpMwWdu0KvXBDuH2MeAHdJCTgM=";
+    rev = "v${version}";
+    sha256 = "12b545xz0r2g4z5r7f8amxl7nm0lqymkzwcwhg1bni9h0sxwpv6c";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/kaldi-active-grammar/default.nix
+++ b/pkgs/development/python-modules/kaldi-active-grammar/default.nix
@ -5,6 +5,7 @@
 , cmake
 , ush
 , requests
+, six
 , numpy
 , cffi
 , openfst
@ -12,6 +13,11 @@
 , callPackage
 }:

+#
+# Maintainer note: only in-tree dependant is `dragonfly`, try to
+# update the two alongside eachother.
+#
+
 let
  kaldi = callPackage ./fork.nix { };
 in
@ -48,7 +54,7 @@ buildPythonPackage rec {

  buildInputs = [ openfst kaldi ];
  nativeBuildInputs = [ scikit-build cmake ];
-  propagatedBuildInputs = [ ush requests numpy cffi ];
+  propagatedBuildInputs = [ ush requests numpy cffi six ];

  doCheck = false;  # no tests exist

--- a/pkgs/development/python-modules/kbcstorage/default.nix
+++ b/pkgs/development/python-modules/kbcstorage/default.nix
@ -0,0 +1,69 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+
+# build
+, setuptools-scm
+
+# propagates
+, azure-storage-blob
+, boto3
+, requests
+
+# tests
+, responses
+, python
+}:
+
+buildPythonPackage rec {
+    pname = "sapi-python-client";
+    version = "0.4.1";
+    format = "setuptools";
+
+    src = fetchFromGitHub {
+      owner = "keboola";
+      repo = pname;
+      rev  = version;
+      sha256 = "189dzj06vzp7366h2qsfvbjmw9qgl7jbp8syhynn9yvrjqp4k8h3";
+    };
+
+    SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+    nativeBuildInputs = [
+      setuptools-scm
+    ];
+
+    propagatedBuildInputs = [
+      azure-storage-blob
+      boto3
+      requests
+    ];
+
+    # requires API token and an active keboola bucket
+    # ValueError: Root URL is required.
+    doCheck = false;
+
+    checkInputs = [
+      responses
+    ];
+
+    checkPhase = ''
+      runHook preCheck
+      ${python.interpreter} -m unittest discover
+      runHook postCheck
+    '';
+
+    pythonImportsCheck = [
+      "kbcstorage"
+      "kbcstorage.buckets"
+      "kbcstorage.client"
+      "kbcstorage.tables"
+    ];
+
+    meta = with lib; {
+      description = "Keboola Connection Storage API client";
+      homepage = "https://github.com/keboola/sapi-python-client";
+      maintainers = with maintainers; [ mrmebelman ];
+      license = licenses.mit;
+    };
+}
--- a/pkgs/development/python-modules/pixcat/default.nix
+++ b/pkgs/development/python-modules/pixcat/default.nix
@ -0,0 +1,38 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, blessed
+, docopt
+, pillow
+, requests
+, dataclasses
+, pythonOlder
+}:
+
+buildPythonPackage rec {
+  pname = "pixcat";
+  version = "0.1.4";
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "657c8fe04513caecccd6086b347aa4b85db6b4c0f761b162cb9cd789abe7abb6";
+  };
+
+  propagatedBuildInputs = [
+    blessed
+    docopt
+    pillow
+    requests
+  ];
+
+  pythonImportsCheck = [ "pixcat" ];
+
+  meta = with lib; {
+    description = "Display images on a kitty terminal with optional resizing";
+    homepage = "https://github.com/mirukan/pixcat";
+    license = licenses.lgpl3;
+    maintainers = [ maintainers.tilcreator ];
+  };
+}
--- a/pkgs/development/python-modules/pyfaidx/default.nix
+++ b/pkgs/development/python-modules/pyfaidx/default.nix
@ -5,6 +5,7 @@
 , numpy
 , setuptools-scm
 , six
+, glibcLocales
 , pytestCheckHook
 }:

@ -27,16 +28,15 @@ buildPythonPackage rec {
  ];

  checkInputs = [
+    glibcLocales
    nose
    numpy
    pytestCheckHook
  ];

-  disabledTests = [
-    # PyPI releases don't ship all the needed files for the tests
-    "test_index_zero_length"
-    "test_fetch_zero_length"
-    "test_read_back_index"
+  disabledTestPaths = [
+    # FileNotFoundError: [Errno 2] No such file or directory: 'data/genes.fasta.gz'
+    "tests/test_Fasta_bgzip.py"
  ];

  pythonImportsCheck = [
--- a/pkgs/development/python-modules/pytest-testmon/default.nix
+++ b/pkgs/development/python-modules/pytest-testmon/default.nix
@ -16,16 +16,11 @@ buildPythonPackage rec {
    sha256 = "sha256-6gWWCtm/GHknhjLyRdVf42koeaSKzk5/V0173DELmj0=";
  };

-  propagatedBuildInputs = [ coverage ];
+  propagatedBuildInputs = [ pytest coverage ];

-  checkInputs = [ pytest ];
-
-  # avoid tests which try to import unittest_mixins
-  # unittest_mixins doesn't seem to be very active
-  checkPhase = ''
-    cd test
-    pytest test_{core,process_code,pytest_assumptions}.py
-  '';
+  # The project does not include tests since version 1.3.0
+  doCheck = false;
+  pythonImportsCheck = [ "testmon" ];

  meta = with lib; {
    homepage = "https://github.com/tarpas/pytest-testmon/";
--- a/pkgs/development/python-modules/python-miio/default.nix
+++ b/pkgs/development/python-modules/python-miio/default.nix
@ -1,24 +1,24 @@
 { lib
-, buildPythonPackage
-, pythonOlder
-, fetchPypi
-, poetry-core
-, click
-, cryptography
-, construct
-, zeroconf
-, attrs
-, pytz
-, appdirs
-, tqdm
-, netifaces
 , android-backup
-, importlib-metadata
+, appdirs
+, attrs
+, buildPythonPackage
+, click
+, construct
 , croniter
+, cryptography
 , defusedxml
-, pytestCheckHook
+, fetchPypi
+, importlib-metadata
+, netifaces
+, poetry-core
 , pytest-mock
+, pytestCheckHook
+, pythonOlder
+, pytz
 , pyyaml
+, tqdm
+, zeroconf
 }:


@ -57,13 +57,16 @@ buildPythonPackage rec {
  ];

  checkInputs = [
-    pytestCheckHook
    pytest-mock
+    pytestCheckHook
  ];

  postPatch = ''
    substituteInPlace pyproject.toml \
-      --replace 'defusedxml = "^0"' 'defusedxml = "*"' \
+      --replace 'defusedxml = "^0"' 'defusedxml = "*"'
+    # Will be fixed with the next release, https://github.com/rytilahti/python-miio/pull/1378
+    substituteInPlace miio/integrations/vacuum/roborock/vacuum_cli.py \
+      --replace "resultcallback" "result_callback"
  '';

  pythonImportsCheck = [
--- a/pkgs/development/python-modules/python-vagrant/default.nix
+++ b/pkgs/development/python-modules/python-vagrant/default.nix
@ -3,6 +3,7 @@
 buildPythonPackage rec {
  version = "1.0.0";
  pname = "python-vagrant";
+  format = "pyproject";

  src = fetchPypi {
    inherit pname version;
@ -12,6 +13,10 @@ buildPythonPackage rec {
  # The tests try to connect to qemu
  doCheck = false;

+  pythonImportsCheck = [
+    "vagrant"
+  ];
+
  meta = {
    description = "Python module that provides a thin wrapper around the vagrant command line executable";
    homepage = "https://github.com/todddeluca/python-vagrant";
--- a/pkgs/development/python-modules/radio_beam/default.nix
+++ b/pkgs/development/python-modules/radio_beam/default.nix
@ -3,14 +3,17 @@
 , buildPythonPackage
 , setuptools-scm
 , astropy
+, numpy
+, scipy
+, six
 , pytestCheckHook
 , pytest-doctestplus
-, scipy
 }:

 buildPythonPackage rec {
  pname = "radio_beam";
  version = "0.3.3";
+  format = "pyproject";

  src = fetchPypi {
    inherit version;
@ -22,9 +25,17 @@ buildPythonPackage rec {
    setuptools-scm
  ];

-  propagatedBuildInputs = [ astropy ];
+  propagatedBuildInputs = [
+    astropy
+    numpy
+    scipy
+    six
+  ];

-  checkInputs = [ pytestCheckHook pytest-doctestplus scipy ];
+  checkInputs = [
+    pytestCheckHook
+    pytest-doctestplus
+  ];

  # Tests must be run in the build directory
  preCheck = ''
--- a/pkgs/development/python-modules/sapi-python-client/default.nix
+++ b/pkgs/development/python-modules/sapi-python-client/default.nix
@ -1,30 +0,0 @@
-{ lib, git, setuptools, setuptools-scm, fetchFromGitHub, requests, boto3, buildPythonPackage, responses }:
-
-buildPythonPackage rec {
-    pname = "sapi-python-client";
-    version = "0.4.1";
-
-    src = fetchFromGitHub {
-        owner = "keboola";
-        repo = pname;
-        rev  = version;
-        sha256 = "189dzj06vzp7366h2qsfvbjmw9qgl7jbp8syhynn9yvrjqp4k8h3";
-    };
-
-    postPatch = ''
-        sed -i 's|use_scm_version=True|version="${version}"|' setup.py
-    '';
-
-    doCheck = false; # requires API token and an active keboola bucket
-
-    nativeBuildInputs = [ git setuptools-scm ];
-
-    propagatedBuildInputs = [ setuptools requests boto3 responses ];
-
-    meta = with lib; {
-        description = "Keboola Connection Storage API client";
-        homepage = "https://github.com/keboola/sapi-python-client";
-        maintainers = with maintainers; [ mrmebelman ];
-        license = licenses.mit;
-    };
-}
--- a/pkgs/development/python-modules/sendgrid/default.nix
+++ b/pkgs/development/python-modules/sendgrid/default.nix
@ -7,6 +7,7 @@
 , pythonOlder
 , pyyaml
 , starkbank-ecdsa
+, six
 , werkzeug
 }:

@ -27,6 +28,7 @@ buildPythonPackage rec {
  propagatedBuildInputs = [
    python-http-client
    starkbank-ecdsa
+    six
  ];

  checkInputs = [
--- a/pkgs/development/python-modules/shtab/default.nix
+++ b/pkgs/development/python-modules/shtab/default.nix
@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "shtab";
-  version = "1.5.3";
+  version = "1.5.4";
  format = "setuptools";

  disabled = pythonOlder "3.7";
@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "iterative";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Wuc4m3VdOGEcevYXUpbL4gTvyW9t13pj57zPYdqx0UY=";
+    hash = "sha256-MYLAQSz55913fOhRnH+Y9xugOdfO43gkavitazIgeqg=";
  };

  SETUPTOOLS_SCM_PRETEND_VERSION = version;
--- a/pkgs/development/tools/metal-cli/default.nix
+++ b/pkgs/development/tools/metal-cli/default.nix
@ -2,23 +2,29 @@

 buildGoModule rec {
  pname = "metal-cli";
-  version = "0.7.3";
+  version = "0.7.4";

  src = fetchFromGitHub {
    owner = "equinix";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-PsTQuEbo1ReWwZV4D14mEGsU99j49kleiL/6Xyk+g9s=";
+    sha256 = "sha256-muhHBUb5Ttj4n6fJzIJMqics5rKupeSBZAd4JxZUe64=";
  };

-  ldflags = [
-    "-X github.com/equinix/metal-cli/cmd.Version=${version}"
-  ];
-
  vendorSha256 = "sha256-F8d5i9jvjY11Pv6w0ZXI3jr0Wix++B/w9oRTuJGpQfE=";

+  ldflags = [
+    "-s" "-w"
+    "-X github.com/equinix/metal-cli/cmd.Version=${version}"
+  ];
+
  doCheck = false;

+  doInstallCheck = true;
+  installCheckPhase = ''
+      $out/bin/metal --version | grep ${version}
+  '';
+
  meta = with lib; {
    description = "Official Equinix Metal CLI";
    homepage = "https://github.com/equinix/metal-cli/";
--- a/pkgs/development/tools/misc/sccache/default.nix
+++ b/pkgs/development/tools/misc/sccache/default.nix
@ -16,7 +16,8 @@ rustPlatform.buildRustPackage rec {
  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ openssl ] ++ lib.optional stdenv.isDarwin Security;

-  buildFeatures = lib.optionals (!stdenv.isDarwin) [ "dist-client" "dist-server" ];
+  # sccache-dist is only supported on x86_64 Linux machines.
+  buildFeatures = lib.optionals (stdenv.system == "x86_64-linux") [ "dist-client" "dist-server" ];

  # Tests fail because of client server setup which is not possible inside the pure environment,
  # see https://github.com/mozilla/sccache/issues/460
--- a/pkgs/development/tools/richgo/default.nix
+++ b/pkgs/development/tools/richgo/default.nix
@ -13,10 +13,6 @@ buildGoModule rec {

  vendorSha256 = "sha256-O63QEo0/+m9cYktMg4+RloLuUfAlCG0eGkxpHPFg/Cw=";

-  doCheck = false;
-
-  subPackages = [ "." ];
-
  meta = with lib; {
    description = "Enrich `go test` outputs with text decorations";
    homepage = "https://github.com/kyoh86/richgo";
--- a/pkgs/development/web/minify/default.nix
+++ b/pkgs/development/web/minify/default.nix
@ -2,18 +2,16 @@

 buildGoModule rec {
  pname = "minify";
-  version = "2.10.0";
+  version = "2.11.1";

  src = fetchFromGitHub {
    owner = "tdewolff";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-4wF9bRLrGQftw54b+HrsoJOGsTRTNYVDEMsKsFqnHGY=";
+    sha256 = "sha256-qna2u+Y4eRGLNvRKDbL/VQud1pn8b1wWzbKQM1p0Yws=";
  };

-  vendorSha256 = "sha256-4aoDQKMhczy1u4Eq567aMrFVIBW2L8OgNCqsgmUN6CI=";
-
-  doCheck = false;
+  vendorSha256 = "sha256-stj3fOaPM70kF6vTX/DEs4qFq/O0Vq0TFw0J/3L5NmA=";

  ldflags = [ "-s" "-w" "-X main.Version=${version}" ];

@ -21,5 +19,6 @@ buildGoModule rec {
    description = "Minifiers for web formats";
    license = licenses.mit;
    homepage = "https://go.tacodewolff.nl/minify";
+    downloadPage = "https://github.com/tdewolff/minify";
  };
 }
--- a/pkgs/games/unciv/default.nix
+++ b/pkgs/games/unciv/default.nix
@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "unciv";
-  version = "3.19.12";
+  version = "3.19.14";

  src = fetchurl {
    url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    sha256 = "sha256-PALrOyaUYXyNH+QdE8oy1TM5U4SZjw1N0NJ2BKiqjtU=";
+    sha256 = "sha256-Q0OiXjqZ6RmQg3Ob6k4NjaHsc+K50a0bAGBaaaUcP3I=";
  };

  dontUnpack = true;
--- a/pkgs/servers/gerbera/default.nix
+++ b/pkgs/servers/gerbera/default.nix
@ -65,13 +65,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "gerbera";
-  version = "1.9.2";
+  version = "1.10.0";

  src = fetchFromGitHub {
    repo = "gerbera";
    owner = "gerbera";
    rev = "v${version}";
-    sha256 = "sha256-uLHiGuBXYafpY1/Q4qWFt1CTHKW7vqq0o/zqIEbEZqs=";
+    sha256 = "sha256-z/w0/iuZ0GIYmDWUmqK+1l3GNNFWhkZCWqXhvjgLjgY=";
  };

  postPatch = lib.optionalString enableMysql ''
--- a/pkgs/servers/web-apps/jitsi-meet/default.nix
+++ b/pkgs/servers/web-apps/jitsi-meet/default.nix
@ -2,11 +2,11 @@

 stdenv.mkDerivation rec {
  pname = "jitsi-meet";
-  version = "1.0.5818";
+  version = "1.0.5913";

  src = fetchurl {
    url = "https://download.jitsi.org/jitsi-meet/src/jitsi-meet-${version}.tar.bz2";
-    sha256 = "oVZoYEkYQd8dy1m0+1i/uIQ/gRipvJBXmgYphbBhicY=";
+    sha256 = "NQxGkwEqnrOrkB+Rtka1n1SDqcQqp7epmDBuXKR/qFQ=";
  };

  dontBuild = true;
--- a/pkgs/shells/zsh/oh-my-zsh/default.nix
+++ b/pkgs/shells/zsh/oh-my-zsh/default.nix
@ -5,15 +5,15 @@
 , git, nix, nixfmt, jq, coreutils, gnused, curl, cacert }:

 stdenv.mkDerivation rec {
-  version = "2022-04-18";
+  version = "2022-04-19";
  pname = "oh-my-zsh";
-  rev = "ed411d3ff196e32844409ebe0f8b3e21b0b1c9f6";
+  rev = "a26d72baa27a46cfd2f35afa789529dccf7fc212";

  src = fetchFromGitHub {
    inherit rev;
    owner = "ohmyzsh";
    repo = "ohmyzsh";
-    sha256 = "j38odMVj/NT9qGf06RLREmEXQRsvR2UGSlzRxtn+C8E=";
+    sha256 = "PwHE8PDvZ4fRBAq4wxgXc7FS6Q6Se6ICYDrwBaxKV1Q=";
  };

  installPhase = ''
--- a/pkgs/tools/admin/awscli2/default.nix
+++ b/pkgs/tools/admin/awscli2/default.nix
@ -8,24 +8,20 @@ let
  py = python3.override {
    packageOverrides = self: super: {
      awscrt = super.awscrt.overridePythonAttrs (oldAttrs: rec {
-        version = "0.12.4";
+        version = "0.13.5";
        src = self.fetchPypi {
          inherit (oldAttrs) pname;
          inherit version;
-          sha256 = "sha256:1cmfkcv2zzirxsb989vx1hvna9nv24pghcvypl0zaxsjphv97mka";
+          sha256 = "sha256-dUNljMKsbl6eByhEYivWgRJczTBw3N1RVl8r3e898mg=";
        };
      });
-
-      botocore = super.botocore.overridePythonAttrs (oldAttrs: rec {
-        # Releases: https://github.com/boto/botocore/commits/v2
-        version = "2.0.0dev155";
-        src = fetchFromGitHub {
-          owner = "boto";
-          repo = "botocore";
-          rev = "7083e5c204e139dc41f646e0ad85286b5e7c0c23";
-          sha256 = "sha256-aiCc/CXoTem0a9wI/AMBRK3g2BXJi7LpnUY/BxBEKVM=";
+      jmespath = super.jmespath.overridePythonAttrs (oldAttrs: rec {
+        version = "0.10.0";
+        src = self.fetchPypi {
+          inherit (oldAttrs) pname;
+          inherit version;
+          sha256 = "sha256-uF0FZ7hmYUmpMXJxLmiSBzQzPAzn6Jt4s+mH9x5e1Pk=";
        };
-        propagatedBuildInputs = super.botocore.propagatedBuildInputs ++ [ py.pkgs.awscrt ];
      });
    };
  };
@ -33,19 +29,18 @@ let
 in
 with py.pkgs; buildPythonApplication rec {
  pname = "awscli2";
-  version = "2.4.23"; # N.B: if you change this, change botocore to a matching version too
+  version = "2.5.6"; # N.B: if you change this, check if overrides are still up-to-date

  src = fetchFromGitHub {
    owner = "aws";
    repo = "aws-cli";
    rev = version;
-    sha256 = "sha256-zpkphlIfmexqZm0lZgDP3RoQJqTpFdT+5dGtaLiRr/U=";
+    sha256 = "sha256-NANdm2RK4U5sXPuGbC8KUGXsbYl/WwAoUep4JxJA5lI=";
  };

  propagatedBuildInputs = [
    awscrt
    bcdoc
-    botocore
    colorama
    cryptography
    distro
@ -57,6 +52,9 @@ with py.pkgs; buildPythonApplication rec {
    rsa
    ruamel-yaml
    wcwidth
+    dateutil
+    jmespath
+    urllib3
  ];

  checkInputs = [
--- a/pkgs/tools/security/maigret/default.nix
+++ b/pkgs/tools/security/maigret/default.nix
@ -5,13 +5,13 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "maigret";
-  version = "0.4.1";
+  version = "0.4.2";

  src = fetchFromGitHub {
    owner = "soxoj";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0igfxg238awdn1ly8s3r655yi3gpxink7g2hr6xb0c1nrm7z0kad";
+    sha256 = "sha256-XML7sb/dhMX9i8GzOezanVTFha73v2m1OVOYvSOelNQ=";
  };

  propagatedBuildInputs = with python3.pkgs; [
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -904,6 +904,8 @@ with pkgs;
  # lib functions depending on pkgs
  inherit (import ../pkgs-lib { inherit lib pkgs; }) formats;

+  testers = callPackage ../build-support/testers {};
+
  ### TOOLS

  _3llo = callPackage ../tools/misc/3llo { };
@ -3577,7 +3579,12 @@ with pkgs;
    inherit (darwin.apple_sdk.frameworks) Security;
  };

-  gpu-burn = callPackage ../applications/misc/gpu-burn { };
+  gpu-burn = callPackage ../applications/misc/gpu-burn {
+    # gpu-burn doesn't build on gcc11. CUDA 11.3 is the last version to use
+    # pre-gcc11, in particular gcc9.
+    cudatoolkit = cudaPackages_11_3.cudatoolkit;
+    stdenv = gcc9Stdenv;
+  };

  greg = callPackage ../applications/audio/greg {
    pythonPackages = python3Packages;
@ -4011,6 +4018,8 @@ with pkgs;
    inherit (darwin.apple_sdk.frameworks) SystemConfiguration;
  };

+  pixcat = with python3Packages; toPythonApplication pixcat;
+
  pixiecore = callPackage ../tools/networking/pixiecore {};

  waitron = callPackage ../tools/networking/waitron {};
@ -10650,8 +10659,6 @@ with pkgs;

  termplay = callPackage ../tools/misc/termplay { };

-  testEqualDerivation = callPackage ../build-support/test-equal-derivation.nix { };
-
  tetrd = callPackage ../applications/networking/tetrd { };

  tewisay = callPackage ../tools/misc/tewisay { };
@ -23097,6 +23104,10 @@ with pkgs;

  librealsenseWithCuda = callPackage ../development/libraries/librealsense {
    cudaSupport = true;
+    # librealsenseWithCuda doesn't build on gcc11. CUDA 11.3 is the last version
+    # to use pre-gcc11, in particular gcc9.
+    cudaPackages = cudaPackages_11_3;
+    stdenv = gcc9Stdenv;
  };

  librealsenseWithoutCuda = callPackage ../development/libraries/librealsense {
@ -32975,12 +32986,28 @@ with pkgs;
  ifstat-legacy = callPackage ../tools/networking/ifstat-legacy { };

  isabelle = callPackage ../applications/science/logic/isabelle {
-    polyml = lib.overrideDerivation polyml (_: {
+    polyml = polyml.overrideAttrs (_: {
+      pname = "polyml-for-isabelle";
+      version = "2021-1";
      configureFlags = [ "--enable-intinf-as-int" "--with-gmp" "--disable-shared" ];
+      buildFlags = [ "compiler" ];
+      src = fetchFromGitHub {
+        owner = "polyml";
+        repo = "polyml";
+        rev = "39d96a2def903ed019c6855e3b688df5070d633a";
+        sha256 = "sha256-S7d2Vr/nB+rCX9d4qQj4f7edVZKocKIjc5rrx9A/B4Q=";
+      };
    });

    java = openjdk17;
-    z3 = z3_4_4_0;
+    z3 = z3_4_4_0.overrideAttrs (_: {
+      src = fetchFromGitHub {
+        owner = "Z3Prover";
+        repo = "z3";
+        rev = "0482e7fe727c75e259ac55a932b28cf1842c530e";
+        sha256 = "1m53avlljxqd2p8w266ksmjywjycsd23h224yn786qsnf36dr63x";
+      };
+    });
  };
  isabelle-components = recurseIntoAttrs (callPackage ../applications/science/logic/isabelle/components { });

--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@ -121,6 +121,7 @@ mapAliases ({
  ruamel_base = ruamel-base; # added 2021-11-01
  ruamel_yaml = ruamel-yaml; # added 2021-11-01
  ruamel_yaml_clib = ruamel-yaml-clib; # added 2021-11-01
+  sapi-python-client = kbcstorage; # added 2022-04-20
  scikitlearn = scikit-learn; # added 2021-07-21
  selectors34 = throw "selectors34 has been removed: functionality provided by Python itself; archived by upstream."; # added 2021-06-10
  setuptools_scm = setuptools-scm; # added 2021-06-03
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@ -1958,7 +1958,11 @@ in {

  cufflinks = callPackage ../development/python-modules/cufflinks { };

-  cupy = callPackage ../development/python-modules/cupy { };
+  cupy = callPackage ../development/python-modules/cupy {
+    # cupy doesn't build on gcc11. CUDA 11.3 is the last version to use
+    # pre-gcc11, in particular gcc9.
+    cudaPackages = pkgs.cudaPackages_11_3;
+  };

  curio = callPackage ../development/python-modules/curio { };

@ -4243,20 +4247,23 @@ in {

  jaxlib-bin = callPackage ../development/python-modules/jaxlib/bin.nix {
    cudaSupport = pkgs.config.cudaSupport or false;
-    inherit (self.tensorflow) cudaPackages;
+    # At the time of writing (2022-04-18), `cudaPackages.nccl` is broken, so we
+    # pin to `cudaPackages_11_6` instead.
+    cudaPackages = pkgs.cudaPackages_11_6;
  };

  jaxlib-build = callPackage ../development/python-modules/jaxlib {
    # Some platforms don't have `cudaSupport` defined, hence the need for 'or false'.
    cudaSupport = pkgs.config.cudaSupport or false;
-    inherit (self.tensorflow) cudaPackages;
+    # At the time of writing (2022-04-18), `cudaPackages.nccl` is broken, so we
+    # pin to `cudaPackages_11_6` instead.
+    cudaPackages = pkgs.cudaPackages_11_6;
  };

  jaxlib = self.jaxlib-build;

  jaxlibWithCuda = self.jaxlib-build.override {
    cudaSupport = true;
-
  };

  jaxlibWithoutCuda = self.jaxlib-build.override {
@ -4485,6 +4492,8 @@ in {

  kazoo = callPackage ../development/python-modules/kazoo { };

+  kbcstorage = callPackage ../development/python-modules/kbcstorage { };
+
  kconfiglib = callPackage ../development/python-modules/kconfiglib { };

  keep = callPackage ../development/python-modules/keep { };
@ -6189,6 +6198,8 @@ in {

  pdunehd = callPackage ../development/python-modules/pdunehd { };

+  pixcat = callPackage ../development/python-modules/pixcat { };
+
  pyprecice = callPackage ../development/python-modules/pyprecice { };

  phonopy = callPackage ../development/python-modules/phonopy { };
@ -9088,8 +9099,6 @@ in {

  sanic-testing = callPackage ../development/python-modules/sanic-testing { };

-  sapi-python-client = callPackage ../development/python-modules/sapi-python-client { };
-
  sarif-om = callPackage ../development/python-modules/sarif-om { };

  sarge = callPackage ../development/python-modules/sarge { };