Merge master into haskell-updates

2021-08-02 00:05:43 +00:00
parent 9980dffc9b 49fcc13e14
commit 3b93976ebe
98 changed files with 1202 additions and 443 deletions
@@ -26,22 +26,22 @@ let

    # Linux
    "aarch64-linux" "armv5tel-linux" "armv6l-linux" "armv7a-linux"
-    "armv7l-linux" "i686-linux" "mipsel-linux" "powerpc64-linux"
-    "powerpc64le-linux" "riscv32-linux" "riscv64-linux" "x86_64-linux"
-    "m68k-linux" "s390-linux"
+    "armv7l-linux" "i686-linux" "m68k-linux" "mipsel-linux"
+    "powerpc64-linux" "powerpc64le-linux" "riscv32-linux"
+    "riscv64-linux" "s390-linux" "x86_64-linux"

    # MMIXware
    "mmix-mmixware"

    # NetBSD
    "aarch64-netbsd" "armv6l-netbsd" "armv7a-netbsd" "armv7l-netbsd"
-    "i686-netbsd" "mipsel-netbsd" "powerpc-netbsd" "riscv32-netbsd"
-    "riscv64-netbsd" "x86_64-netbsd"
+    "i686-netbsd" "m68k-netbsd" "mipsel-netbsd" "powerpc-netbsd"
+    "riscv32-netbsd" "riscv64-netbsd" "x86_64-netbsd"

    # none
-    "aarch64-none" "arm-none" "armv6l-none" "avr-none" "i686-none" "msp430-none"
-    "or1k-none" "powerpc-none" "riscv32-none" "riscv64-none" "vc4-none" "m68k-none"
-    "s390-none" "x86_64-none"
+    "aarch64-none" "arm-none" "armv6l-none" "avr-none" "i686-none"
+    "msp430-none" "or1k-none" "m68k-none" "powerpc-none"
+    "riscv32-none" "riscv64-none" "s390-none" "vc4-none" "x86_64-none"

    # OpenBSD
    "i686-openbsd" "x86_64-openbsd"
@@ -127,9 +127,10 @@ rec {

  # GNU build systems assume that older NetBSD architectures are using a.out.
  gnuNetBSDDefaultExecFormat = cpu:
-    if (cpu.family == "x86" && cpu.bits == 32) ||
-       (cpu.family == "arm" && cpu.bits == 32) ||
-       (cpu.family == "sparc" && cpu.bits == 32)
+    if (cpu.family == "arm" && cpu.bits == 32) ||
+       (cpu.family == "sparc" && cpu.bits == 32) ||
+       (cpu.family == "m68k" && cpu.bits == 32) ||
+       (cpu.family == "x86" && cpu.bits == 32)
    then execFormats.aout
    else execFormats.elf;

@@ -29,7 +29,7 @@ with lib.systems.doubles; lib.runTests {
  testgnu = mseteq gnu (linux /* ++ kfreebsd ++ ... */);
  testillumos = mseteq illumos [ "x86_64-solaris" ];
  testlinux = mseteq linux [ "aarch64-linux" "armv5tel-linux" "armv6l-linux" "armv7a-linux" "armv7l-linux" "i686-linux" "mipsel-linux" "riscv32-linux" "riscv64-linux" "x86_64-linux" "powerpc64-linux" "powerpc64le-linux" "m68k-linux" "s390-linux" ];
-  testnetbsd = mseteq netbsd [ "aarch64-netbsd" "armv6l-netbsd" "armv7a-netbsd" "armv7l-netbsd" "i686-netbsd" "mipsel-netbsd" "powerpc-netbsd" "riscv32-netbsd" "riscv64-netbsd" "x86_64-netbsd" ];
+  testnetbsd = mseteq netbsd [ "aarch64-netbsd" "armv6l-netbsd" "armv7a-netbsd" "armv7l-netbsd" "i686-netbsd" "m68k-netbsd" "mipsel-netbsd" "powerpc-netbsd" "riscv32-netbsd" "riscv64-netbsd" "x86_64-netbsd" ];
  testopenbsd = mseteq openbsd [ "i686-openbsd" "x86_64-openbsd" ];
  testwindows = mseteq windows [ "i686-cygwin" "x86_64-cygwin" "i686-windows" "x86_64-windows" ];
  testunix = mseteq unix (linux ++ darwin ++ freebsd ++ openbsd ++ netbsd ++ illumos ++ cygwin ++ redox);
@@ -607,6 +607,14 @@
          </listitem>
        </itemizedlist>
      </listitem>
+      <listitem>
+        <para>
+          <literal>services.uptimed</literal> now uses
+          <literal>/var/lib/uptimed</literal> as its stateDirectory
+          instead of <literal>/var/spool/uptimed</literal>. Make sure to
+          move all files to the new directory.
+        </para>
+      </listitem>
    </itemizedlist>
  </section>
  <section xml:id="sec-release-21.11-notable-changes">
@@ -153,6 +153,8 @@ pt-services.clipcat.enable).
  - `CoenraadS.bracket-pair-colorizer` -> `coenraads.bracket-pair-colorizer`
  - `golang.Go` -> `golang.go`

+- `services.uptimed` now uses `/var/lib/uptimed` as its stateDirectory instead of `/var/spool/uptimed`. Make sure to move all files to the new directory.
+
 ## Other Notable Changes {#sec-release-21.11-notable-changes}

 - The setting [`services.openssh.logLevel`](options.html#opt-services.openssh.logLevel) `"VERBOSE"` `"INFO"`. This brings NixOS in line with upstream and other Linux distributions, and reduces log spam on servers due to bruteforcing botnets.
@@ -634,6 +634,7 @@
  ./services/network-filesystems/glusterfs.nix
  ./services/network-filesystems/kbfs.nix
  ./services/network-filesystems/ipfs.nix
+  ./services/network-filesystems/litestream/default.nix
  ./services/network-filesystems/netatalk.nix
  ./services/network-filesystems/nfsd.nix
  ./services/network-filesystems/openafs/client.nix
@@ -961,6 +962,7 @@
  ./services/web-apps/moodle.nix
  ./services/web-apps/nextcloud.nix
  ./services/web-apps/nexus.nix
+  ./services/web-apps/node-red.nix
  ./services/web-apps/plantuml-server.nix
  ./services/web-apps/plausible.nix
  ./services/web-apps/pgpkeyserver-lite.nix
@@ -4,7 +4,10 @@ with lib;

 let

-  pkg = pkgs.sane-backends;
+  pkg = pkgs.sane-backends.override {
+    scanSnapDriversUnfree = config.hardware.sane.drivers.scanSnap.enable;
+    scanSnapDriversPackage = config.hardware.sane.drivers.scanSnap.package;
+  };

  sanedConf = pkgs.writeTextFile {
    name = "saned.conf";
@@ -98,6 +101,28 @@ in
      '';
    };

+    hardware.sane.drivers.scanSnap.enable = mkOption {
+      type = types.bool;
+      default = false;
+      example = true;
+      description = ''
+        Whether to enable drivers for the Fujitsu ScanSnap scanners.
+
+        The driver files are unfree and extracted from the Windows driver image.
+      '';
+    };
+
+    hardware.sane.drivers.scanSnap.package = mkOption {
+      type = types.package;
+      default = pkgs.sane-drivers.epjitsu;
+      description = ''
+        Epjitsu driver package to use. Useful if you want to extract the driver files yourself.
+
+        The process is described in the <literal>/etc/sane.d/epjitsu.conf</literal> file in
+        the <literal>sane-backends</literal> package.
+      '';
+    };
+
    services.saned.enable = mkOption {
      type = types.bool;
      default = false;
@@ -523,19 +523,12 @@ in
        ''}

        # update all hooks' binary paths
-        HOOKS=$(find ${cfg.repositoryRoot} -mindepth 4 -maxdepth 6 -type f -wholename "*git/hooks/*")
-        if [ "$HOOKS" ]
-        then
-          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/gitea,${gitea}/bin/gitea,g' $HOOKS
-          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/env,${pkgs.coreutils}/bin/env,g' $HOOKS
-          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/bash,${pkgs.bash}/bin/bash,g' $HOOKS
-          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/perl,${pkgs.perl}/bin/perl,g' $HOOKS
-        fi
+        ${gitea}/bin/gitea admin regenerate hooks

        # update command option in authorized_keys
        if [ -r ${cfg.stateDir}/.ssh/authorized_keys ]
        then
-          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/gitea,${gitea}/bin/gitea,g' ${cfg.stateDir}/.ssh/authorized_keys
+          ${gitea}/bin/gitea admin regenerate keys
        fi
      '';

@@ -458,7 +458,7 @@ in
                description = "The flake reference to which <option>from></option> is to be rewritten.";
              };
              flake = mkOption {
-                type = types.unspecified;
+                type = types.nullOr types.attrs;
                default = null;
                example = literalExample "nixpkgs";
                description = ''
@@ -0,0 +1,100 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.litestream;
+  settingsFormat = pkgs.formats.yaml {};
+in
+{
+  options.services.litestream = {
+    enable = mkEnableOption "litestream";
+
+    package = mkOption {
+      description = "Package to use.";
+      default = pkgs.litestream;
+      defaultText = "pkgs.litestream";
+      type = types.package;
+    };
+
+    settings = mkOption {
+      description = ''
+        See the <link xlink:href="https://litestream.io/reference/config/">documentation</link>.
+      '';
+      type = settingsFormat.type;
+      example = {
+        dbs = [
+          {
+            path = "/var/lib/db1";
+            replicas = [
+              {
+                url = "s3://mybkt.litestream.io/db1";
+              }
+            ];
+          }
+        ];
+      };
+    };
+
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/secrets/litestream";
+      description = ''
+        Environment file as defined in <citerefentry>
+        <refentrytitle>systemd.exec</refentrytitle><manvolnum>5</manvolnum>
+        </citerefentry>.
+
+        Secrets may be passed to the service without adding them to the
+        world-readable Nix store, by specifying placeholder variables as
+        the option value in Nix and setting these variables accordingly in the
+        environment file.
+
+        By default, Litestream will perform environment variable expansion
+        within the config file before reading it. Any references to ''$VAR or
+        ''${VAR} formatted variables will be replaced with their environment
+        variable values. If no value is set then it will be replaced with an
+        empty string.
+
+        <programlisting>
+          # Content of the environment file
+          LITESTREAM_ACCESS_KEY_ID=AKIAxxxxxxxxxxxxxxxx
+          LITESTREAM_SECRET_ACCESS_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/xxxxxxxxx
+        </programlisting>
+
+        Note that this file needs to be available on the host on which
+        this exporter is running.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    environment.etc = {
+      "litestream.yml" = {
+        source = settingsFormat.generate "litestream-config.yaml" cfg.settings;
+      };
+    };
+
+    systemd.services.litestream = {
+      description = "Litestream";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "networking.target" ];
+      serviceConfig = {
+        EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        ExecStart = "${cfg.package}/bin/litestream replicate";
+        Restart = "always";
+        User = "litestream";
+        Group = "litestream";
+      };
+    };
+
+    users.users.litestream = {
+      description = "Litestream user";
+      group = "litestream";
+      isSystemUser = true;
+    };
+    users.groups.litestream = {};
+  };
+  meta.doc = ./litestream.xml;
+}
@@ -0,0 +1,65 @@
+<chapter xmlns="http://docbook.org/ns/docbook"
+         xmlns:xlink="http://www.w3.org/1999/xlink"
+         xmlns:xi="http://www.w3.org/2001/XInclude"
+         version="5.0"
+         xml:id="module-services-litestream">
+ <title>Litestream</title>
+ <para>
+  <link xlink:href="https://litestream.io/">Litestream</link> is a standalone streaming
+  replication tool for SQLite.
+ </para>
+
+ <section xml:id="module-services-litestream-configuration">
+  <title>Configuration</title>
+
+  <para>
+   Litestream service is managed by a dedicated user named <literal>litestream</literal>
+   which needs permission to the database file. Here's an example config which gives
+   required permissions to access <link linkend="opt-services.grafana.database.path">
+   grafana database</link>:
+<programlisting>
+{ pkgs, ... }:
+{
+  users.users.litestream.extraGroups = [ "grafana" ];
+
+  systemd.services.grafana.serviceConfig.ExecStartPost = "+" + pkgs.writeShellScript "grant-grafana-permissions" ''
+    timeout=10
+
+    while [ ! -f /var/lib/grafana/data/grafana.db ];
+    do
+      if [ "$timeout" == 0 ]; then
+        echo "ERROR: Timeout while waiting for /var/lib/grafana/data/grafana.db."
+        exit 1
+      fi
+
+      sleep 1
+
+      ((timeout--))
+    done
+
+    find /var/lib/grafana -type d -exec chmod -v 775 {} \;
+    find /var/lib/grafana -type f -exec chmod -v 660 {} \;
+  '';
+
+  services.litestream = {
+    enable = true;
+
+    environmentFile = "/run/secrets/litestream";
+
+    settings = {
+      dbs = [
+        {
+          path = "/var/lib/grafana/data/grafana.db";
+          replicas = [{
+            url = "s3://mybkt.litestream.io/grafana";
+          }];
+        }
+      ];
+    };
+  };
+}
+</programlisting>
+  </para>
+ </section>
+
+</chapter>
@@ -37,13 +37,9 @@ let
    do sleep 1; done

    curl() {
-        while
-            ${pkgs.curl}/bin/curl -Ss -H "X-API-Key: $api_key" \
-                --retry 100 --retry-delay 1 --retry-connrefused "$@"
-            status=$?
-            [ "$status" -eq 52 ] # retry on empty reply from server
-        do sleep 1; done
-        return "$status"
+        ${pkgs.curl}/bin/curl -sS -H "X-API-Key: $api_key" \
+            --retry 1000 --retry-delay 1 --retry-all-errors \
+            "$@"
    }

    # query the old config
@@ -547,6 +543,7 @@ in {
        cfg.devices != {} || cfg.folders != {} || cfg.extraOptions != {}
      ) {
        description = "Syncthing configuration updater";
+        requisite = [ "syncthing.service" ];
        after = [ "syncthing.service" ];
        wantedBy = [ "multi-user.target" ];

@@ -4,7 +4,7 @@ with lib;

 let
  cfg = config.services.uptimed;
-  stateDir = "/var/spool/uptimed";
+  stateDir = "/var/lib/uptimed";
 in
 {
  options = {
@@ -21,12 +21,16 @@ in
  };

  config = mkIf cfg.enable {
+
+    environment.systemPackages = [ pkgs.uptimed ];
+
    users.users.uptimed = {
      description = "Uptimed daemon user";
      home        = stateDir;
-      createHome  = true;
      uid         = config.ids.uids.uptimed;
+      group       = "uptimed";
    };
+    users.groups.uptimed = {};

    systemd.services.uptimed = {
      unitConfig.Documentation = "man:uptimed(8) man:uprecords(1)";
@@ -41,7 +45,7 @@ in
        PrivateTmp              = "yes";
        PrivateNetwork          = "yes";
        NoNewPrivileges         = "yes";
-        ReadWriteDirectories    = stateDir;
+        StateDirectory          = [ "uptimed" ];
        InaccessibleDirectories = "/home";
        ExecStart               = "${pkgs.uptimed}/sbin/uptimed -f -p ${stateDir}/pid";
      };
@@ -0,0 +1,148 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.node-red;
+  defaultUser = "node-red";
+  finalPackage = if cfg.withNpmAndGcc then node-red_withNpmAndGcc else cfg.package;
+  node-red_withNpmAndGcc = pkgs.runCommandNoCC "node-red" {
+    nativeBuildInputs = [ pkgs.makeWrapper ];
+  }
+  ''
+    mkdir -p $out/bin
+    makeWrapper ${pkgs.nodePackages.node-red}/bin/node-red $out/bin/node-red \
+      --set PATH '${lib.makeBinPath [ pkgs.nodePackages.npm pkgs.gcc ]}:$PATH' \
+  '';
+in
+{
+  options.services.node-red = {
+    enable = mkEnableOption "the Node-RED service";
+
+    package = mkOption {
+      default = pkgs.nodePackages.node-red;
+      defaultText = "pkgs.nodePackages.node-red";
+      type = types.package;
+      description = "Node-RED package to use.";
+    };
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Open ports in the firewall for the server.
+      '';
+    };
+
+    withNpmAndGcc = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Give Node-RED access to NPM and GCC at runtime, so 'Nodes' can be
+        downloaded and managed imperatively via the 'Palette Manager'.
+      '';
+    };
+
+    configFile = mkOption {
+      type = types.path;
+      default = "${cfg.package}/lib/node_modules/node-red/settings.js";
+      defaultText = "\${cfg.package}/lib/node_modules/node-red/settings.js";
+      description = ''
+        Path to the JavaScript configuration file.
+        See <link
+        xlink:href="https://github.com/node-red/node-red/blob/master/packages/node_modules/node-red/settings.js"/>
+        for a configuration example.
+      '';
+    };
+
+    port = mkOption {
+      type = types.port;
+      default = 1880;
+      description = "Listening port.";
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = defaultUser;
+      description = ''
+        User under which Node-RED runs.If left as the default value this user
+        will automatically be created on system activation, otherwise the
+        sysadmin is responsible for ensuring the user exists.
+      '';
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = defaultUser;
+      description = ''
+        Group under which Node-RED runs.If left as the default value this group
+        will automatically be created on system activation, otherwise the
+        sysadmin is responsible for ensuring the group exists.
+      '';
+    };
+
+    userDir = mkOption {
+      type = types.path;
+      default = "/var/lib/node-red";
+      description = ''
+        The directory to store all user data, such as flow and credential files and all library data. If left
+        as the default value this directory will automatically be created before the node-red service starts,
+        otherwise the sysadmin is responsible for ensuring the directory exists with appropriate ownership
+        and permissions.
+      '';
+    };
+
+    safe = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether to launch Node-RED in --safe mode.";
+    };
+
+    define = mkOption {
+      type = types.attrs;
+      default = {};
+      description = "List of settings.js overrides to pass via -D to Node-RED.";
+      example = literalExample ''
+        {
+          "logging.console.level" = "trace";
+        }
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.users = optionalAttrs (cfg.user == defaultUser) {
+      ${defaultUser} = {
+        isSystemUser = true;
+      };
+    };
+
+    users.groups = optionalAttrs (cfg.group == defaultUser) {
+      ${defaultUser} = { };
+    };
+
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+
+    systemd.services.node-red = {
+      description = "Node-RED Service";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "networking.target" ];
+      environment = {
+        HOME = cfg.userDir;
+      };
+      serviceConfig = mkMerge [
+        {
+          User = cfg.user;
+          Group = cfg.group;
+          ExecStart = "${finalPackage}/bin/node-red ${pkgs.lib.optionalString cfg.safe "--safe"} --settings ${cfg.configFile} --port ${toString cfg.port} --userDir ${cfg.userDir} ${concatStringsSep " " (mapAttrsToList (name: value: "-D ${name}=${value}") cfg.define)}";
+          PrivateTmp = true;
+          Restart = "always";
+          WorkingDirectory = cfg.userDir;
+        }
+        (mkIf (cfg.userDir == "/var/lib/node-red") { StateDirectory = "node-red"; })
+      ];
+    };
+  };
+}
@@ -72,11 +72,14 @@ def main():
                    f"Setting session name: {session}, as we found the existing wayland-session: {session_file}"
                )
                user.set_session(session)
+                user.set_session_type("wayland")
            elif is_session_xsession(session_file):
                logging.debug(
                    f"Setting session name: {session}, as we found the existing xsession: {session_file}"
                )
                user.set_x_session(session)
+                user.set_session(session)
+                user.set_session_type("x11")
            else:
                logging.error(f"Couldn't figure out session type for {session_file}")
                sys.exit(1)
@@ -18,6 +18,13 @@ in {
          The size of the VirtualBox base image in MiB.
        '';
      };
+      baseImageFreeSpace = mkOption {
+        type = with types; int;
+        default = 30 * 1024;
+        description = ''
+          Free space in the VirtualBox base image in MiB.
+        '';
+      };
      memorySize = mkOption {
        type = types.int;
        default = 1536;
@@ -129,6 +136,7 @@ in {
      inherit pkgs lib config;
      partitionTableType = "legacy";
      diskSize = cfg.baseImageSize;
+      additionalSpace = "${toString cfg.baseImageFreeSpace}M";

      postVM =
        ''
@@ -227,6 +227,7 @@ in
  libreswan = handleTest ./libreswan.nix {};
  lightdm = handleTest ./lightdm.nix {};
  limesurvey = handleTest ./limesurvey.nix {};
+  litestream = handleTest ./litestream.nix {};
  locate = handleTest ./locate.nix {};
  login = handleTest ./login.nix {};
  loki = handleTest ./loki.nix {};
@@ -259,6 +260,7 @@ in
  morty = handleTest ./morty.nix {};
  mosquitto = handleTest ./mosquitto.nix {};
  mpd = handleTest ./mpd.nix {};
+  mpv = handleTest ./mpv.nix {};
  mumble = handleTest ./mumble.nix {};
  musescore = handleTest ./musescore.nix {};
  munin = handleTest ./munin.nix {};
@@ -301,6 +303,7 @@ in
  nix-serve = handleTest ./nix-ssh-serve.nix {};
  nix-ssh-serve = handleTest ./nix-ssh-serve.nix {};
  nixos-generate-config = handleTest ./nixos-generate-config.nix {};
+  node-red = handleTest ./node-red.nix {};
  nomad = handleTest ./nomad.nix {};
  novacomd = handleTestOn ["x86_64-linux"] ./novacomd.nix {};
  nsd = handleTest ./nsd.nix {};
@@ -0,0 +1,93 @@
+import ./make-test-python.nix ({ pkgs, ...} : {
+  name = "litestream";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ jwygoda ];
+  };
+
+  machine =
+    { pkgs, ... }:
+    { services.litestream = {
+        enable = true;
+        settings = {
+          dbs = [
+            {
+              path = "/var/lib/grafana/data/grafana.db";
+              replicas = [{
+                url = "sftp://foo:bar@127.0.0.1:22/home/foo/grafana";
+              }];
+            }
+          ];
+        };
+      };
+      systemd.services.grafana.serviceConfig.ExecStartPost = "+" + pkgs.writeShellScript "grant-grafana-permissions" ''
+        timeout=10
+
+        while [ ! -f /var/lib/grafana/data/grafana.db ];
+        do
+          if [ "$timeout" == 0 ]; then
+            echo "ERROR: Timeout while waiting for /var/lib/grafana/data/grafana.db."
+            exit 1
+          fi
+
+          sleep 1
+
+          ((timeout--))
+        done
+
+        find /var/lib/grafana -type d -exec chmod -v 775 {} \;
+        find /var/lib/grafana -type f -exec chmod -v 660 {} \;
+      '';
+      services.openssh = {
+        enable = true;
+        allowSFTP = true;
+        listenAddresses = [ { addr = "127.0.0.1"; port = 22; } ];
+      };
+      services.grafana = {
+        enable = true;
+        security = {
+          adminUser = "admin";
+          adminPassword = "admin";
+        };
+        addr = "localhost";
+        port = 3000;
+        extraOptions = {
+          DATABASE_URL = "sqlite3:///var/lib/grafana/data/grafana.db?cache=private&mode=rwc&_journal_mode=WAL";
+        };
+      };
+      users.users.foo = {
+        isNormalUser = true;
+        password = "bar";
+      };
+      users.users.litestream.extraGroups = [ "grafana" ];
+    };
+
+  testScript = ''
+    start_all()
+    machine.wait_until_succeeds("test -d /home/foo/grafana")
+    machine.wait_for_open_port(3000)
+    machine.succeed("""
+        curl -sSfN -X PUT -H "Content-Type: application/json" -d '{
+          "oldPassword": "admin",
+          "newPassword": "newpass",
+          "confirmNew": "newpass"
+        }' http://admin:admin@127.0.0.1:3000/api/user/password
+    """)
+    # https://litestream.io/guides/systemd/#simulating-a-disaster
+    machine.systemctl("stop litestream.service")
+    machine.succeed(
+        "rm -f /var/lib/grafana/data/grafana.db "
+        "/var/lib/grafana/data/grafana.db-shm "
+        "/var/lib/grafana/data/grafana.db-wal"
+    )
+    machine.succeed(
+        "litestream restore /var/lib/grafana/data/grafana.db "
+        "&& chown grafana:grafana /var/lib/grafana/data/grafana.db "
+        "&& chmod 660 /var/lib/grafana/data/grafana.db"
+    )
+    machine.systemctl("restart grafana.service")
+    machine.wait_for_open_port(3000)
+    machine.succeed(
+        "curl -sSfN -u admin:newpass http://127.0.0.1:3000/api/org/users | grep admin\@localhost"
+    )
+  '';
+})
@@ -0,0 +1,28 @@
+import ./make-test-python.nix ({ lib, ... }:
+
+with lib;
+
+let
+  port = toString 4321;
+in
+{
+  name = "mpv";
+  meta.maintainers = with maintainers; [ zopieux ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [
+        pkgs.curl
+        (pkgs.mpv-with-scripts.override {
+          scripts = [ pkgs.mpvScripts.simple-mpv-webui ];
+        })
+      ];
+    };
+
+  testScript = ''
+    machine.execute("set -m; mpv --script-opts=webui-port=${port} --idle=yes &")
+    machine.wait_for_open_port(${port})
+    assert "<title>simple-mpv-webui" in machine.succeed("curl -s localhost:${port}")
+  '';
+})
@@ -0,0 +1,31 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "nodered";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ matthewcroughan ];
+  };
+
+  nodes = {
+    client = { config, pkgs, ... }: {
+      environment.systemPackages = [ pkgs.curl ];
+    };
+    nodered = { config, pkgs, ... }: {
+      services.node-red = {
+        enable = true;
+        openFirewall = true;
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    nodered.wait_for_unit("node-red.service")
+    nodered.wait_for_open_port("1880")
+
+    client.wait_for_unit("multi-user.target")
+
+    with subtest("Check that the Node-RED webserver can be reached."):
+        assert "<title>Node-RED</title>" in client.succeed(
+            "curl -sSf http:/nodered:1880/ | grep title"
+        )
+  '';
+})
@@ -0,0 +1,24 @@
+import ./make-test-python.nix ({ pkgs, ... }: {
+  name = "soapui";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ asbachb ];
+  };
+
+  machine = { config, pkgs, ... }: {
+    imports = [
+      ./common/x11.nix
+    ];
+
+    services.xserver.enable = true;
+
+    environment.systemPackages = [ pkgs.soapui ];
+  };
+
+  testScript = ''
+    machine.wait_for_x()
+    machine.succeed("soapui &")
+    machine.wait_for_window(r"SoapUI \d+\.\d+\.\d+")
+    machine.sleep(1)
+    machine.screenshot("soapui")
+  '';
+})
@@ -2,12 +2,16 @@
 , gettext, pkg-config, python3
 , avahi, libgphoto2, libieee1284, libjpeg, libpng, libtiff, libusb1, libv4l, net-snmp
 , curl, systemd, libxml2, poppler
+, sane-drivers

 # List of { src name backend } attibute sets - see installFirmware below:
 , extraFirmware ? []

 # For backwards compatibility with older setups; use extraFirmware instead:
 , gt68xxFirmware ? null, snapscanFirmware ? null
+
+# Not included by default, scan snap drivers require fetching of unfree binaries.
+, scanSnapDriversUnfree ? false, scanSnapDriversPackage ? sane-drivers.epjitsu
 }:

 stdenv.mkDerivation {
@@ -88,7 +92,14 @@ stdenv.mkDerivation {

    # net.conf conflicts with the file generated by the nixos module
    rm $out/etc/sane.d/net.conf
-  '' + lib.concatStrings (builtins.map installFirmware compatFirmware);
+
+  ''
+  + lib.optionalString scanSnapDriversUnfree ''
+    # the ScanSnap drivers live under the epjitsu subdirectory, which was already created by the build but is empty.
+    rmdir $out/share/sane/epjitsu
+    ln -svT ${scanSnapDriversPackage} $out/share/sane/epjitsu
+  ''
+  + lib.concatStrings (builtins.map installFirmware compatFirmware);

  meta = with lib; {
    description = "SANE (Scanner Access Now Easy) backends";
@@ -0,0 +1,13 @@
+{ lib, fetchFromGitHub }:
+
+{
+  # Fujitsu ScanSnap
+  epjitsu = fetchFromGitHub {
+    name = "scansnap-firmware";
+    owner = "stevleibelt";
+    repo = "scansnap-firmware";
+    rev = "96c3a8b2a4e4f1ccc4e5827c5eb5598084fd17c8";
+    sha256 = "1inchnvaqyw9d0skpg8hp5rpn27c09q58lsr42by4bahpbx5qday";
+    meta.license = lib.licenses.unfree;
+  };
+}
@@ -2,7 +2,7 @@

 stdenv.mkDerivation rec {
  pname = "1password";
-  version = "1.9.1";
+  version = "1.11.2";
  src =
    if stdenv.isLinux then fetchzip {
      url = {
@@ -11,14 +11,14 @@ stdenv.mkDerivation rec {
        "aarch64-linux" = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_linux_arm_v${version}.zip";
      }.${stdenv.hostPlatform.system};
      sha256 = {
-        "i686-linux" = "1x5khnp6yqrjf513x3y6l38rb121nib7d4aiz4cz7fh029kxjhd1";
-        "x86_64-linux" = "1ar8lzkndl7xzcinv93rzg8q25vb23fggbjkhgchgc5x9wkwk8hw";
-        "aarch64-linux" = "1q81pk6qmp96p1dbhx1ijln8f54rac8r81d4ghqx9v756s9szrr1";
+        "i686-linux" = "0rh5bakj9qd43cf6wj5v46a3h98kcwqyc0f1yw72wvcacvjycyjz";
+        "x86_64-linux" = "00nf0cb8cxk1pvzr1wq778wvikzrlzy38r3rzkq44whdpdj50jzx";
+        "aarch64-linux" = "1gv282z49bj3ln5na4wb1z5455a64cyd54fp5i96k8shaxd0apxf";
      }.${stdenv.hostPlatform.system};
      stripRoot = false;
    } else fetchurl {
-      url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_darwin_amd64_v${version}.pkg";
-      sha256 = "0904wwy3wdhfvbkvpdap8141a9gqmn0dw45ikrzsqpg7pv1r2zch";
+      url = "https://cache.agilebits.com/dist/1P/op/pkg/v${version}/op_apple_universal_v${version}.pkg";
+      sha256 = "1pqdjr6d23j9fpwgahb0s1ni1bpjv9jajs1hapgq5kdrww2w7nhm";
    };

  buildInputs = lib.optionals stdenv.isDarwin [ xar cpio ];
@@ -22,15 +22,16 @@
 , libmtp
 , xdg-utils
 , removeReferencesTo
+, libstemmer
 }:

 mkDerivation rec {
  pname = "calibre";
-  version = "5.17.0";
+  version = "5.24.0";

  src = fetchurl {
    url = "https://download.calibre-ebook.com/${version}/${pname}-${version}.tar.xz";
-    hash = "sha256-rdiBL3Y3q/0wFfWGE4jGkWakgV8hA9HjDcKXso6tVrs=";
+    hash = "sha256:18dr577nv7ijw3ar6mrk2xrc54mlrqkaj5jrc6s5sirl0710fdfg";
  };

  patches = [
@@ -65,6 +66,7 @@ mkDerivation rec {
    libjpeg
    libmtp
    libpng
+    libstemmer
    libusb1
    podofo
    poppler_utils
@@ -73,7 +75,9 @@ mkDerivation rec {
    xdg-utils
  ] ++ (
    with python3Packages; [
-      apsw
+      (apsw.overrideAttrs (oldAttrs: rec {
+        setupPyBuildFlags = [ "--enable=load_extension" ];
+      }))
      beautifulsoup4
      cchardet
      css-parser
@@ -95,15 +99,7 @@ mkDerivation rec {
      python
      regex
      sip
-      (zeroconf.overrideAttrs (oldAttrs: rec {
-        version = "0.31.0";
-        src = fetchFromGitHub {
-          owner = "jstasiak";
-          repo = "python-zeroconf";
-          rev = version;
-          sha256 = "158dqay74zvnz6kmpvip4ml0kw59nf2aaajwgaamx0zc8ci1p5pj";
-        };
-      }))
+      zeroconf
      # the following are distributed with calibre, but we use upstream instead
      odfpy
    ] ++ lib.optional (unrarSupport) unrardll
@@ -2,13 +2,13 @@

 let
  pname = "freeplane";
-  version = "1.8.11";
+  version = "1.9.5";

  src = fetchFromGitHub {
    owner = pname;
    repo = pname;
    rev = "release-${version}";
-    sha256 = "07xjx9pf62dvy8lx6vnbwwcn1zqy89cmdmwy792k7gb12wz81nnc";
+    sha256 = "qfhhmF3mePxcL4U8izkEmWaiaOLi4slsaymVnDoO3sY=";
  };

  deps = stdenv.mkDerivation {
@@ -31,7 +31,7 @@ let

    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
-    outputHash = "0r7f6713m0whh5hlk1id7z9j5v9494r41sivn9fzl63q70kzz92g";
+    outputHash = "xphTzaSXTGpP7vI/t4oIiv1ZpbekG2dFRzyl3ub6qnA=";
  };

  # Point to our local deps repo
@@ -24,12 +24,12 @@

 stdenv.mkDerivation rec {
  pname = "yambar";
-  version = "1.6.1";
+  version = "1.6.2";

  src = fetchgit {
    url = "https://codeberg.org/dnkl/yambar.git";
    rev = version;
-    sha256 = "p47tFsEWsYNe6IVV65xGG211u6Vm2biRf4pmUDylBOQ=";
+    sha256 = "sha256-oUNkaWrYIcsK2u+aeRg6DHmH4M1VZ0leNSM0lV9Yy1Y=";
  };

  nativeBuildInputs = [ pkg-config meson ninja scdoc ];
@@ -259,25 +259,12 @@ let
    '';

    gnFlags = mkGnFlags ({
+      # Main build and toolchain settings:
      is_official_build = true;
      custom_toolchain = "//build/toolchain/linux/unbundle:default";
      host_toolchain = "//build/toolchain/linux/unbundle:default";
-      system_wayland_scanner_path = "${wayland}/bin/wayland-scanner";
-
      use_sysroot = false;
-      use_gnome_keyring = gnomeKeyringSupport;
-      use_gio = gnomeSupport;
-      # ninja: error: '../../native_client/toolchain/linux_x86/pnacl_newlib/bin/x86_64-nacl-objcopy',
-      # needed by 'nacl_irt_x86_64.nexe', missing and no known rule to make it
-      enable_nacl = false;
-      # Enabling the Widevine component here doesn't affect whether we can
-      # redistribute the chromium package; the Widevine component is either
-      # added later in the wrapped -wv build or downloaded from Google.
-      enable_widevine = true;
-      use_cups = cupsSupport;
-      # Provides the enable-webrtc-pipewire-capturer flag to support Wayland screen capture.
-      rtc_use_pipewire = true;
-
+      system_wayland_scanner_path = "${wayland}/bin/wayland-scanner";
      treat_warnings_as_errors = false;
      clang_use_chrome_plugins = false;
      blink_symbol_level = 0;
@@ -288,6 +275,21 @@ let
      # Note: The API key is for NixOS/nixpkgs use ONLY.
      # For your own distribution, please get your own set of keys.
      google_api_key = "AIzaSyDGi15Zwl11UNe6Y-5XW_upsfyw31qwZPI";
+
+      # Optional features:
+      use_cups = cupsSupport;
+      use_gio = gnomeSupport;
+      use_gnome_keyring = gnomeKeyringSupport;
+
+      # Feature overrides:
+      # Native Client support was deprecated in 2020 and support will end in June 2021:
+      enable_nacl = false;
+      # Enabling the Widevine component here doesn't affect whether we can
+      # redistribute the chromium package; the Widevine component is either
+      # added later in the wrapped -wv build or downloaded from Google:
+      enable_widevine = true;
+      # Provides the enable-webrtc-pipewire-capturer flag to support Wayland screen capture:
+      rtc_use_pipewire = true;
    } // optionalAttrs proprietaryCodecs {
      # enable support for the H.264 codec
      proprietary_codecs = true;
@@ -296,14 +298,6 @@ let
    } // optionalAttrs pulseSupport {
      use_pulseaudio = true;
      link_pulseaudio = true;
-      # Disable PGO (defaults to 2 since M89) because it fails without additional changes:
-      # error: Could not read profile ../../chrome/build/pgo_profiles/chrome-linux-master-1610647094-405a32bcf15e5a84949640f99f84a5b9f61e2f2e.profdata: Unsupported instrumentation profile format version
-      chrome_pgo_phase = 0;
-      # Disable build with TFLite library because it fails without additional changes:
-      # ninja: error: '../../chrome/test/data/simple_test.tflite', needed by 'test_data/simple_test.tflite', missing and no known rule to make it
-      # Note: chrome/test/data/simple_test.tflite is in the Git repository but not in chromium-90.0.4400.8.tar.xz
-      # See also chrome/services/machine_learning/README.md
-      build_with_tflite_lib = false;
    } // optionalAttrs ungoogled {
      chrome_pgo_phase = 0;
      enable_hangout_services_extension = false;
@@ -82,7 +82,8 @@ stdenv.mkDerivation {
    wrapProgram $out/opt/viber/Viber \
      --set QT_PLUGIN_PATH "$out/opt/viber/plugins" \
      --set QT_XKB_CONFIG_ROOT "${xorg.xkeyboardconfig}/share/X11/xkb" \
-      --set QTCOMPOSE "${xorg.libX11.out}/share/X11/locale"
+      --set QTCOMPOSE "${xorg.libX11.out}/share/X11/locale" \
+      --set QML2_IMPORT_PATH "$out/opt/viber/qml"
    ln -s $out/opt/viber/Viber $out/bin/viber

    mv $out/usr/share $out/share
@@ -5,12 +5,12 @@

 let
  pname = "zulip";
-  version = "5.8.0";
+  version = "5.8.1";
  name = "${pname}-${version}";

  src = fetchurl {
    url = "https://github.com/zulip/zulip-desktop/releases/download/v${version}/Zulip-${version}-x86_64.AppImage";
-    sha256 = "0z8lp56j6qvm57sfqdyqrqzj9add3drh1z4zsckg45jfw6yn3jdv";
+    sha256 = "02m18y5j6jmmlygv8ycwaaq6n7mvj97ljhd3l9pvii0adwcvrpfz";
    name="${pname}-${version}.AppImage";
  };

@@ -1,25 +1,30 @@
-{ fetchurl, lib, stdenv, writeText, jdk, maven, makeWrapper }:
+{ fetchurl, lib, stdenv, writeText, jdk, makeWrapper }:

 stdenv.mkDerivation rec {
  pname = "soapui";
-  version = "5.5.0";
+  version = "5.6.0";

  src = fetchurl {
    url = "https://s3.amazonaws.com/downloads.eviware/soapuios/${version}/SoapUI-${version}-linux-bin.tar.gz";
-    sha256 = "0v1wiy61jgvlxjk8qdvcnyn1gh2ysxf266zln7r4wpzwd5gc3dpw";
+    sha256 = "0vmj11fswja0ddnbc4vb7gj1al8km7ilma9bv1waaj8h5c8qpayi";
  };

  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ jdk maven ];
+  buildInputs = [ jdk ];

  installPhase = ''
+    runHook preInstall
+
    mkdir -p $out/share/java
    cp -R bin lib $out/share/java

    makeWrapper $out/share/java/bin/soapui.sh $out/bin/soapui --set SOAPUI_HOME $out/share/java
+
+    runHook postInstall
  '';

  patches = [
+    # Adjust java path to point to derivation paths
    (writeText "soapui-${version}.patch" ''
      --- a/bin/soapui.sh
      +++ b/bin/soapui.sh
@@ -3,11 +3,11 @@

 buildPythonApplication rec {
  pname = "MAVProxy";
-  version = "1.8.39";
+  version = "1.8.40";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-1RXuAiz9i5ZnLtDGQ+o3DNgWJ2FDJGIoelmlDmEzrts=";
+    sha256 = "cad317e2e879f1f7cb59af078788aaf0d09cd761ecd91ad091adf7ac6cc1bcdb";
  };

  postPatch = ''
@@ -2,13 +2,13 @@
 , fetchFromGitHub }:
 stdenvNoCC.mkDerivation rec {
  pname = "simple-mpv-ui";
-  version = "1.0.0";
+  version = "2.1.0";

  src = fetchFromGitHub {
    owner = "open-dynaMIX";
    repo = "simple-mpv-webui";
    rev = "v${version}";
-    sha256 = "1glrnnl1slcl0ri0zs4j64lc9aa52p9ffh6av0d81fk95nm98917";
+    sha256 = "1z0y8sdv5mbxznxqh43w5592ym688vkvqg7w26p8cinrhf09pbw8";
  };

  dontBuild = true;
@@ -21,7 +21,7 @@ stdenvNoCC.mkDerivation rec {
  meta = with lib; {
    description = "A web based user interface with controls for the mpv mediaplayer";
    homepage = "https://github.com/open-dynaMIX/simple-mpv-webui";
-    maintainers = [ maintainers.cript0nauta ];
+    maintainers = with maintainers; [ cript0nauta zopieux ];
    longDescription = ''
      You can access the webui when accessing http://127.0.0.1:8080 or
      http://[::1]:8080 in your webbrowser. By default it listens on
@@ -1,4 +1,5 @@
-{ lib, stdenv
+{ lib
+, stdenv
 , fetchFromGitHub
 , pkg-config
 , cmake
@@ -19,25 +20,27 @@
 , vulkan-tools
 , wrapQtAppsHook
 }:
-
-let
+stdenv.mkDerivation rec {
  pname = "qmplay2";
-  version = "20.12.16";
-in stdenv.mkDerivation {
-  inherit pname version;
+  version = "21.06.07";

  src = fetchFromGitHub {
    owner = "zaps166";
    repo = "QMPlay2";
    rev = version;
-    sha256 = "sha256-+XXlQI9MyENioYmzqbbZYQ6kaMATBjPrPaErR2Vqhus=";
+    sha256 = "sha256-NV9uglYnqebXhMx8uL0DhGe9l5TBVjlSIaB4IWC8YAc=";
    fetchSubmodules = true;
  };

-  nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wrapQtAppsHook
+  ];
  buildInputs = [
    alsa-lib
    ffmpeg
+    libXv
    libass
    libcddb
    libcdio
@@ -45,7 +48,6 @@ in stdenv.mkDerivation {
    libpulseaudio
    libsidplayfp
    libva
-    libXv
    qtbase
    qttools
    taglib
@@ -52,13 +52,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "arcan";
-  version = "0.6.1pre1+unstable=2021-07-10";
+  version = "0.6.1pre1+unstable=2021-07-30";

  src = fetchFromGitHub {
    owner = "letoram";
    repo = "arcan";
-    rev = "25da999e6e03688c71c7df3852314c01ed610e0d";
-    hash = "sha256-+ZF6mD/Z0N/5QCjXe80z4L6JOE33+Yv4ZlwKvlG/c44=";
+    rev = "885b2f0c9e031fd157af21302af2027ecbe3fe1f";
+    hash = "sha256-tj5kPa5OWCGt7LTzo4ZYV1UjBpOrjQHER/K+ZfL3h+8=";
  };

  postUnpack = ''
@@ -20,9 +20,10 @@ symlinkJoin rec {
        --set ARCAN_BINPATH "${placeholder "out"}/bin/arcan_frameserver" \
        --set ARCAN_LIBPATH "${placeholder "out"}/lib/" \
        --set ARCAN_RESOURCEPATH "${placeholder "out"}/share/arcan/resources/" \
-        --set ARCAN_SCRIPTPATH "${placeholder "out"}/share/arcan/scripts/" \
-        --set ARCAN_STATEBASEPATH "\$HOME/.arcan/resources/savestates/"
+        --set ARCAN_SCRIPTPATH "${placeholder "out"}/share/arcan/scripts/"
    done
  '';
 }
 # TODO: set ARCAN_FONTPATH to a set of fonts that can be provided in a parameter
+# TODO: set ARCAN_STATEBASEPATH to $HOME/.arcan/resources/savestates/ - possibly
+# via a suitable script
@@ -13,6 +13,7 @@
 , xkeyboard_config
 , udisks2

+, waylandSupport ? false, wayland-protocols, xwayland
 , bluetoothSupport ? true, bluez5
 , pulseSupport ? !stdenv.isDarwin, libpulseaudio
 }:
@@ -45,6 +46,7 @@ stdenv.mkDerivation rec {
  ]
  ++ lib.optional bluetoothSupport bluez5 # for bluetooth configuration and control
  ++ lib.optional pulseSupport libpulseaudio # for proper audio device control and redirection
+  ++ lib.optionals waylandSupport [ wayland-protocols xwayland ]
  ;

  patches = [
@@ -62,7 +64,7 @@ stdenv.mkDerivation rec {

  mesonFlags = [
    "-D systemdunitdir=lib/systemd/user"
-  ];
+  ] ++ lib.optional waylandSupport "-Dwl=true";

  passthru.providedSessions = [ "enlightenment" ];

@@ -47,20 +47,24 @@ stdenv.mkDerivation {
    (if threadSupport then "--enable-threads" else "--disable-threads")
    "--with-gmp-prefix=${gmp.dev}"
    "--with-libffi-prefix=${libffi.dev}"
-    ]
-    ++
-    (lib.optional (! noUnicode)
-      "--enable-unicode")
-    ;
+  ]
+  ++
+  (lib.optional useBoehmgc
+    "--with-libgc-prefix=${boehmgc.dev}")
+  ++
+  (lib.optional (! noUnicode)
+    "--enable-unicode")
+  ;

  hardeningDisable = [ "format" ];

-  postInstall = ''
+  postInstall = let
+    ldArgs = lib.strings.concatMapStringsSep " "
+      (l: ''--prefix NIX_LDFLAGS ' ' "-L${l.lib or l.out or l}/lib"'')
+      ([ gmp libffi ] ++ lib.optional useBoehmgc boehmgc);
+  in ''
    sed -e 's/@[-a-zA-Z_]*@//g' -i $out/bin/ecl-config
-    wrapProgram "$out/bin/ecl" \
-      --prefix PATH ':' "${gcc}/bin" \
-      --prefix NIX_LDFLAGS ' ' "-L${gmp.lib or gmp.out or gmp}/lib" \
-      --prefix NIX_LDFLAGS ' ' "-L${libffi.lib or libffi.out or libffi}/lib"
+    wrapProgram "$out/bin/ecl" --prefix PATH ':' "${gcc}/bin" ${ldArgs}
  '';

  meta = {
@@ -2,13 +2,13 @@

 stdenv.mkDerivation ( rec {
  pname = "corral";
-  version = "0.5.1";
+  version = "0.5.3";

  src = fetchFromGitHub {
    owner = "ponylang";
    repo = pname;
    rev = version;
-    sha256 = "1g4dkf5hsnykn3x6yx6ycjzmzzr1nwl59lj13j7zyka1ibv53hwf";
+    sha256 = "sha256-27J1Y3+tbZK7RX+63xVV2eaX/LF525vBR3Ff9EYDEl0=";
  };

  buildInputs = [ ponyc ];
@@ -1,4 +1,16 @@
-{ lib, mkCoqDerivation, coq, compcert, version ? null }:
+{ lib, mkCoqDerivation, coq, compcert, ITree, version ? null }:
+
+# A few modules that are not built and installed by default
+#  but that may be useful to some users.
+# They depend on ITree.
+let extra_floyd_files = [
+  "ASTsize.v"
+  "io_events.v"
+  "powerlater.v"
+  "printf.v"
+  "quickprogram.v"
+  ];
+in

 with lib; mkCoqDerivation {
  pname = "coq${coq.coq-version}-VST";
@@ -12,9 +24,14 @@ with lib; mkCoqDerivation {
  ] null;
  release."2.8".sha256 = "sha256-cyK88uzorRfjapNQ6XgQEmlbWnDsiyLve5po1VG52q0=";
  releaseRev = v: "v${v}";
+  extraBuildInputs = [ ITree ];
  propagatedBuildInputs = [ compcert ];

-  preConfigure = "patchShebangs util";
+  preConfigure = ''
+    patchShebangs util
+    substituteInPlace Makefile \
+      --replace 'FLOYD_FILES=' 'FLOYD_FILES= ${toString extra_floyd_files}'
+  '';

  makeFlags = [
    "BITSIZE=64"
@@ -21,6 +21,9 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ cmake removeReferencesTo ];

+  # These checks fail on aarch64-darwin
+  cmakeFlags = [ "-DENABLE_UBSAN=OFF" ];
+
  # It used to reference it, in the past, but thanks to the postFixup hook, now
  # it doesn't.
  disallowedReferences = [ stdenv.cc.cc ];
@@ -8,13 +8,13 @@

 stdenv.mkDerivation rec {
  pname = "gensio";
-  version = "2.2.7";
+  version = "2.2.8";

  src = fetchFromGitHub {
    owner = "cminyard";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-2wxsPHrQ9GgyUE4p6zYuR1mPU2OyjtgiPnMApEscR2g=";
+    sha256 = "sha256-6+hYytLMg5E1KTBPWSteVu2VjF0APkcoOiigqzrBI+U=";
  };

  passthru = {
@@ -1,22 +1,25 @@
 { stdenv, lib, fetchurl, fetchpatch, pkg-config, libtool
-, gtk ? null
+, gtk2-x11, gtk3-x11 , gtkSupport ? null
 , libpulseaudio, gst_all_1, libvorbis, libcap
-, CoreServices
+, Carbon, CoreServices
 , withAlsa ? stdenv.isLinux, alsa-lib }:

 stdenv.mkDerivation rec {
-  name = "libcanberra-0.30";
+  pname = "libcanberra";
+  version = "0.30";

  src = fetchurl {
-    url = "http://0pointer.de/lennart/projects/libcanberra/${name}.tar.xz";
+    url = "http://0pointer.de/lennart/projects/libcanberra/${pname}-${version}.tar.xz";
    sha256 = "0wps39h8rx2b00vyvkia5j40fkak3dpipp1kzilqla0cgvk73dn2";
  };

  nativeBuildInputs = [ pkg-config libtool ];
  buildInputs = [
-    libpulseaudio libvorbis gtk
+    libpulseaudio libvorbis
  ] ++ (with gst_all_1; [ gstreamer gst-plugins-base ])
-    ++ lib.optional stdenv.isDarwin CoreServices
+    ++ lib.optional (gtkSupport == "gtk2") gtk2-x11
+    ++ lib.optional (gtkSupport == "gtk3") gtk3-x11
+    ++ lib.optionals stdenv.isDarwin [Carbon CoreServices]
    ++ lib.optional stdenv.isLinux libcap
    ++ lib.optional withAlsa alsa-lib;

@@ -30,7 +33,7 @@ stdenv.mkDerivation rec {
    })
  ];

-  postPatch = (lib.optional stdenv.isDarwin) ''
+  postPatch = lib.optionalString stdenv.isDarwin ''
    patch -p0 < ${fetchpatch {
      url = "https://raw.githubusercontent.com/macports/macports-ports/master/audio/libcanberra/files/patch-configure.diff";
      sha256 = "1f7h7ifpqvbfhqygn1b7klvwi80zmpv3538vbmq7ql7bkf1q8h31";
@@ -43,8 +46,8 @@ stdenv.mkDerivation rec {
    done
  '';

-  passthru = {
-    gtkModule = "/lib/gtk-2.0/";
+  passthru = lib.optionalAttrs (gtkSupport != null) {
+    gtkModule = if gtkSupport == "gtk2" then "/lib/gtk-2.0" else "/lib/gtk-3.0/";
  };

  meta = with lib; {
@@ -62,6 +65,6 @@ stdenv.mkDerivation rec {
    platforms = platforms.unix;
    # canberra-gtk-module.c:28:10: fatal error: 'gdk/gdkx.h' file not found
    # #include <gdk/gdkx.h>
-    broken = stdenv.isDarwin;
+    broken = stdenv.isDarwin && (gtkSupport == "gtk3");
  };
 }
@@ -11,15 +11,13 @@

 stdenv.mkDerivation rec {
  pname = "zchunk";
-  version = "1.1.11";
-
-  outputs = [ "out" "lib" "dev" ];
+  version = "1.1.16";

  src = fetchFromGitHub {
    owner = "zchunk";
    repo = pname;
    rev = version;
-    hash = "sha256-r+qWJOUnTyPJjM9eW44Q2DMKxx4HloyfNrQ6xWDO9vQ=";
+    hash = "sha256-+8FkivLTZXdu0+1wu+7T98y6rQzIHbG9l15Abrbln1o=";
  };

  nativeBuildInputs = [
@@ -33,6 +31,13 @@ stdenv.mkDerivation rec {
    zstd
  ] ++ lib.optional stdenv.isDarwin argp-standalone;

+
+  outputs = [
+    "out"
+    "lib"
+    "dev"
+  ];
+
  meta = with lib; {
    homepage = "https://github.com/zchunk/zchunk";
    description = "File format designed for highly efficient deltas while maintaining good compression";
@@ -2,16 +2,20 @@ diff --git a/src/repository/opamRepositoryConfig.ml b/src/repository/opamReposit
 index c2954c1d..528fc621 100644
 --- a/src/repository/opamRepositoryConfig.ml
 +++ b/src/repository/opamRepositoryConfig.ml
-@@ -27,23 +27,7 @@ type 'a options_fun =
+@@ -27,31 +27,7 @@ type 'a options_fun =
   'a
 
 let default = {
 -  download_tool = lazy (
+-    let os = OpamStd.Sys.os () in
 -    try
+-      let curl = "curl", `Curl in
 -      let tools =
-        if OpamStd.Sys.(os () = Darwin)
-        then ["wget", `Default; "curl", `Curl]
-        else ["curl", `Curl; "wget", `Default]
+-        match os with
+-        | Darwin  -> ["wget", `Default; curl]
+-        | FreeBSD -> ["fetch", `Default ; curl]
+-        | OpenBSD -> ["ftp", `Default; curl]
+-        | _ -> [curl; "wget", `Default]
 -      in
 -      let cmd, kind =
 -        List.find (fun (c,_) -> OpamSystem.resolve_command c <> None) tools
@@ -20,8 +24,12 @@ index c2954c1d..528fc621 100644
 -    with Not_found ->
 -      OpamConsole.error_and_exit `Configuration_error
 -        "Could not find a suitable download command. Please make sure you \
-         have either \"curl\" or \"wget\" installed, or specify a custom \
-         command through variable OPAMFETCH."
+-         have %s installed, or specify a custom command through variable \
+-         OPAMFETCH."
+-        (match os with
+-         | FreeBSD -> "fetch"
+-         | OpenBSD -> "ftp"
+-         | _ -> "either \"curl\" or \"wget\"")
 -  );
 +  download_tool = lazy ([ CIdent SUBSTITUTE_NIXOS_CURL_PATH, None ], `Curl);
   validation_hook = None;
@@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "aioambient";
-  version = "1.2.4";
+  version = "1.2.5";
  format = "pyproject";
  disabled = pythonOlder "3.6";

@@ -24,7 +24,7 @@ buildPythonPackage rec {
    owner = "bachya";
    repo = pname;
    rev = version;
-    sha256 = "sha256-uqvM5F0rpw+xeCXYl4lGMt3r0ugPsUmSvujmTJ9HABk=";
+    sha256 = "1v8xr69y9cajyrdfz8wdksz1hclh5cvgxppf9lpygwfj4q70wh88";
  };

  nativeBuildInputs = [
@@ -46,12 +46,6 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  postPatch = ''
-    # https://github.com/bachya/aioambient/pull/84
-    substituteInPlace pyproject.toml \
-      --replace 'websockets = "^8.1"' 'websockets = ">=8.1,<10.0"'
-  '';
-
  # Ignore the examples directory as the files are prefixed with test_
  disabledTestPaths = [ "examples/" ];

@@ -12,12 +12,12 @@

 buildPythonPackage rec {
  pname = "apispec";
-  version = "4.7.0";
+  version = "4.7.1";
  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-v6G+yLWyzqZyfgIMOm/hHZYwiN0u1hbhFHXOry1naTc=";
+    sha256 = "1yf71c9nq1rfb5pkgmfw486fvywi1bjnmgwxcly7y3basf3980kr";
  };

  propagatedBuildInputs = [
@@ -1,14 +1,27 @@
-{ lib, buildPythonPackage, fetchPypi }:
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, python
+}:

 buildPythonPackage rec {
  pname = "bitstring";
-  version = "3.1.7";
+  version = "3.1.9";

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0jl6192dwrlm5ybkbh7ywmyaymrc3cmz9y07nm7qdli9n9rfpwzx";
+  src = fetchFromGitHub {
+    owner = "scott-griffiths";
+    repo = pname;
+    rev = "bitstring-${version}";
+    sha256 = "0y2kcq58psvl038r6dhahhlhp1wjgr5zsms45wyz1naq6ri8x9qa";
  };

+  checkPhase = ''
+    cd test
+    ${python.interpreter} -m unittest discover
+  '';
+
+  pythonImportsCheck = [ "bitstring" ];
+
  meta = with lib; {
    description = "Module for binary data manipulation";
    homepage = "https://github.com/scott-griffiths/bitstring";
@@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "dipy";
-  version = "1.3.0";
+  version = "1.4.1";

  disabled = isPy27;

@@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner  = "dipy";
    repo   = pname;
    rev    = version;
-    sha256 = "0555abx0fwqmk6dc3im7r45d9j7r9xh6gm9mbwfwvlf7laf8h098";
+    sha256 = "0zaqsiq73vprbqbzvzswjfmqgappl5vhpl2fwjrrda33c27klpzj";
  };

  nativeBuildInputs = [ cython packaging ];
@@ -1,23 +1,23 @@
 { lib
 , buildPythonPackage
-, fetchPypi
-, isPy3k
+, fetchFromGitHub
 , pythonOlder
 , importlib-metadata
 , matplotlib
 , numpy
-, exdown
 , pytestCheckHook
 }:

 buildPythonPackage rec {
  pname = "dufte";
-  version = "0.2.12";
-  disabled = !isPy3k;
+  version = "0.2.27";
+  disabled = pythonOlder "3.6";

-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0ag1d7h1wijkc7v2vpgkbqjlnpiwd4nh8zhxiby0989bpmlp3jr3";
+  src = fetchFromGitHub {
+    owner = "nschloe";
+    repo = pname;
+    rev = version;
+    sha256 = "1i68h224hx9clxj3l0rd2yigsi6fqsr3x10vj5hf3j6s69iah7r3";
  };
  format = "pyproject";

@@ -28,13 +28,10 @@ buildPythonPackage rec {
    importlib-metadata
  ];

-  preCheck = ''
-    export HOME=$TMPDIR
-    mkdir -p $HOME/.matplotlib
-    echo "backend: ps" > $HOME/.matplotlib/matplotlibrc
-  '';
+  checkInputs = [
+    pytestCheckHook
+  ];

-  checkInputs = [ exdown pytestCheckHook ];
  pythonImportsCheck = [ "dufte" ];

  meta = with lib; {
@@ -6,13 +6,13 @@

 buildPythonPackage rec {
  pname = "emoji";
-  version = "1.4.0";
+  version = "1.4.1";

  src = fetchFromGitHub {
    owner = "carpedm20";
    repo = pname;
    rev = "v.${version}";
-    sha256 = "0xksxdld20sh3c2s6pry1fm2br9xq8ypdq5pf971fpg5pk2f4iy9";
+    sha256 = "0gakvh8hfmfdjyp46bl18b2zm3grm3k5shiqrpzqlipbaxb7ifrk";
  };

  checkInputs = [
@@ -11,7 +11,7 @@

 buildPythonPackage rec {
  pname = "motioneye-client";
-  version = "0.3.10";
+  version = "0.3.11";
  format = "pyproject";
  disabled = pythonOlder "3.8";

@@ -19,7 +19,7 @@ buildPythonPackage rec {
    owner = "dermotduffy";
    repo = pname;
    rev = "v${version}";
-    sha256 = "0ilh9wfzggnbfz068vkz66g64ar6isl3m2vcp7jf2zbaj0bqsjax";
+    sha256 = "0f34ig8njyn7dzy8272m0b1nlnnhir58ar3vx4zps10i0dc32hb2";
  };

  nativeBuildInputs = [
@@ -1,24 +1,45 @@
-{ lib, buildPythonPackage, pythonOlder, fetchFromGitLab
-, gobject-introspection, idna, libsoup, precis-i18n, pygobject3, pyopenssl
+{ lib
+, buildPythonPackage
+, pythonOlder
+, fetchFromGitLab
+, gobject-introspection
+, idna
+, libsoup
+, precis-i18n
+, pygobject3
+, pyopenssl
+, pytestCheckHook
 }:

 buildPythonPackage rec {
  pname = "nbxmpp";
-  version = "2.0.2";
+  version = "2.0.3";

  disabled = pythonOlder "3.7";

-  # Tests aren't included in PyPI tarball.
  src = fetchFromGitLab {
    domain = "dev.gajim.org";
    owner = "gajim";
    repo = "python-nbxmpp";
    rev = "nbxmpp-${version}";
-    sha256 = "0z27mxgfk7hvpx0xdrd8g9441rywv74yk7s83zjnc2mc7xvpwhf4";
+    sha256 = "0gzyd25sja7n49f1ihyg6gch1b0r409r0p3qpwn8w8xy7jgn6ysc";
  };

-  buildInputs = [ precis-i18n ];
-  propagatedBuildInputs = [ gobject-introspection idna libsoup pygobject3 pyopenssl ];
+  buildInputs = [
+    precis-i18n
+  ];
+
+  propagatedBuildInputs = [
+    gobject-introspection
+    idna
+    libsoup
+    pygobject3
+    pyopenssl
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];

  pythonImportsCheck = [ "nbxmpp" ];

@@ -4,15 +4,17 @@
 , nose
 , numpy
 , quantities
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "neo";
-  version = "0.9.0";
+  version = "0.10.0";
+  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "6e31c88d7c52174fa2512df589b2b5003e9471fde27fca9f315f4770ba3bd3cb";
+    sha256 = "0lw3r9p1ky1cswhrs9radc0vq1qfzbrk7qd00f34g96g30zab4g5";
  };

  propagatedBuildInputs = [ numpy quantities ];
@@ -7,20 +7,20 @@
 , pipdate
 , tqdm
 , rich
-, pytest
-, isPy27
+, pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "perfplot";
-  version = "0.9.5";
-  disabled = isPy27;
+  version = "0.9.6";
+  disabled = pythonOlder "3.7";

  src = fetchFromGitHub {
    owner = "nschloe";
-    repo = "perfplot";
+    repo = pname;
    rev = "v${version}";
-    sha256 = "1nr31a7qvipqjycw2flkabnhnc4drbi1xpjm8yjxw2gjzznd1jg4";
+    sha256 = "11f31d6xqxp04693symc2dl8890gjaycrb2a35y5xy023abwir5b";
  };
  format = "pyproject";

@@ -34,20 +34,15 @@ buildPythonPackage rec {
  ];

  checkInputs = [
-    pytest
+    pytestCheckHook
  ];

-  checkPhase = ''
-    export HOME=$TMPDIR
-    mkdir -p $HOME/.matplotlib
-    echo "backend: ps" > $HOME/.matplotlib/matplotlibrc
-    pytest test/perfplot_test.py
-  '';
+  pythonImportsCheck = [ "perfplot" ];

  meta = with lib; {
    description = "Performance plots for Python code snippets";
    homepage = "https://github.com/nschloe/perfplot";
    license = licenses.mit;
-    maintainers = [ maintainers.costrouc ];
+    maintainers = with maintainers; [ costrouc ];
  };
 }
@@ -8,12 +8,12 @@

 buildPythonPackage rec {
  pname = "pg8000";
-  version = "1.20.0";
+  version = "1.21.0";
  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-SQ7CKpJgHwRUs+1MjU7N3DD2bA4/eD8OzFgQN3SajFU=";
+    sha256 = "1msj0vk14fbsis8yfk0my1ygpcli9jz3ivwdi9k6ii5i6330i4f9";
  };

  propagatedBuildInputs = [
@@ -21,11 +21,6 @@ buildPythonPackage rec {
    scramp
  ];

-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "scramp==1.4.0" "scramp>=1.4.0"
-  '';
-
  # Tests require a running PostgreSQL instance
  doCheck = false;
  pythonImportsCheck = [ "pg8000" ];
@@ -6,11 +6,11 @@

 buildPythonPackage rec {
  pname = "phonenumbers";
-  version = "8.12.26";
+  version = "8.12.28";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-Zbq269vg7FGWx0YmlJdI21M30jiVqrwe+PXXKEeHmYo=";
+    sha256 = "1g86bf791lr9ggrfgllah9liwa3bx917h9ffrdb01kjwdna4zsj2";
  };

  checkInputs = [
@@ -2,23 +2,23 @@
 , buildPythonPackage
 , fetchPypi
 , pythonOlder
-, isPy27
 , appdirs
 , importlib-metadata
 , requests
-, pytest
+, rich
+, setuptools
 , wheel
 }:

 buildPythonPackage rec {
  pname = "pipdate";
-  version = "0.5.2";
+  version = "0.5.5";
  format = "pyproject";
-  disabled = isPy27; # abandoned
+  disabled = pythonOlder "3.6";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "507065231f2d50b6319d483432cba82aadad78be21b7a2969b5881ed8dee9ab4";
+    sha256 = "03hr9i691cpg9q2xc1xr4lpd90xs8rba0xjh6qmc1vg7lgcdgbaa";
  };

  nativeBuildInputs = [ wheel ];
@@ -26,25 +26,19 @@ buildPythonPackage rec {
  propagatedBuildInputs = [
    appdirs
    requests
+    rich
+    setuptools
  ] ++ lib.optionals (pythonOlder "3.8") [
    importlib-metadata
  ];

-  checkInputs = [
-    pytest
-  ];
-
-  checkPhase = ''
-    HOME=$(mktemp -d) pytest test/test_pipdate.py
-  '';
-
-  # tests require network access
+  # Tests require network access and pythonImportsCheck requires configuration file
  doCheck = false;

  meta = with lib; {
    description = "pip update helpers";
    homepage = "https://github.com/nschloe/pipdate";
-    license = licenses.mit;
-    maintainers = [ maintainers.costrouc ];
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ costrouc ];
  };
 }
@@ -4,19 +4,19 @@
 , requests
 , tqdm
 , websocket-client
-, isPy27
+, pythonOlder
 }:

 buildPythonPackage rec {
-  pname = "PlexAPI";
-  version = "4.6.1";
-  disabled = isPy27;
+  pname = "plexapi";
+  version = "4.7.0";
+  disabled = pythonOlder "3.5";

  src = fetchFromGitHub {
    owner = "pkkid";
    repo = "python-plexapi";
    rev = version;
-    sha256 = "sha256-WL5UBsvAdtfOCkVX9NI0Z2fJ2CAO+NwD8wvkvkJ2uww=";
+    sha256 = "1gh36ln9ki69rs7ml9syqq956i996rdi145qffjwb3736zylrzkp";
  };

  propagatedBuildInputs = [
@@ -27,6 +27,7 @@ buildPythonPackage rec {

  # Tests require a running Plex instance
  doCheck = false;
+
  pythonImportsCheck = [ "plexapi" ];

  meta = with lib; {
@@ -1,31 +1,37 @@
 { lib
 , buildPythonPackage
-, isPy27
-, fetchPypi
-, pybind11
-, exdown
+, fetchFromGitHub
+, importlib-metadata
 , numpy
+, pybind11
 , pytestCheckHook
+, pythonOlder
 }:

 buildPythonPackage rec {
  pname = "pyfma";
  version = "0.1.4";
+  disabled = pythonOlder "3.7";

-  disabled = isPy27;
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "5bc6bf57d960a5232b7a56bd38e9fe3dce0911016746029931044b66bdec46e9";
+  src = fetchFromGitHub {
+    owner = "nschloe";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1wkcl41j2d1yflc5dl30ys1yxx68w9zn3vj8brwkm1ar9jnfmg4h";
  };
+  format = "pyproject";

  buildInputs = [
    pybind11
  ];

-  checkInputs = [
-    exdown
+  propagatedBuildInputs = [
    numpy
+  ] ++ lib.optionals (pythonOlder "3.8") [
+    importlib-metadata
+  ];
+
+  checkInputs = [
    pytestCheckHook
  ];

@@ -35,6 +41,6 @@ buildPythonPackage rec {
    description = "Fused multiply-add for Python";
    homepage = "https://github.com/nschloe/pyfma";
    license = licenses.mit;
-    maintainers = [ maintainers.costrouc];
+    maintainers = with maintainers; [ costrouc ];
  };
 }
@@ -2,7 +2,6 @@
 , buildPythonPackage
 , fetchFromGitHub
 , pytest-asyncio
-, pytest-cov
 , pytest-timeout
 , pytestCheckHook
 , pythonOlder
@@ -11,19 +10,18 @@

 buildPythonPackage rec {
  pname = "pypck";
-  version = "0.7.10";
+  version = "0.7.11";
  disabled = pythonOlder "3.8";

  src = fetchFromGitHub {
    owner = "alengwenus";
    repo = pname;
    rev = version;
-    sha256 = "sha256-B2imewEONewj1Y+Q316reIBZB/b9WQAu67x9cLMkRTU=";
+    sha256 = "1jj0y487qcxrprx4x2rs6r7rqsf5m9khk0xhigbvnbyvh8rsd2jr";
  };

  checkInputs = [
    pytest-asyncio
-    pytest-cov
    pytest-timeout
    pytestCheckHook
  ];
@@ -9,11 +9,11 @@

 buildPythonPackage rec {
  pname = "pysma";
-  version = "0.6.4";
+  version = "0.6.5";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-hnvbQOilsoHn1qc/pKJ2Eq1VwJi+HbGlAAJwiME1Pgc=";
+    sha256 = "0kabwx8mi2kkbxxg7abnxwggxvidjrzgp5yidiyll5iba0ghhgnw";
  };

  propagatedBuildInputs = [
@@ -29,11 +29,11 @@

 buildPythonPackage rec {
  pname = "sentry-sdk";
-  version = "1.3.0";
+  version = "1.3.1";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "sha256-UhCnEt1X2I0iXB/D/jo2Jv7kk2N7zVTiBIJs8EuNdpw=";
+    sha256 = "0v72zzghlk6kvjg7fg4c4mfr1kasnwlpjzk1wyqd864nz9293sgb";
  };

  checkInputs = [ blinker botocore chalice django flask tornado bottle rq falcon sqlalchemy werkzeug trytond
@@ -1,5 +1,5 @@
 { stdenv, bazel_3, buildBazelPackage, isPy3k, lib, fetchFromGitHub, symlinkJoin
-, addOpenGLRunpath
+, addOpenGLRunpath, fetchpatch
 # Python deps
 , buildPythonPackage, pythonOlder, pythonAtLeast, python
 # Python libraries
@@ -114,6 +114,12 @@ let
    };

    patches = [
+      # included from 2.6.0 onwards
+      (fetchpatch {
+        name = "fix-numpy-1.20-notimplementederror.patch";
+        url = "https://github.com/tensorflow/tensorflow/commit/b258941525f496763d4277045b6513c815720e3a.patch";
+        sha256 = "19f9bzrcfsynk11s2hqvscin5c65zf7r6g3nb10jnimw79vafiry";
+      })
      # Relax too strict Python packages versions dependencies.
      ./relax-dependencies.patch
      # Add missing `io_bazel_rules_docker` dependency.
@@ -10,11 +10,11 @@ in

 stdenv.mkDerivation rec {
  pname = "liquibase";
-  version = "4.4.1";
+  version = "4.4.2";

  src = fetchurl {
    url = "https://github.com/liquibase/liquibase/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-2Y/eRIkskuk+7GC/br178XzWTnP4iXSFfa5ybLjvqDA=";
+    sha256 = "sha256-qOKMyqf3KX7pWjslVgcPiGlTiwvMZLvm7DiatmSLd1U=";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -1,6 +1,6 @@
 { lib, buildDunePackage, fetchurl, makeWrapper
 , curly, fmt, bos, cmdliner, re, rresult, logs
-, odoc, opam-format, opam-core, opam-state, yojson
+, odoc, opam-format, opam-core, opam-state, yojson, astring
 , opam, git, findlib, mercurial, bzip2, gnutar, coreutils
 , alcotest, mdx
 }:
@@ -10,18 +10,18 @@
 let runtimeInputs = [ opam findlib git mercurial bzip2 gnutar coreutils ];
 in buildDunePackage rec {
  pname = "dune-release";
-  version = "1.4.0";
+  version = "1.5.0";

  minimumOCamlVersion = "4.06";

  src = fetchurl {
    url = "https://github.com/ocamllabs/${pname}/releases/download/${version}/${pname}-${version}.tbz";
-    sha256 = "1frinv1rsrm30q6jclicsswpshkdwwdgxx7sp6q9w4c2p211n1ln";
+    sha256 = "1lyfaczskdbqnhmpiy6wga9437frds3m8prfk2rhwyb96h69y3pv";
  };

  nativeBuildInputs = [ makeWrapper ];
  buildInputs = [ curly fmt cmdliner re opam-format opam-state opam-core
-                  rresult logs odoc bos yojson ];
+                  rresult logs odoc bos yojson astring ];
  checkInputs = [ alcotest mdx ] ++ runtimeInputs;
  doCheck = true;

@@ -32,16 +32,16 @@ in buildDunePackage rec {
    # to have a fixed path to the binary in nix store
    sed -i '/must_exist (Cmd\.v "curl"/d' lib/github.ml

-    # fix problems with git invocations in tests
-    for f in tests/bin/{delegate_info,errors,tag,no_doc,x-commit-hash}/run.t; do
-      # set bogus user info in git so git commit doesn't fail
-      sed -i '/git init/ a \    $ git config user.name test; git config user.email "pseudo@pseudo.invalid"' "$f"
-      # surpress hint to set default branch name
-      substituteInPlace "$f" --replace "git init" "git init -b main"
-    done
-
    # ignore weird yes error message
-    sed -i 's/yes |/yes 2>\/dev\/null |/' tests/bin/no_doc/run.t
+    sed -i 's/yes |/yes 2>\/dev\/null |/' \
+      tests/bin/no_doc/run.t \
+      tests/bin/draft/run.t \
+      tests/bin/url-file/run.t
+  '';
+
+  preCheck = ''
+    # it fails when it tries to reference "./make_check_deterministic.exe"
+    rm -fr tests/bin/check
  '';

  # tool specific env vars have been deprecated, use PATH
@@ -6,62 +6,74 @@ assert lib.versionAtLeast ocaml.version "4.02.3";

 let
  srcs = {
-    cmdliner = fetchurl {
-      url = "http://erratique.ch/software/cmdliner/releases/cmdliner-1.0.2.tbz";
-      sha256 = "18jqphjiifljlh9jg8zpl6310p3iwyaqphdkmf89acyaix0s4kj1";
+    "0install-solver" = fetchurl {
+      url = "https://github.com/0install/0install/releases/download/v2.17/0install-v2.17.tbz";
+      sha256 = "08q95mzmf9pyyqs68ff52422f834hi313cxmypwrxmxsabcfa10p";
    };
-    cppo = fetchurl {
-      url = "https://github.com/ocaml-community/cppo/releases/download/v1.6.6/cppo-v1.6.6.tbz";
-      sha256 = "185q0x54id7pfc6rkbjscav8sjkrg78fz65rgfw7b4bqlyb2j9z7";
+    "cmdliner" = fetchurl {
+      url = "http://erratique.ch/software/cmdliner/releases/cmdliner-1.0.4.tbz";
+      sha256 = "1h04q0zkasd0mw64ggh4y58lgzkhg6yhzy60lab8k8zq9ba96ajw";
    };
-    cudf = fetchurl {
+    "cppo" = fetchurl {
+      url = "https://github.com/ocaml-community/cppo/releases/download/v1.6.7/cppo-v1.6.7.tbz";
+      sha256 = "17ajdzrnmnyfig3s6hinb56mcmhywbssxhsq32dz0v90dhz3wmfv";
+    };
+    "cudf" = fetchurl {
      url = "https://gforge.inria.fr/frs/download.php/36602/cudf-0.9.tar.gz";
      sha256 = "0771lwljqwwn3cryl0plny5a5dyyrj4z6bw66ha5n8yfbpcy8clr";
    };
-    dose3 = fetchurl {
+    "dose3" = fetchurl {
      url = "https://gforge.inria.fr/frs/download.php/file/36063/dose3-5.0.1.tar.gz";
      sha256 = "00yvyfm4j423zqndvgc1ycnmiffaa2l9ab40cyg23pf51qmzk2jm";
    };
-    dune-local = fetchurl {
-      url = "https://github.com/ocaml/dune/releases/download/1.6.3/dune-1.6.3.tbz";
-      sha256 = "0dmf0wbfmgdy5plz1bjiisc2hjgblvxsnrqjmw2c8y45v1h23mdz";
+    "dune-local" = fetchurl {
+      url = "https://github.com/ocaml/dune/releases/download/2.9.0/dune-2.9.0.tbz";
+      sha256 = "07m476kgagpd6kzm3jq30yfxqspr2hychah0xfqs14z82zxpq8dv";
    };
-    extlib = fetchurl {
+    "extlib" = fetchurl {
      url = "https://ygrek.org/p/release/ocaml-extlib/extlib-1.7.7.tar.gz";
      sha256 = "1sxmzc1mx3kg62j8kbk0dxkx8mkf1rn70h542cjzrziflznap0s1";
    };
-    mccs = fetchurl {
-      url = "https://github.com/AltGr/ocaml-mccs/archive/1.1+11.tar.gz";
-      sha256 = "0mswapf37rav8nvvbjc4c7c7wnl6qwgd3c5v0nfifmr910qygz72";
+    "mccs" = fetchurl {
+      url = "https://github.com/AltGr/ocaml-mccs/archive/1.1+13.tar.gz";
+      sha256 = "05nnji9h8mss3hzjr5faid2v3xfr7rcv2ywmpcxxp28y6h2kv9gv";
    };
-    ocamlgraph = fetchurl {
-      url = "http://ocamlgraph.lri.fr/download/ocamlgraph-1.8.8.tar.gz";
-      sha256 = "0m9g16wrrr86gw4fz2fazrh8nkqms0n863w7ndcvrmyafgxvxsnr";
+    "ocamlgraph" = fetchurl {
+      url = "https://github.com/backtracking/ocamlgraph/releases/download/2.0.0/ocamlgraph-2.0.0.tbz";
+      sha256 = "029692bvdz3hxpva9a2jg5w5381fkcw55ysdi8424lyyjxvjdzi0";
    };
-    opam-file-format = fetchurl {
-      url = "https://github.com/ocaml/opam-file-format/archive/2.0.0.tar.gz";
-      sha256 = "0cjw69r7iilidi7b6arr92kjnjspchvwnmwr1b1gyaxqxpr2s98m";
+    "opam-0install-cudf" = fetchurl {
+      url = "https://github.com/ocaml-opam/opam-0install-solver/releases/download/v0.4.2/opam-0install-cudf-v0.4.2.tbz";
+      sha256 = "10wma4hh9l8hk49rl8nql6ixsvlz3163gcxspay5fwrpbg51fmxr";
    };
-    re = fetchurl {
+    "opam-file-format" = fetchurl {
+      url = "https://github.com/ocaml/opam-file-format/archive/2.1.3.tar.gz";
+      sha256 = "1bqyrlsvmjf4gqzmzbiyja9m1ph30ic9i18x23p5ziymyylw2sfg";
+    };
+    "re" = fetchurl {
      url = "https://github.com/ocaml/ocaml-re/releases/download/1.9.0/re-1.9.0.tbz";
      sha256 = "1gas4ky49zgxph3870nffzkr6y41kkpqp4nj38pz1gh49zcf12aj";
    };
-    result = fetchurl {
-      url = "https://github.com/janestreet/result/archive/1.4.tar.gz";
-      sha256 = "1cjlncnzkwc6zr4v8dgy8nin490blbyxzwwp0qh0cla7s3q2jw0n";
+    "result" = fetchurl {
+      url = "https://github.com/janestreet/result/releases/download/1.5/result-1.5.tbz";
+      sha256 = "0cpfp35fdwnv3p30a06wd0py3805qxmq3jmcynjc3x2qhlimwfkw";
    };
-    seq = fetchurl {
-      url = "https://github.com/c-cube/seq/archive/0.1.tar.gz";
-      sha256 = "02lb2d9i12bxrz2ba5wygk2bycan316skqlyri0597q7j9210g8r";
+    "seq" = fetchurl {
+      url = "https://github.com/c-cube/seq/archive/0.2.2.tar.gz";
+      sha256 = "1ck15v3pg8bacdg6d6iyp2jc3kgrzxk5jsgzx3287x2ycb897j53";
+    };
+    "stdlib-shims" = fetchurl {
+      url = "https://github.com/ocaml/stdlib-shims/releases/download/0.3.0/stdlib-shims-0.3.0.tbz";
+      sha256 = "0jnqsv6pqp5b5g7lcjwgd75zqqvcwcl5a32zi03zg1kvj79p5gxs";
    };
    opam = fetchurl {
-      url = "https://github.com/ocaml/opam/archive/2.0.8.zip";
-      sha256 = "1h55jh4nnx1fcn7v7ss3fgxrn6ixkgnq7pvg5njz8c9xq4njwbc1";
+      url = "https://github.com/ocaml/opam/archive/2.1.0.zip";
+      sha256 = "063df5gsvp4yrbqbnd8k7a1f04cf12prc5wh4f1200acs3jwjxwb";
    };
  };
 in stdenv.mkDerivation {
  pname = "opam";
-  version = "2.0.8";
+  version = "2.1.0";

  nativeBuildInputs = [ makeWrapper unzip ];
  buildInputs = [ curl ncurses ocaml getconf ] ++ lib.optional stdenv.isLinux bubblewrap;
@@ -69,18 +81,21 @@ in stdenv.mkDerivation {
  src = srcs.opam;

  postUnpack = ''
-    ln -sv ${srcs.cmdliner} $sourceRoot/src_ext/cmdliner.tbz
-    ln -sv ${srcs.cppo} $sourceRoot/src_ext/cppo.tbz
-    ln -sv ${srcs.cudf} $sourceRoot/src_ext/cudf.tar.gz
-    ln -sv ${srcs.dose3} $sourceRoot/src_ext/dose3.tar.gz
-    ln -sv ${srcs.dune-local} $sourceRoot/src_ext/dune-local.tbz
-    ln -sv ${srcs.extlib} $sourceRoot/src_ext/extlib.tar.gz
-    ln -sv ${srcs.mccs} $sourceRoot/src_ext/mccs.tar.gz
-    ln -sv ${srcs.ocamlgraph} $sourceRoot/src_ext/ocamlgraph.tar.gz
-    ln -sv ${srcs.opam-file-format} $sourceRoot/src_ext/opam-file-format.tar.gz
-    ln -sv ${srcs.re} $sourceRoot/src_ext/re.tbz
-    ln -sv ${srcs.result} $sourceRoot/src_ext/result.tar.gz
-    ln -sv ${srcs.seq} $sourceRoot/src_ext/seq.tar.gz
+    ln -sv ${srcs."0install-solver"} $sourceRoot/src_ext/0install-solver.tbz
+    ln -sv ${srcs."cmdliner"} $sourceRoot/src_ext/cmdliner.tbz
+    ln -sv ${srcs."cppo"} $sourceRoot/src_ext/cppo.tbz
+    ln -sv ${srcs."cudf"} $sourceRoot/src_ext/cudf.tar.gz
+    ln -sv ${srcs."dose3"} $sourceRoot/src_ext/dose3.tar.gz
+    ln -sv ${srcs."dune-local"} $sourceRoot/src_ext/dune-local.tbz
+    ln -sv ${srcs."extlib"} $sourceRoot/src_ext/extlib.tar.gz
+    ln -sv ${srcs."mccs"} $sourceRoot/src_ext/mccs.tar.gz
+    ln -sv ${srcs."ocamlgraph"} $sourceRoot/src_ext/ocamlgraph.tbz
+    ln -sv ${srcs."opam-0install-cudf"} $sourceRoot/src_ext/opam-0install-cudf.tbz
+    ln -sv ${srcs."opam-file-format"} $sourceRoot/src_ext/opam-file-format.tar.gz
+    ln -sv ${srcs."re"} $sourceRoot/src_ext/re.tbz
+    ln -sv ${srcs."result"} $sourceRoot/src_ext/result.tbz
+    ln -sv ${srcs."seq"} $sourceRoot/src_ext/seq.tar.gz
+    ln -sv ${srcs."stdlib-shims"} $sourceRoot/src_ext/stdlib-shims.tbz
  '';

  patches = [ ./opam-shebangs.patch ];
@@ -118,4 +133,4 @@ in stdenv.mkDerivation {
    platforms = platforms.all;
  };
 }
-# Generated by: ./opam.nix.pl -v 2.0.8 -p opam-shebangs.patch
+# Generated by: ./opam.nix.pl -v 2.1.0 -p opam-shebangs.patch
@@ -2,7 +2,7 @@ diff --git a/src/client/opamInitDefaults.ml b/src/client/opamInitDefaults.ml
 index eca13a7c..1fd66f43 100644
 --- a/src/client/opamInitDefaults.ml
 +++ b/src/client/opamInitDefaults.ml
-@@ -35,11 +35,15 @@ let eval_variables = [
+@@ -35,14 +35,18 @@ let eval_variables = [
 let os_filter os =
   FOp (FIdent ([], OpamVariable.of_string "os", None), `Eq, FString os)
 
@@ -13,6 +13,9 @@ index eca13a7c..1fd66f43 100644
 let macos_filter = os_filter "macos"
 let openbsd_filter = os_filter "openbsd"
 let freebsd_filter = os_filter "freebsd"
+ let not_open_free_bsd_filter =
+   FNot (FOr (openbsd_filter,  freebsd_filter))
+ let win32_filter = os_filter "win32"
 let sandbox_filter = FOr (linux_filter, macos_filter)
 +let nixos_filter = os_distribution_filter "nixos"
 
@@ -51,7 +51,7 @@ for my $src (sort keys %urls) {
  system "echo \Q$md5s{$src}\E' *'\Q$store_path\E | md5sum -c 1>&2";
  die "md5 check failed for $urls{$src}\n" if $?;
  print <<"EOF";
-    $src = fetchurl {
+    "$src" = fetchurl {
      url = "$urls{$src}";
      sha256 = "$sha256";
    };
@@ -68,8 +68,8 @@ in stdenv.mkDerivation {
  pname = "opam";
  version = "$OPAM_RELEASE";

-  nativeBuildInputs = [ unzip ];
-  buildInputs = [ curl ncurses ocaml makeWrapper getconf ] ++ lib.optional stdenv.isLinux bubblewrap;
+  nativeBuildInputs = [ makeWrapper unzip ];
+  buildInputs = [ curl ncurses ocaml getconf ] ++ lib.optional stdenv.isLinux bubblewrap;

  src = srcs.opam;

@@ -79,7 +79,7 @@ for my $src (sort keys %urls) {
  my($ext) = $urls{$src} =~ /(\.(?:t(?:ar\.|)|)(?:gz|bz2?))$/
    or die "could not find extension for $urls{$src}\n";
  print <<"EOF";
-    ln -sv \${srcs.$src} \$sourceRoot/src_ext/$src$ext
+    ln -sv \${srcs."$src"} \$sourceRoot/src_ext/$src$ext
 EOF
 }
 print <<'EOF';
@@ -52,8 +52,8 @@ let
    };
    "0.47.05" = {
      twbtRelease = "6.xx";
-      dfhackRelease = "0.47.05-beta1";
-      sha256 = "sha256-Y6G0qBMHvotp/oyiqANlzXZVklL270dhskd135PnE9Q=";
+      dfhackRelease = "0.47.05-r1";
+      sha256 = "1nqhaf7271bm9rq9dmilhhk9q7v3841d0rv4y3fid40vfi4gpi3p";
      prerelease = true;
    };
  };
@@ -1,8 +1,8 @@
-{ lib, stdenv, fetchurl, cups }:
+{ lib, stdenv, fetchurl, cups, busybox }:

 stdenv.mkDerivation rec {
  pname = "epson-inkjet-printer-escpr2";
-  version = "1.1.34";
+  version = "1.1.38";

  src = fetchurl {
    # To find new versions, visit
@@ -11,15 +11,26 @@ stdenv.mkDerivation rec {
    # version.
    # NOTE: Don't forget to update the webarchive link too!
    urls = [
-      "https://download3.ebz.epson.net/dsc/f/03/00/12/85/48/fd5de1ecd7270b0398399355e265c99dfd1dbafb/epson-inkjet-printer-escpr2-1.1.34.tar.gz"
-      "https://web.archive.org/web/20210627160654/https://download3.ebz.epson.net/dsc/f/03/00/12/85/48/fd5de1ecd7270b0398399355e265c99dfd1dbafb/epson-inkjet-printer-escpr2-1.1.34.tar.gz"
+      "https://download3.ebz.epson.net/dsc/f/03/00/12/91/84/6902a4d11864b195ddda45f6de968d8ec1ee9e3b/epson-inkjet-printer-escpr2-1.1.38-1lsb3.2.src.rpm"
+      "https://web.archive.org/web/20210731163511/https://download3.ebz.epson.net/dsc/f/03/00/12/91/84/6902a4d11864b195ddda45f6de968d8ec1ee9e3b/epson-inkjet-printer-escpr2-1.1.38-1lsb3.2.src.rpm"
    ];
-    sha256 = "sha256-sHBGWbkZ+zolHehyXQR8U2AyKSrgDSPmrkrcfcx/bAs=";
+    sha256 = "sha256-rQtmWREZKtu5MuqEn91/1+SfGol4f8jKzd1mQ0e3h1c=";
  };

+  unpackPhase = ''
+    runHook preUnpack
+
+    rpm2cpio $src | cpio -idmv
+    tar xvf ${pname}-${version}-1lsb3.2.tar.gz
+    cd ${pname}-${version}
+
+    runHook postUnpack
+  '';
+
  patches = [ ./cups-filter-ppd-dirs.patch ];

  buildInputs = [ cups ];
+  nativeBuildInputs = [ busybox ];

  meta = with lib; {
    homepage = "http://download.ebz.epson.net/dsc/search/01/search/";
@@ -18,26 +18,15 @@
 , wrapQtAppsHook
 }:

-let
-  desktopItem = makeDesktopItem {
-    name = "mgba";
-    exec = "mgba-qt";
-    icon = "mgba";
-    comment = "A Game Boy Advance Emulator";
-    desktopName = "mgba";
-    genericName = "Game Boy Advance Emulator";
-    categories = "Game;Emulator;";
-    startupNotify = "false";
-  };
-in stdenv.mkDerivation rec {
+stdenv.mkDerivation rec {
  pname = "mgba";
-  version = "0.9.0";
+  version = "0.9.2";

  src = fetchFromGitHub {
    owner = "mgba-emu";
    repo = "mgba";
    rev = version;
-    hash = "sha256-JVauGyHJVfiXVG4Z+Ydh1lRypy5rk9SKeTbeHFNFYJs=";
+    hash = "sha256-A48PVUCekdRYel/BddPCeIcEDllOvcU7pk4i4P58dpo=";
  };

  nativeBuildInputs = [
@@ -59,9 +48,21 @@ in stdenv.mkDerivation rec {
    qttools
  ];

-  postInstall = ''
-    cp -r ${desktopItem}/share/applications $out/share
-  '';
+  postInstall = let
+    desktopItem = makeDesktopItem {
+      name = "mgba";
+      exec = "mgba-qt";
+      icon = "mgba";
+      comment = "A Game Boy Advance Emulator";
+      desktopName = "mgba";
+      genericName = "Game Boy Advance Emulator";
+      categories = "Game;Emulator;";
+      startupNotify = "false";
+    };
+  in
+    ''
+      cp -r ${desktopItem}/share/applications $out/share
+    '';

  meta = with lib; {
    homepage = "https://mgba.io";
@@ -1,28 +1,55 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config
+{ lib
+, stdenv
+, fetchFromGitHub
+, pkg-config
+, SDL2
+, SDL2_image
+, SDL2_ttf
+, alsa-lib
+, freetype
+, glew
+, libGL
+, libogg
+, libpng
+, libtheora
+, libvorbis
 , python
-, alsa-lib, glew, libGL, libpng
-, libogg, libtheora, libvorbis
-, SDL2, SDL2_image, SDL2_ttf
-, freetype, tcl, zlib
+, tcl
+, zlib
 }:

 stdenv.mkDerivation rec {
  pname = "openmsx";
-  version = "16.0";
+  version = "17.0";

  src = fetchFromGitHub {
    owner = "openMSX";
    repo = "openMSX";
    rev = "RELEASE_${builtins.replaceStrings ["."] ["_"] version}";
-    sha256 = "04sphn9ph378r0qv881riv90cgz58650jcqcwmi1mv6gbcb3img5";
+    sha256 = "sha256-9PdUNahJZ2O6ASkzLW/uudP3hiIzTDpxzFy6Pjb8JiU=";
    fetchSubmodules = true;
  };

-  nativeBuildInputs = [ pkg-config python ];
+  nativeBuildInputs = [
+    pkg-config
+    python
+  ];

-  buildInputs = [ alsa-lib glew libGL libpng
-    libogg libtheora libvorbis freetype
-    SDL2 SDL2_image SDL2_ttf tcl zlib ];
+  buildInputs = [
+    SDL2
+    SDL2_image
+    SDL2_ttf
+    alsa-lib
+    freetype
+    glew
+    libGL
+    libogg
+    libpng
+    libtheora
+    libvorbis
+    tcl
+    zlib
+  ];

  postPatch = ''
    cp ${./custom-nix.mk} build/custom.mk
@@ -30,19 +57,19 @@ stdenv.mkDerivation rec {

  dontAddPrefix = true;

-  # Many thanks @mthuurne from OpenMSX project
-  # for providing support to Nixpkgs :)
+  # Many thanks @mthuurne from OpenMSX project for providing support to
+  # Nixpkgs! :)
  TCL_CONFIG="${tcl}/lib/";

-  meta = with lib;{
+  meta = with lib; {
+    homepage = "https://openmsx.org";
    description = "The MSX emulator that aims for perfection";
    longDescription = ''
      OpenMSX is an emulator for the MSX home computer system. Its goal is
      to emulate all aspects of the MSX with 100% accuracy.
    '';
-    homepage = "https://openmsx.org";
+    license = with licenses; [ bsd2 boost gpl2Plus ];
    maintainers = with maintainers; [ AndersonTorres ];
    platforms = platforms.unix;
-    license = with licenses; [ bsd2 boost gpl2 ];
  };
 }
@@ -7,13 +7,13 @@

 stdenv.mkDerivation rec {
  pname = "stella";
-  version = "6.5.2";
+  version = "6.5.3";

  src = fetchFromGitHub {
    owner = "stella-emu";
    repo = pname;
    rev = version;
-    hash = "sha256-CDLMOqSgRx75tjBoLycis/cckCNwgdlb9TRBlD3Dd04=";
+    hash = "sha256-Y9rEh9PZalQNj+d7OXN/8z5P8Hti4R3c2RL1BY+J1y4=";
  };

  nativeBuildInputs = [ pkg-config ];
@@ -433,6 +433,10 @@ self: super: {
      });
  });

+  onedark-nvim = super.onedark-nvim.overrideAttrs (old: {
+    dependencies = with self; [ lush-nvim ];
+  });
+
  onehalf = super.onehalf.overrideAttrs (old: {
    configurePhase = "cd vim";
  });
@@ -141,6 +141,15 @@ in rec {
        cp -r ${MacOSX-SDK}/usr/include/libDER $out/include
      '';
    };
+
+    simd = stdenv.mkDerivation {
+      name = "apple-lib-simd";
+      dontUnpack = true;
+      installPhase = ''
+        mkdir -p $out/include
+        cp -r ${MacOSX-SDK}/usr/include/simd $out/include
+      '';
+    };
  };

  overrides = super: {
@@ -1,7 +1,7 @@
 { frameworks, libs, libobjc, Libsystem, libnetwork }: with frameworks; with libs;
 {
  AGL                              = { inherit Carbon OpenGL; };
-  AVFoundation                     = { inherit ApplicationServices AVFCapture AVFCore CoreGraphics; };
+  AVFoundation                     = { inherit ApplicationServices AVFCapture AVFCore CoreGraphics simd UniformTypeIdentifiers; };
  AVKit                            = {};
  Accelerate                       = { inherit CoreWLAN IOBluetooth; };
  Accessibility                    = {};
@@ -1,8 +1,9 @@
 { lib, stdenv, buildLinux, fetchFromGitHub, ... } @ args:

 let
-  version = "5.13.5";
-  suffix = "xanmod1-cacule";
+  version = "5.13.7";
+  release = "1";
+  suffix = "xanmod${release}-cacule";
 in
 buildLinux (args // rec {
  inherit version;
@@ -12,7 +13,7 @@ buildLinux (args // rec {
    owner = "xanmod";
    repo = "linux";
    rev = modDirVersion;
-    sha256 = "sha256-Vhshu3mNkQ58TEOUBOuF7jLBlablxg/BioUyd96lI5g=";
+    sha256 = "sha256-6SppDriZWzLu6Qye1e6ciiE+Ro63vDyabxfgWS/PTSo=";
  };

  structuredExtraConfig = with lib.kernel; {
@@ -1,7 +1,7 @@
 { lib, fetchFromGitHub, buildLinux, ... } @ args:

 let
-  version = "5.13.5";
+  version = "5.13.7";
  suffix = "zen1";
 in

@@ -14,11 +14,15 @@ buildLinux (args // {
    owner = "zen-kernel";
    repo = "zen-kernel";
    rev = "v${version}-${suffix}";
-    sha256 = "sha256-3guG482lsdcWqAJ1kY757D4EeOEpTDvy95de0bHif98=";
+    sha256 = "sha256-ZvB5Ejt9MXP4QK5cj9CGQgFJIfDV03IW5xcknCxDui0=";
+  };
+
+  structuredExtraConfig = with lib.kernel; {
+    ZEN_INTERACTIVE = yes;
  };

  extraMeta = {
-    branch = "5.12/master";
+    branch = "5.13";
    maintainers = with lib.maintainers; [ atemu andresilva ];
    description = "Built using the best configuration and kernel sources for desktop, multimedia, and gaming workloads.";
  };
@@ -3,7 +3,7 @@
 } :

 let
-  version = "35.0";
+  version = "36.0";

 in stdenv.mkDerivation {
  pname = "rdma-core";
@@ -13,7 +13,7 @@ in stdenv.mkDerivation {
    owner = "linux-rdma";
    repo = "rdma-core";
    rev = "v${version}";
-    sha256 = "0ra0m1s0029qgcq0li7md6pkri7pcc4iy3cd6jrrqs9c6n1clnnd";
+    sha256 = "0x3mpwmhln6brwrwix9abdq1bs9zi4qnr3r64vwqk7l6f43mqd30";
  };

  nativeBuildInputs = [ cmake pkg-config pandoc docutils ];
@@ -17,11 +17,11 @@ lua = luajitPackages;

 unwrapped = stdenv.mkDerivation rec {
  pname = "knot-resolver";
-  version = "5.3.2";
+  version = "5.4.0";

  src = fetchurl {
    url = "https://secure.nic.cz/files/knot-resolver/${pname}-${version}.tar.xz";
-    sha256 = "8b6f447d5fe93422d4c129a2d4004a977369c3aa6e55258ead1cbd488bc01436";
+    sha256 = "534af671b98433b23b57039acc9d7d3c100a4888a8cf9aeba36161774ca0815e";
  };

  outputs = [ "out" "dev" ];
@@ -43,7 +43,7 @@ unwrapped = stdenv.mkDerivation rec {
    # some tests have issues with network sandboxing, apparently
  + optionalString doInstallCheck ''
    echo 'os.exit(77)' > daemon/lua/trust_anchors.test/bootstrap.test.lua
-    sed '/^[[:blank:]]*test_dstaddr,$/d' -i \
+    sed -E '/^[[:blank:]]*test_(dstaddr|headers),?$/d' -i \
      tests/config/doh2.test.lua modules/http/http_doh.test.lua
  '';

@@ -2,13 +2,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "icingaweb2";
-  version = "2.9.0";
+  version = "2.9.2";

  src = fetchFromGitHub {
    owner = "Icinga";
    repo = "icingaweb2";
    rev = "v${version}";
-    sha256 = "1vp2gdvgvw960178yaqql6iza0rg2h8japsnass3kkrwrmb2liq5";
+    sha256 = "sha256-sCglJDxEUOAcBwNowLjglMi6y92QJ4ZF+I/5HPfTE+s=";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -2,13 +2,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "icingaweb2-ipl";
-  version = "0.6.0";
+  version = "0.6.1";

  src = fetchFromGitHub {
    owner = "Icinga";
    repo = "icinga-php-library";
    rev = "v${version}";
-    sha256 = "0nzvd84r9f1mypfhq4p37hsvkrbd5wzgs1m9qhj45ncvf5rq49f1";
+    sha256 = "sha256-5xlvwB1o6d3mWd0TSybQW9s88q6A7KrledY1L8xaxLU=";
  };

  installPhase = ''
@@ -92,7 +92,10 @@ stdenv.mkDerivation rec {
      "--with-bash-completion-dir=${placeholder "out"}/share/bash-completions/completions"
    ]
    ++ lib.optional (jackaudioSupport && !libOnly) "--enable-jack"
-    ++ lib.optional stdenv.isDarwin "--with-mac-sysroot=/"
+    ++ lib.optionals stdenv.isDarwin [
+      "--with-mac-sysroot=/"
+      "--disable-neon-opt"
+    ]
    ++ lib.optional (stdenv.isLinux && useSystemd) "--with-systemduserunitdir=${placeholder "out"}/lib/systemd/user"
    ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) "--disable-gsettings";

@@ -16,6 +16,11 @@ stdenv.mkDerivation rec {
      url = "https://github.com/Mic92/TTRSS-Auth-LDAP/commit/7534fa54babc377a070e05e326a46a252b5e3884.patch";
      sha256 = "1p7zas0n627z0g226dp5m5dg1ai2z3vi69n3xivp517iv3lch70l";
    })
+    # https://github.com/hydrian/TTRSS-Auth-LDAP/pull/40
+    (fetchpatch {
+      url = "https://github.com/hydrian/TTRSS-Auth-LDAP/commit/557811efa15bab3b5044c98416f9e37264f11c9a.patch";
+      sha256 = "sha256-KtDY0J1OYNTLwK7834lI+2XL1N1FkOk5zhinGY90/4A=";
+    })
  ];

  installPhase = ''
@@ -4,7 +4,7 @@

 stdenv.mkDerivation rec {
  pname = "tcsh";
-  version = "6.22.03";
+  version = "6.22.04";

  src = fetchurl {
    urls = [
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
      "ftp://ftp.funet.fi/pub/unix/shells/tcsh/${pname}-${version}.tar.gz"
      "ftp://ftp.funet.fi/pub/unix/shells/tcsh/old/${pname}-${version}.tar.gz"
    ];
-    sha256 = "sha256-viz9ZT0qDH9QbS3RTBIyS6dJvUhAN75t9Eo5c/UiYrc=";
+    hash = "sha256-6xY1YkMhjDLzngcljXK/iyHmLOlLsOipXjGLFROX4jE=";
  };

  buildInputs = [ ncurses ];
@@ -28,12 +28,13 @@ stdenv.mkDerivation rec {
    });

  meta = with lib; {
+    homepage = "https://www.tcsh.org/";
    description = "An enhanced version of the Berkeley UNIX C shell (csh)";
    longDescription = ''
-      tcsh is an enhanced but completely compatible version of the
-      Berkeley UNIX C shell, csh. It is a command language interpreter
-      usable both as an interactive login shell and a shell script
-      command processor.
+      tcsh is an enhanced but completely compatible version of the Berkeley UNIX
+      C shell, csh. It is a command language interpreter usable both as an
+      interactive login shell and a shell script command processor.
+
      It includes:
      - command-line editor
      - programmable word completion
@@ -41,10 +42,9 @@ stdenv.mkDerivation rec {
      - history mechanism
      - job control
    '';
-    homepage = "https://www.tcsh.org/";
    license = licenses.bsd2;
    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = platforms.unix;
  };

  passthru = {
@@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "eksctl";
-  version = "0.58.0";
+  version = "0.59.0";

  src = fetchFromGitHub {
    owner = "weaveworks";
    repo = pname;
    rev = version;
-    sha256 = "sha256-g7Lfx8Q2yEFk6/3r8+MUl8jehbRfVGfrZb1+WgA6TYA=";
+    sha256 = "sha256-qSZos1BO48Z5aiay8B/9DFGPgAOC8ib7IRjlFhzFh5Y=";
  };

  vendorSha256 = "sha256-mapok/c3uh7xmLZnN5S9zavgxSOfytqtqxBScv4Ao8w=";
@@ -1,23 +1,39 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper, qt4, util-linux, coreutils, which, qmake4Hook
-, p7zip, mtools, syslinux }:
+{ lib
+, stdenv
+, coreutils
+, fetchFromGitHub
+, libsForQt5
+, mtools
+, p7zip
+, qt5
+, syslinux
+, util-linux
+, which
+}:

 stdenv.mkDerivation rec {
  pname = "unetbootin";
-  version = "681";
+  version = "702";

  src = fetchFromGitHub {
-    owner  = "unetbootin";
-    repo   = "unetbootin";
-    rev    = version;
-    sha256 = "0ppqb7ywh4cpcjr5nw6f65dx4s8kx09gnhihnby3zjhxdf4l99fm";
+    owner = pname;
+    repo = pname;
+    rev = version;
+    sha256 = "sha256-psX15XicPXAsd36BhuvK0G3GQS8hV/hazzO0HByCqV4=";
  };

  setSourceRoot = ''
    sourceRoot=$(echo */src/unetbootin)
  '';

-  buildInputs = [ qt4 ];
-  nativeBuildInputs = [ makeWrapper qmake4Hook ];
+  buildInputs = [
+    qt5.qtbase
+    qt5.qttools
+    libsForQt5.qmake
+  ];
+
+  nativeBuildInputs = [ qt5.wrapQtAppsHook ];
+
  enableParallelBuilding = true;

  # Lots of nice hard-coded paths...
@@ -50,18 +66,19 @@ stdenv.mkDerivation rec {
    install -Dm644 -t $out/share/unetbootin   unetbootin_*.qm
    install -Dm644 -t $out/share/applications unetbootin.desktop

-    wrapProgram $out/bin/unetbootin \
-      --prefix PATH : ${lib.makeBinPath [ mtools p7zip which ]} \
-      --set QT_X11_NO_MITSHM 1
-
    runHook postInstall
  '';

+  qtWrapperArgs = [
+    "--prefix PATH : ${lib.makeBinPath [ mtools p7zip which ]}"
+    "--set QT_X11_NO_MITSHM 1"
+  ];
+
  meta = with lib; {
-    homepage    = "http://unetbootin.sourceforge.net/";
    description = "A tool to create bootable live USB drives from ISO images";
-    license     = licenses.gpl2Plus;
-    platforms   = platforms.linux;
+    homepage = "http://unetbootin.github.io/";
+    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ ebzzry ];
+    platforms = platforms.linux;
  };
 }
@@ -1,11 +1,13 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , zlib
 , xz
 , lz4
 , lzo
 , zstd
+, nixosTests
 }:

 stdenv.mkDerivation rec {
@@ -23,6 +25,12 @@ stdenv.mkDerivation rec {
    # This patch adds an option to pad filesystems (increasing size) in
    # exchange for better chunking / binary diff calculation.
    ./4k-align.patch
+    # Otherwise sizes of some files may break in our ISO; see
+    # https://github.com/NixOS/nixpkgs/issues/132286
+    (fetchpatch {
+      url = "https://github.com/plougher/squashfs-tools/commit/19b161c1cd3e31f7a396ea92dea4390ad43f27b9.diff";
+      sha256 = "15ng8m2my3a6a9hnfx474bip2vwdh08hzs2k0l5gwd36jv2z1h3f";
+    })
  ] ++ lib.optional stdenv.isDarwin ./darwin.patch;

  buildInputs = [ zlib xz zstd lz4 lzo ];
@@ -40,6 +48,10 @@ stdenv.mkDerivation rec {
    "LZO_SUPPORT=1"
  ];

+  passthru.tests = {
+    nixos-iso-boots-and-verifies = nixosTests.boot.biosCdrom;
+  };
+
  meta = with lib; {
    homepage = "https://github.com/plougher/squashfs-tools";
    description = "Tool for creating and unpacking squashfs filesystems";
@@ -14,14 +14,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "broot";
-  version = "1.6.0";
+  version = "1.6.2";

  src = fetchCrate {
    inherit pname version;
-    sha256 = "sha256-H/QT/fmQI9sHjl6wMJjrfjvbOhY9VyBkAGetvcUqGrE=";
+    sha256 = "sha256-SjfTMBGby2jzmeNEtBVYqumLExhXW8nqxpbaeeaRM3w=";
  };

-  cargoHash = "sha256-5mqLVbB/dLAk3Ck7ilHhVn0CB/6Ln82SaTxZ/vkx+9k=";
+  cargoHash = "sha256-BdSqTzXu7Glhr0fQGmnkg5BXYgdQS6jgfH3A9hPpECY=";

  nativeBuildInputs = [
    installShellFiles
@@ -75,7 +75,7 @@ rustPlatform.buildRustPackage rec {
  meta = with lib; {
    description = "An interactive tree view, a fuzzy search, a balanced BFS descent and customizable commands";
    homepage = "https://dystroy.org/broot/";
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ dywedir ];
    license = with licenses; [ mit ];
  };
 }
@@ -1,12 +1,12 @@
 { lib, fetchurl, appimageTools }:
 let
  name = "vial-${version}";
-  version = "0.4";
+  version = "0.4.1";
  pname = "Vial";

  src = fetchurl {
    url = "https://github.com/vial-kb/vial-gui/releases/download/v${version}/${pname}-v${version}-x86_64.AppImage";
-    sha256 = "sha256-4EDEVSqjQ6Ybqx4BoNwE4pT5yFLYM05FBHc5deQU9f8=";
+    sha256 = "sha256-aN0wvgahWPNSXP/JmV1JWaEnARIOTyRdz1ko6eC7Y5s=";
  };

  appimageContents = appimageTools.extractType2 { inherit name src; };
@@ -26,7 +26,7 @@ appimageTools.wrapType2 {
  meta = with lib; {
    description = "An Open-source cross-platform (Windows, Linux and Mac) GUI and a QMK fork for configuring your keyboard in real time";
    homepage = "https://get.vial.today";
-    license = licenses.gpl2Only;
+    license = licenses.gpl2Plus;
    maintainers = with maintainers; [ kranzes ];
    platforms = [ "x86_64-linux" ];
  };
@@ -7,16 +7,25 @@

 buildGoModule rec {
  pname = "ghostunnel";
-  version = "1.5.3";
+  version = "1.6.0";

  src = fetchFromGitHub {
    owner = "ghostunnel";
    repo = "ghostunnel";
    rev = "v${version}";
-    sha256 = "15rmd89j7sfpznzznss899smizbyshprsrvsdmrbhb617myd9fpy";
+    sha256 = "sha256-EE8gCm/gOp3lmCx1q4PahulipLoBZnEatNAVUXzHIVw=";
  };

-  vendorSha256 = "1i95fx4a0fh6id6iy6afbva4pazr7ym6sbwi9r7la6gxzyncd023";
+  vendorSha256 = "sha256-XgmvqB1PCfL2gSDqwqauSixk8vlINHRmX6U0h9EXXdU=";
+
+  deleteVendor = true;
+
+  # The certstore directory isn't recognized as a subpackage, but is when moved
+  # into the vendor directory.
+  postUnpack = ''
+    mkdir -p $sourceRoot/vendor/ghostunnel
+    mv $sourceRoot/certstore $sourceRoot/vendor/ghostunnel/
+  '';

  meta = with lib; {
    description = "A simple TLS proxy with mutual authentication support for securing non-TLS backend applications";
@@ -26,4 +35,5 @@ buildGoModule rec {
  };

  passthru.tests.nixos = nixosTests.ghostunnel;
+  passthru.tests.podman = nixosTests.podman-tls-ghostunnel;
 }
@@ -1,18 +1,20 @@
-{ fetchurl, lib, nettools, pythonPackages, texinfo }:
+{ lib, nettools, python3Packages, texinfo, fetchFromGitHub }:

 # FAILURES: The "running build_ext" phase fails to compile Twisted
 # plugins, because it tries to write them into Twisted's (immutable)
 # store path. The problem appears to be non-fatal, but there's probably
 # some loss of functionality because of it.

-pythonPackages.buildPythonApplication rec {
-  version = "1.13.0";
+python3Packages.buildPythonApplication rec {
+  version = "2021-07-09";
  pname = "tahoe-lafs";
  namePrefix = "";

-  src = fetchurl {
-    url = "https://tahoe-lafs.org/downloads/tahoe-lafs-${version}.tar.bz2";
-    sha256 = "11pfz9yyy6qkkyi0kskxlbn2drfppx6yawqyv4kpkrkj4q7x5m42";
+  src = fetchFromGitHub {
+    owner = "tahoe-lafs";
+    repo = "tahoe-lafs";
+    rev = "8e28a9d0e02fde2388aca549da2b5c452ac4337f";
+    sha256 = "sha256-MuD/ZY+die7RCsuVdcePSD0DdwatXRi7CxW2iFt22L0=";
  };

  outputs = [ "out" "doc" "info" ];
@@ -38,26 +40,30 @@ pythonPackages.buildPythonApplication rec {
      cd src/allmydata/test

      # Buggy?
-      rm cli/test_create.py test_backupdb.py
+      rm cli/test_create.py test_client.py

      # These require Tor and I2P.
      rm test_connections.py test_iputil.py test_hung_server.py test_i2p_provider.py test_tor_provider.py

+      # Fails due to the above tests missing
+      rm test_python3.py
+
      # Expensive
      rm test_system.py
    )
  '';

-  nativeBuildInputs = with pythonPackages; [ sphinx texinfo ];
+  nativeBuildInputs = with python3Packages; [ sphinx texinfo ];

  # The `backup' command requires `sqlite3'.
-  propagatedBuildInputs = with pythonPackages; [
-    twisted foolscap nevow simplejson zfec pycryptopp darcsver
-    setuptoolsTrial setuptoolsDarcs pycrypto pyasn1 zope_interface
-    service-identity pyyaml magic-wormhole treq characteristic
+  propagatedBuildInputs = with python3Packages; [
+    appdirs beautifulsoup4 characteristic distro eliot fixtures foolscap future
+    html5lib magic-wormhole netifaces pyasn1 pycrypto pyutil pyyaml recommonmark
+    service-identity simplejson sphinx_rtd_theme testtools treq twisted zfec
+    zope_interface
  ];

-  checkInputs = with pythonPackages; [ mock hypothesis twisted ];
+  checkInputs = with python3Packages; [ mock hypothesis twisted ];

  # Install the documentation.
  postInstall = ''
@@ -90,6 +96,5 @@ pythonPackages.buildPythonApplication rec {
    license = [ lib.licenses.gpl2Plus /* or */ "TGPPLv1+" ];
    maintainers = with lib.maintainers; [ MostAwesomeDude ];
    platforms = lib.platforms.gnu ++ lib.platforms.linux;
-    broken = true;
  };
 }
@@ -7,21 +7,20 @@

 buildGoModule rec {
  pname = "gdu";
-  version = "5.3.0";
+  version = "5.5.0";

  src = fetchFromGitHub {
    owner = "dundee";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-hf5jTEAN5oOPg2PaAlYjIDMYcwXkaFAqPtWTwZV98N0=";
+    sha256 = "sha256-cnDYeL1BdxBaCZtK+DnIbtsTVUr3AujA50ttchPX6V0=";
  };

  vendorSha256 = "sha256-9W1K01PJ+tRLSJ0L7NGHXT5w5oHmlBkT8kwnOLOzSCc=";

  nativeBuildInputs = [ installShellFiles ];

-  buildFlagsArray = [
-    "-ldflags="
+  ldflags = [
    "-s"
    "-w"
    "-X github.com/dundee/gdu/v${lib.versions.major version}/build.Version=${version}"
@@ -14,6 +14,11 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = [ autoreconfHook ];
  patches = [ ./no-var-spool-install.patch ];

+  postPatch = ''
+    substituteInPlace libuptimed/urec.h \
+      --replace /var/spool /var/lib
+  '';
+
  meta = with lib; {
    description = "Uptime record daemon";
    longDescription = ''
@@ -1,22 +1,23 @@
 { lib, python3Packages }:

-let
+python3Packages.buildPythonPackage rec {
  pname = "rst2html5";
-  version = "1.10.6";
-  format = "wheel";
-in python3Packages.buildPythonPackage {
-  inherit pname version format;
+  version = "2.0";

  src = python3Packages.fetchPypi {
-    inherit pname version format;
-    sha256 = "sha256-jmToDFLQODqgTycBp2J8LyoJ1Zxho9w1VdhFMzvDFkg=";
+    inherit pname version;
+    hash = "sha256-Ejjja/fm6wXTf9YtjCYZsNDB8X5oAtyPoUIsYFDuZfc=";
  };

-  propagatedBuildInputs = with python3Packages;
-  [ docutils genshi pygments beautifulsoup4 ];
+  buildInputs = with python3Packages; [
+    beautifulsoup4
+    docutils
+    genshi
+    pygments
+  ];

  meta = with lib;{
-    homepage = "https://pypi.org/project/rst2html5/";
+    homepage = "https://rst2html5.readthedocs.io/en/latest/";
    description = "Converts ReSTructuredText to (X)HTML5";
    license = licenses.mit;
    maintainers = with maintainers; [ AndersonTorres ];
@@ -8952,7 +8952,9 @@ in
    inherit (darwin.apple_sdk.frameworks) Security;
  };

-  soapui = callPackage ../applications/networking/soapui { };
+  soapui = callPackage ../applications/networking/soapui {
+    jdk = jdk11;
+  };

  spglib = callPackage ../development/libraries/spglib { };

@@ -16295,13 +16297,13 @@ in
  libcacard = callPackage ../development/libraries/libcacard { };

  libcanberra = callPackage ../development/libraries/libcanberra {
-    inherit (darwin.apple_sdk.frameworks) CoreServices;
+    inherit (darwin.apple_sdk.frameworks) Carbon CoreServices;
  };
  libcanberra-gtk2 = pkgs.libcanberra.override {
-    gtk = gtk2-x11;
+    gtkSupport = "gtk2";
  };
  libcanberra-gtk3 = pkgs.libcanberra.override {
-    gtk = gtk3-x11;
+    gtkSupport = "gtk3";
  };

  libcanberra_kde = if (config.kde_runtime.libcanberraWithoutGTK or true)
@@ -31830,6 +31832,8 @@ in

  sane-backends = callPackage ../applications/graphics/sane/backends (config.sane or {});

+  sane-drivers = callPackage ../applications/graphics/sane/drivers.nix {};
+
  senv = callPackage ../applications/misc/senv { };

  brlaser = callPackage ../misc/cups/drivers/brlaser { };
@@ -194,6 +194,7 @@ let
      idrisPackages = packagePlatforms pkgs.idrisPackages;
      agdaPackages = packagePlatforms pkgs.agdaPackages;

+      pkgsLLVM.stdenv = [ "x86_64-linux" "aarch64-linux" ];
      pkgsMusl.stdenv = [ "x86_64-linux" "aarch64-linux" ];
      pkgsStatic.stdenv = [ "x86_64-linux" "aarch64-linux" ];