Merge master into staging-next

2021-08-21 12:01:20 +00:00
parent 677ab4aebe 415ca84f8b
commit 4e9e7267bd
43 changed files with 1124 additions and 466 deletions
@@ -20,9 +20,9 @@
 <xi:include href="idris.section.xml" />
 <xi:include href="ios.section.xml" />
 <xi:include href="java.section.xml" />
+ <xi:include href="javascript.section.xml" />
 <xi:include href="lua.section.xml" />
 <xi:include href="maven.section.xml" />
- <xi:include href="node.section.xml" />
 <xi:include href="ocaml.section.xml" />
 <xi:include href="perl.section.xml" />
 <xi:include href="php.section.xml" />
@@ -0,0 +1,203 @@
+# Javascript {#language-javascript}
+
+## Introduction {#javascript-introduction}
+
+This contains instructions on how to package javascript applications. For instructions on how to add a cli package from npm please consult the #node.js section
+
+The various tools available will be listed in the [tools-overview](#javascript-tools-overview). Some general principles for packaging will follow. Finally some tool specific instructions will be given.
+
+## Tools overview {#javascript-tools-overview}
+
+## General principles {#javascript-general-principles}
+
+The following principles are given in order of importance with potential exceptions.
+
+### Try to use the same node version used upstream {#javascript-upstream-node-version}
+
+It is often not documented which node version is used upstream, but if it is, try to use the same version when packaging.
+
+This can be a problem if upstream is using the latest and greatest and you are trying to use an earlier version of node. Some cryptic errors regarding V8 may appear.
+
+An exception to this:
+
+### Try to respect the package manager originally used by upstream (and use the upstream lock file) {#javascript-upstream-package-manager}
+
+A lock file (package-lock.json, yarn.lock...) is supposed to make reproducible installations of node_modules for each tool.
+
+Guidelines of package managers, recommend to commit those lock files to the repos. If a particular lock file is present, it is a strong indication of which package manager is used upstream.
+
+It's better to try to use a nix tool that understand the lock file. Using a different tool might give you hard to understand error because different packages have been installed. An example of problems that could arise can be found [here](https://github.com/NixOS/nixpkgs/pull/126629). Upstream uses npm, but this is an attempt to package it with yarn2nix (that uses yarn.lock)
+
+Using a different tool forces to commit a lock file to the repository. Those files are fairly large, so when packaging for nixpkgs, this approach does not scale well.
+
+Exceptions to this rule are:
+
+- when you encounter one of the bugs from a nix tool. In each of the tool specific instructions, known problems will be detailed. If you have a problem with a particular tool, then it's best to try another tool, even if this means you will have to recreate a lock file and commit it to nixpkgs. In general yarn2nix has less known problems and so a simple search in nixpkgs will reveal many yarn.lock files commited
+- Some lock files contain particular version of a package that has been pulled off npm for some reason. In that case, you can recreate upstream lock (by removing the original and `npm install`, `yarn`, ...) and commit this to nixpkgs.
+- The only tool that supports workspaces (a feature of npm that helps manage sub-directories with different package.json from a single top level package.json) is yarn2nix. If upstream has workspaces you should try yarn2nix.
+
+### Try to use upstream package.json {#javascript-upstream-package-json}
+
+Exceptions to this rule are
+
+- Sometimes the upstream repo assumes some dependencies be installed globally. In that case you can add them manually to the upstream package.json (`yarn add xxx` or `npm install xxx`, ...). Dependencies that are installed locally can be executed with `npx` for cli tools. (e.g. `npx postcss ...`, this is how you can call those dependencies in the phases).
+- Sometimes there is a version conflict between some dependency requirements. In that case you can fix a version (by removing the `^`).
+- Sometimes the script defined in the package.json does not work as is. Some scripts for example use cli tools that might not be available, or cd in directory with a different package.json (for workspaces notably). In that case, it's perfectly fine to look at what the particular script is doing and break this down in the phases. In the build script you can see `build:*` calling in turns several other build scripts like `build:ui` or `build:server`. If one of those fails, you can try to separate those into:
+
+```Shell
+yarn build:ui
+yarn build:server
+# OR
+npm run build:ui
+npm run build:server
+```
+
+when you need to override a package.json. It's nice to use the one from the upstream src and do some explicit override. Here is an example.
+
+```nix
+patchedPackageJSON = final.runCommand "package.json" { } ''
+  ${jq}/bin/jq '.version = "0.4.0" |
+    .devDependencies."@jsdoc/cli" = "^0.2.5"
+    ${sonar-src}/package.json > $out
+'';
+```
+
+you will still need to commit the modified version of the lock files, but at least the overrides are explicit for everyone to see.
+
+### Using node_modules directly {#javascript-using-node_modules}
+
+each tool has an abstraction to just build the node_modules (dependencies) directory. you can always use the stdenv.mkDerivation with the node_modules to build the package (symlink the node_modules directory and then use the package build command). the node_modules abstraction can be also used to build some web framework frontends. For an example of this see how [plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/web-apps/plausible/default.nix) is built. mkYarnModules to make the derivation containing node_modules. Then when building the frontend you can just symlink the node_modules directory
+
+## javascript packages inside nixpkgs {#javascript-packages-nixpkgs}
+
+The `pkgs/development/node-packages` folder contains a generated collection of
+[NPM packages](https://npmjs.com/) that can be installed with the Nix package
+manager.
+
+As a rule of thumb, the package set should only provide _end user_ software
+packages, such as command-line utilities. Libraries should only be added to the
+package set if there is a non-NPM package that requires it.
+
+When it is desired to use NPM libraries in a development project, use the
+`node2nix` generator directly on the `package.json` configuration file of the
+project.
+
+The package set provides support for the official stable Node.js versions.
+The latest stable LTS release in `nodePackages`, as well as the latest stable
+Current release in `nodePackages_latest`.
+
+If your package uses native addons, you need to examine what kind of native
+build system it uses. Here are some examples:
+
+- `node-gyp`
+- `node-gyp-builder`
+- `node-pre-gyp`
+
+After you have identified the correct system, you need to override your package
+expression while adding in build system as a build input. For example, `dat`
+requires `node-gyp-build`, so [we override](https://github.com/NixOS/nixpkgs/blob/32f5e5da4a1b3f0595527f5195ac3a91451e9b56/pkgs/development/node-packages/default.nix#L37-L40) its expression in [`default.nix`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/node-packages/default.nix):
+
+```nix
+    dat = super.dat.override {
+      buildInputs = [ self.node-gyp-build pkgs.libtool pkgs.autoconf pkgs.automake ];
+      meta.broken = since "12";
+    };
+```
+
+To add a package from NPM to nixpkgs:
+
+1.  Modify `pkgs/development/node-packages/node-packages.json` to add, update
+    or remove package entries to have it included in `nodePackages` and
+    `nodePackages_latest`.
+2.  Run the script: `cd pkgs/development/node-packages && ./generate.sh`.
+3.  Build your new package to test your changes:
+    `cd /path/to/nixpkgs && nix-build -A nodePackages.<new-or-updated-package>`.
+    To build against the latest stable Current Node.js version (e.g. 14.x):
+    `nix-build -A nodePackages_latest.<new-or-updated-package>`
+4.  Add and commit all modified and generated files.
+
+For more information about the generation process, consult the
+[README.md](https://github.com/svanderburg/node2nix) file of the `node2nix`
+tool.
+
+## Tool specific instructions {#javascript-tool-specific}
+
+### node2nix {#javascript-node2nix}
+
+#### Preparation {#javascript-node2nix-preparation}
+
+you will need to generate a nix expression for the dependencies
+
+- don't forget the `-l package-lock.json` if there is a lock file
+- Most probably you will need the `--development` to include the `devDependencies`
+
+so the command will most likely be
+`node2nix --developmennt -l package-lock.json`
+
+[link to the doc in the repo](https://github.com/svanderburg/node2nix)
+
+#### Pitfalls {#javascript-node2nix-pitfalls}
+
+- if upstream package.json does not have a "version" attribute, node2nix will crash. You will need to add it like shown in [the package.json section](#javascript-upstream-package-json)
+- node2nix has some [bugs](https://github.com/svanderburg/node2nix/issues/238). related to working with lock files from npm distributed with nodejs-16_x
+- node2nix does not like missing packages from npm. If you see something like `Cannot resolve version: vue-loader-v16@undefined` then you might want to try another tool. The package might have been pulled off of npm.
+
+### yarn2nix {#javascript-yarn2nix}
+
+#### Preparation {#javascript-yarn2nix-preparation}
+
+you will need at least a yarn.lock and yarn.nix file
+
+- generate a yarn.lock in upstream if it is not already there
+- `yarn2nix > yarn.nix` will generate the dependencies in a nix format
+
+#### mkYarnPackage {#javascript-yarn2nix-mkYarnPackage}
+
+this will by default try to generate a binary. For package only generating static assets (Svelte, Vue, React...), you will need to explicitely override the build step with your instructions. It's important to use the `--offline` flag. For example if you script is `"build": "something"` in package.json use
+
+```nix
+buildPhase = ''
+  yarn build --offline
+'';
+```
+
+The dist phase is also trying to build a binary, the only way to override it is with
+
+```nix
+distPhase = "true";
+```
+
+the configure phase can sometimes fail because it tries to be too clever.
+One common override is
+
+```nix
+configurePhase = "ln -s $node_modules node_modules";
+```
+
+#### mkYarnModules {#javascript-yarn2nix-mkYarnModules}
+
+this will generate a derivation including the node_modules. If you have to build a derivation for an integrated web framework (rails, phoenix..), this is probably the easiest way. [Plausible](https://github.com/NixOS/nixpkgs/blob/master/pkgs/servers/web-apps/plausible/default.nix#L39) offers a good example of how to do this.
+
+#### Pitfalls {#javascript-yarn2nix-pitfalls}
+
+- if version is missing from upstream package.json, yarn will silently install nothing. In that case, you will need to override package.json as shown in the [package.json section](#javascript-upstream-package-json)
+
+## Outside of nixpkgs {#javascript-outside-nixpkgs}
+
+There are some other options available that can't be used inside nixpkgs. Those other options are written in nix. Importing them in nixpkgs will require moving the source code into nixpkgs. Using [Import From Derivation](https://nixos.wiki/wiki/Import_From_Derivation) is not allowed in hydra at present. If you are packaging something outside nixpkgs, those can be considered
+
+### npmlock2nix {#javascript-npmlock2nix}
+
+[npmlock2nix](https://github.com/nix-community/npmlock2nix) aims at building node_modules without code generation. It hasn't reached v1 yet, the api might be suject to change.
+
+#### Pitfalls {#javascript-npmlock2nix-pitfalls}
+
+- there are some [problems with npm v7](https://github.com/tweag/npmlock2nix/issues/45).
+
+### nix-npm-buildpackage {#javascript-nix-npm-buildpackage}
+
+[nix-npm-buildpackage](https://github.com/serokell/nix-npm-buildpackage) aims at building node_modules without code generation. It hasn't reached v1 yet, the api might change. It supports both package-lock.json and yarn.lock.
+
+#### Pitfalls {#javascript-nix-npm-buildpackage-pitfalls}
+
+- there are some [problems with npm v7](https://github.com/serokell/nix-npm-buildpackage/issues/33).
@@ -1,51 +0,0 @@
-# Node.js {#node.js}
-
-The `pkgs/development/node-packages` folder contains a generated collection of
-[NPM packages](https://npmjs.com/) that can be installed with the Nix package
-manager.
-
-As a rule of thumb, the package set should only provide *end user* software
-packages, such as command-line utilities. Libraries should only be added to the
-package set if there is a non-NPM package that requires it.
-
-When it is desired to use NPM libraries in a development project, use the
-`node2nix` generator directly on the `package.json` configuration file of the
-project.
-
-The package set provides support for the official stable Node.js versions.
-The latest stable LTS release in `nodePackages`, as well as the latest stable
-Current release in `nodePackages_latest`.
-
-If your package uses native addons, you need to examine what kind of native
-build system it uses. Here are some examples:
-
-* `node-gyp`
-* `node-gyp-builder`
-* `node-pre-gyp`
-
-After you have identified the correct system, you need to override your package
-expression while adding in build system as a build input. For example, `dat`
-requires `node-gyp-build`, so [we override](https://github.com/NixOS/nixpkgs/blob/32f5e5da4a1b3f0595527f5195ac3a91451e9b56/pkgs/development/node-packages/default.nix#L37-L40) its expression in [`default.nix`](https://github.com/NixOS/nixpkgs/blob/master/pkgs/development/node-packages/default.nix):
-
-```nix
-    dat = super.dat.override {
-      buildInputs = [ self.node-gyp-build pkgs.libtool pkgs.autoconf pkgs.automake ];
-      meta.broken = since "12";
-    };
-```
-
-To add a package from NPM to nixpkgs:
-
- 1. Modify `pkgs/development/node-packages/node-packages.json` to add, update
-    or remove package entries to have it included in `nodePackages` and
-    `nodePackages_latest`.
- 2. Run the script: `cd pkgs/development/node-packages && ./generate.sh`.
- 3. Build your new package to test your changes:
-    `cd /path/to/nixpkgs && nix-build -A nodePackages.<new-or-updated-package>`.
-    To build against the latest stable Current Node.js version (e.g. 14.x):
-    `nix-build -A nodePackages_latest.<new-or-updated-package>`
- 4. Add and commit all modified and generated files.
-
-For more information about the generation process, consult the
-[README.md](https://github.com/svanderburg/node2nix) file of the `node2nix`
-tool.
@@ -62,7 +62,7 @@ in {
        zd1211fw
        alsa-firmware
        sof-firmware
-        openelec-dvb-firmware
+        libreelec-dvb-firmware
      ] ++ optional (pkgs.stdenv.hostPlatform.isAarch32 || pkgs.stdenv.hostPlatform.isAarch64) raspberrypiWirelessFirmware
        ++ optionals (versionOlder config.boot.kernelPackages.kernel.version "4.13") [
        rtl8723bs-firmware
@@ -36,11 +36,12 @@ let
  dependentCertNames = unique (map (hostOpts: hostOpts.certName) acmeEnabledVhosts);

  mkListenInfo = hostOpts:
-    if hostOpts.listen != [] then hostOpts.listen
-    else (
-      optional (hostOpts.onlySSL || hostOpts.addSSL || hostOpts.forceSSL) { ip = "*"; port = 443; ssl = true; } ++
-      optional (!hostOpts.onlySSL) { ip = "*"; port = 80; ssl = false; }
-    );
+    if hostOpts.listen != [] then
+      hostOpts.listen
+    else
+      optionals (hostOpts.onlySSL || hostOpts.addSSL || hostOpts.forceSSL) (map (addr: { ip = addr; port = 443; ssl = true; }) hostOpts.listenAddresses) ++
+      optionals (!hostOpts.onlySSL) (map (addr: { ip = addr; port = 80; ssl = false; }) hostOpts.listenAddresses)
+    ;

  listenInfo = unique (concatMap mkListenInfo vhosts);

@@ -47,12 +47,29 @@ in
      ];
      description = ''
        Listen addresses and ports for this virtual host.
-        <note><para>
+        <note>
+        <para>
          This option overrides <literal>addSSL</literal>, <literal>forceSSL</literal> and <literal>onlySSL</literal>.
-        </para></note>
+        </para>
+        <para>
+          If you only want to set the addresses manually and not the ports, take a look at <literal>listenAddresses</literal>.
+        </para>
+        </note>
      '';
    };

+    listenAddresses = mkOption {
+      type = with types; nonEmptyListOf str;
+
+      description = ''
+        Listen addresses for this virtual host.
+        Compared to <literal>listen</literal> this only sets the addreses
+        and the ports are chosen automatically.
+      '';
+      default = [ "*" ];
+      example = [ "127.0.0.1" ];
+    };
+
    enableSSL = mkOption {
      type = types.bool;
      visible = false;
@@ -8,63 +8,50 @@
 , openjdk11
 , dpkg
 , writeScript
-, coreutils
 , bash
 , tor
-, psmisc
+, gnutar
+, zip
+, xz
 }:

 let
  bisq-launcher = writeScript "bisq-launcher" ''
    #! ${bash}/bin/bash

-    # Setup a temporary Tor instance
-    TMPDIR=$(${coreutils}/bin/mktemp -d)
-    CONTROLPORT=$(${coreutils}/bin/shuf -i 9100-9499 -n 1)
-    SOCKSPORT=$(${coreutils}/bin/shuf -i 9500-9999 -n 1)
-    ${coreutils}/bin/head -c 1024 < /dev/urandom > $TMPDIR/cookie
+    # This is just a comment to convince Nix that Tor is a
+    # runtime dependency; The Tor binary is in a *.jar file,
+    # whereas Nix only scans for hashes in uncompressed text.
+    # ${bisq-tor}

-    ${tor}/bin/tor --SocksPort $SOCKSPORT --ControlPort $CONTROLPORT \
-      --ControlPortWriteToFile $TMPDIR/port --CookieAuthFile $TMPDIR/cookie \
-      --CookieAuthentication 1 >$TMPDIR/tor.log --RunAsDaemon 1
+    JAVA_TOOL_OPTIONS="-XX:+UseG1GC -XX:MaxHeapFreeRatio=10 -XX:MinHeapFreeRatio=5 -XX:+UseStringDeduplication" bisq-desktop-wrapped "$@"
+  '';

-    torpid=$(${psmisc}/bin/fuser $CONTROLPORT/tcp)
+  bisq-tor = writeScript "bisq-tor" ''
+    #! ${bash}/bin/bash

-    echo Temp directory: $TMPDIR
-    echo Tor PID: $torpid
-    echo Tor control port: $CONTROLPORT
-    echo Tor SOCKS port: $SOCKSPORT
-    echo Tor log: $TMPDIR/tor.log
-    echo Bisq log file: $TMPDIR/bisq.log
-
-    JAVA_TOOL_OPTIONS="-XX:MaxRAM=4g" bisq-desktop-wrapped \
-      --torControlCookieFile=$TMPDIR/cookie \
-      --torControlUseSafeCookieAuth \
-      --torControlPort $CONTROLPORT "$@" > $TMPDIR/bisq.log
-
-    echo Bisq exited. Killing Tor...
-    kill $torpid
+    exec ${tor}/bin/tor "$@"
  '';
 in
 stdenv.mkDerivation rec {
  pname = "bisq-desktop";
-  version = "1.7.0";
+  version = "1.7.2";

  src = fetchurl {
    url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb";
-    sha256 = "0crry5k7crmrqn14wxiyrnhk09ac8a9ksqrwwky7jsnyah0bx5k4";
+    sha256 = "0b2rh9sphc9wffkawprrl20frgv0rah7y2k5sfxpjc3shgkqsw80";
  };

-  nativeBuildInputs = [ makeWrapper copyDesktopItems dpkg ];
+  nativeBuildInputs = [ makeWrapper copyDesktopItems imagemagick dpkg gnutar zip xz ];

  desktopItems = [
    (makeDesktopItem {
      name = "Bisq";
      exec = "bisq-desktop";
      icon = "bisq";
-      desktopName = "Bisq";
+      desktopName = "Bisq ${version}";
      genericName = "Decentralized bitcoin exchange";
-      categories = "Network;Utility;";
+      categories = "Network;P2P;";
    })
  ];

@@ -72,6 +59,16 @@ stdenv.mkDerivation rec {
    dpkg -x $src .
  '';

+  buildPhase = ''
+    # Replace the embedded Tor binary (which is in a Tar archive)
+    # with one from Nixpkgs.
+
+    mkdir -p native/linux/x64/
+    cp ${bisq-tor} ./tor
+    tar -cJf native/linux/x64/tor.tar.xz tor
+    zip -r opt/bisq/lib/app/desktop-${version}-all.jar native
+  '';
+
  installPhase = ''
    runHook preInstall

@@ -86,13 +83,15 @@ stdenv.mkDerivation rec {

    for n in 16 24 32 48 64 96 128 256; do
      size=$n"x"$n
-      ${imagemagick}/bin/convert opt/bisq/lib/Bisq.png -resize $size bisq.png
+      convert opt/bisq/lib/Bisq.png -resize $size bisq.png
      install -Dm644 -t $out/share/icons/hicolor/$size/apps bisq.png
    done;

    runHook postInstall
  '';

+  passthru.updateScript = ./update.sh;
+
  meta = with lib; {
    description = "A decentralized bitcoin exchange network";
    homepage = "https://bisq.network";
@@ -0,0 +1,22 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq gnused gnupg common-updater-scripts
+
+set -eu -o pipefail
+
+version="$(curl -s https://api.github.com/repos/bisq-network/bisq/releases| jq '.[] | {name,prerelease} | select(.prerelease==false) | limit(1;.[])' | sed 's/[\"v]//g' | head -n 1)"
+depname="Bisq-64bit-$version.deb"
+src="https://github.com/bisq-network/bisq/releases/download/v$version/$depname"
+signature="$src.asc"
+key="CB36 D7D2 EBB2 E35D 9B75 500B CD5D C1C5 29CD FD3B"
+
+pushd $(mktemp -d --suffix=-bisq-updater)
+export GNUPGHOME=$PWD/gnupg
+mkdir -m 700 -p "$GNUPGHOME"
+curl -L -o "$depname" -- "$src"
+curl -L -o signature.asc -- "$signature"
+gpg --batch --recv-keys "$key"
+gpg --batch --verify signature.asc "$depname"
+sha256=$(nix-prefetch-url --type sha256 "file://$PWD/$depname")
+popd
+
+update-source-version bisq-desktop "$version" "$sha256"
@@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "cni-plugins";
-  version = "0.9.1";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "containernetworking";
    repo = "plugins";
    rev = "v${version}";
-    sha256 = "sha256-n+OtFXgFmW0xsGEtC6ua0qjdsJSbEjn08mAl5Z51Kp8=";
+    sha256 = "sha256-RcDZW/iOAcJodGiuzmeZk3obtD0/mQoMF9vL0xNehbQ=";
  };

  vendorSha256 = null;
@@ -32,7 +32,6 @@ buildGoModule rec {
    "plugins/main/vlan"
    "plugins/meta/bandwidth"
    "plugins/meta/firewall"
-    "plugins/meta/flannel"
    "plugins/meta/portmap"
    "plugins/meta/sbr"
    "plugins/meta/tuning"
@@ -1,30 +1,34 @@
 { lib, stdenv, fetchurl, cln, pkg-config, readline, gmp, python3 }:

 stdenv.mkDerivation rec {
-  name = "ginac-1.8.1";
+  pname = "ginac";
+  version = "1.8.1";

  src = fetchurl {
-    url    = "${meta.homepage}/${name}.tar.bz2";
+    url = "https://www.ginac.de/ginac-${version}.tar.bz2";
    sha256 = "sha256-8WldvWsYcGHvP7pQdkjJ1tukOPczsFjBb5J4y9z14as=";
  };

  propagatedBuildInputs = [ cln ];

-  buildInputs = [ readline ] ++ lib.optional stdenv.isDarwin gmp;
+  buildInputs = [ readline ]
+    ++ lib.optional stdenv.isDarwin gmp;

  nativeBuildInputs = [ pkg-config python3 ];

  strictDeps = true;

-  preConfigure = "patchShebangs ginsh";
+  preConfigure = ''
+    patchShebangs ginsh
+  '';

  configureFlags = [ "--disable-rpath" ];

  meta = with lib; {
    description = "GiNaC is Not a CAS";
-    homepage    = "https://www.ginac.de/";
+    homepage = "https://www.ginac.de/";
    maintainers = with maintainers; [ lovek323 ];
    license = licenses.gpl2;
-    platforms   = platforms.all;
+    platforms = platforms.all;
  };
 }
@@ -1,27 +1,35 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    activesupport (5.2.4.4)
+    activesupport (5.2.6)
      concurrent-ruby (~> 1.0, >= 1.0.2)
      i18n (>= 0.7, < 2)
      minitest (~> 5.1)
      tzinfo (~> 1.1)
-    concurrent-ruby (1.1.7)
-    gitlab-triage (1.13.0)
+    concurrent-ruby (1.1.9)
+    gitlab-triage (1.20.0)
      activesupport (~> 5.1)
+      globalid (~> 0.4)
+      graphql-client (~> 0.16)
      httparty (~> 0.17)
+    globalid (0.5.2)
+      activesupport (>= 5.0)
+    graphql (1.12.14)
+    graphql-client (0.16.0)
+      activesupport (>= 3.0)
+      graphql (~> 1.8)
    httparty (0.18.1)
      mime-types (~> 3.0)
      multi_xml (>= 0.5.2)
-    i18n (1.8.5)
+    i18n (1.8.10)
      concurrent-ruby (~> 1.0)
    mime-types (3.3.1)
      mime-types-data (~> 3.2015)
-    mime-types-data (3.2020.0512)
-    minitest (5.14.2)
+    mime-types-data (3.2021.0704)
+    minitest (5.14.4)
    multi_xml (0.6.0)
    thread_safe (0.3.6)
-    tzinfo (1.2.7)
+    tzinfo (1.2.9)
      thread_safe (~> 0.1)

 PLATFORMS
@@ -5,31 +5,63 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "0dpnk20s754fz6jfz9sp3ri49hn46ksw4hf6ycnlw7s3hsdxqgcd";
+      sha256 = "1vybx4cj42hr6m8cdwbrqq2idh98zms8c11kr399xjczhl9ywjbj";
      type = "gem";
    };
-    version = "5.2.4.4";
+    version = "5.2.6";
  };
  concurrent-ruby = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1vnxrbhi7cq3p4y2v9iwd10v1c7l15is4var14hwnb2jip4fyjzz";
+      sha256 = "0nwad3211p7yv9sda31jmbyw6sdafzmdi2i2niaz6f0wk5nq9h0f";
      type = "gem";
    };
-    version = "1.1.7";
+    version = "1.1.9";
  };
  gitlab-triage = {
-    dependencies = ["activesupport" "httparty"];
+    dependencies = ["activesupport" "globalid" "graphql-client" "httparty"];
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "11sas3h3n638gni1mysck1ahyakqnl8gg6g21pc3krs6jrg9qxj9";
+      sha256 = "sha256-sg/YgRnp1+EcTcBqsm8vZrV0YuHTSJEFk/whhW8An6g=";
      type = "gem";
    };
-    version = "1.13.0";
+    version = "1.20.0";
+  };
+  globalid = {
+    dependencies = ["activesupport"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0k6ww3shk3mv119xvr9m99l6ql0czq91xhd66hm8hqssb18r2lvm";
+      type = "gem";
+    };
+    version = "0.5.2";
+  };
+  graphql = {
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "sha256-iweRDvp7EWY02B52iwbebEpiwL7Mj9E9RyeHYMuqc/o=";
+      type = "gem";
+    };
+    version = "1.12.14";
+  };
+  graphql-client = {
+    dependencies = ["activesupport" "graphql"];
+    groups = ["default"];
+    platforms = [];
+    source = {
+      remotes = ["https://rubygems.org"];
+      sha256 = "0g971rccyrs3rk8812r6az54p28g66m4ngdcbszg31mvddjaqkr4";
+      type = "gem";
+    };
+    version = "0.16.0";
  };
  httparty = {
    dependencies = ["mime-types" "multi_xml"];
@@ -48,10 +80,10 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "153sx77p16vawrs4qpkv7qlzf9v5fks4g7xqcj1dwk40i6g7rfzk";
+      sha256 = "0g2fnag935zn2ggm5cn6k4s4xvv53v2givj1j90szmvavlpya96a";
      type = "gem";
    };
-    version = "1.8.5";
+    version = "1.8.10";
  };
  mime-types = {
    dependencies = ["mime-types-data"];
@@ -69,20 +101,20 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1z75svngyhsglx0y2f9rnil2j08f9ab54b3l95bpgz67zq2if753";
+      sha256 = "0dlxwc75iy0dj23x824cxpvpa7c8aqcpskksrmb32j6m66h5mkcy";
      type = "gem";
    };
-    version = "3.2020.0512";
+    version = "3.2021.0704";
  };
  minitest = {
    groups = ["default"];
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "170y2cvx51gm3cm3nhdf7j36sxnkh6vv8ls36p90ric7w8w16h4v";
+      sha256 = "19z7wkhg59y8abginfrm2wzplz7py3va8fyngiigngqvsws6cwgl";
      type = "gem";
    };
-    version = "5.14.2";
+    version = "5.14.4";
  };
  multi_xml = {
    groups = ["default"];
@@ -110,9 +142,9 @@
    platforms = [];
    source = {
      remotes = ["https://rubygems.org"];
-      sha256 = "1i3jh086w1kbdj3k5l60lc3nwbanmzdf8yjj3mlrx9b2gjjxhi9r";
+      sha256 = "0zwqqh6138s8b321fwvfbywxy00lw1azw4ql3zr0xh1aqxf8cnvj";
      type = "gem";
    };
-    version = "1.2.7";
+    version = "1.2.9";
  };
 }
@@ -54,4 +54,9 @@ rec {
    inherit callPackage;
  };

+  luajit_openresty = import ../luajit/openresty.nix {
+    self = luajit_openresty;
+    inherit callPackage;
+  };
+
 }
@@ -1,6 +1,8 @@
 { self, callPackage, lib }:
 callPackage ./default.nix {
  inherit self;
+  owner = "LuaJIT";
+  repo = "LuaJIT";
  version = "2.0.5-2021-06-08";
  rev = "98f95f69180d48ce49289d6428b46a9ccdd67a46";
  isStable = true;
@@ -1,6 +1,8 @@
 { self, callPackage }:
 callPackage ./default.nix {
  inherit self;
+  owner = "LuaJIT";
+  repo = "LuaJIT";
  version = "2.1.0-2021-06-25";
  rev = "e957737650e060d5bf1c2909b741cc3dffe073ac";
  isStable = false;
@@ -1,6 +1,8 @@
 { lib, stdenv, fetchFromGitHub, buildPackages
 , name ? "luajit-${version}"
 , isStable
+, owner
+, repo
 , sha256
 , rev
 , version
@@ -41,9 +43,7 @@ in
 stdenv.mkDerivation rec {
  inherit name version;
  src = fetchFromGitHub {
-    owner  = "LuaJIT";
-    repo   = "LuaJIT";
-    inherit sha256 rev;
+    inherit owner repo sha256 rev;
  };

  luaversion = "5.1";
@@ -0,0 +1,10 @@
+{ self, callPackage }:
+callPackage ./default.nix rec {
+  inherit self;
+  owner = "openresty";
+  repo = "luajit2";
+  version = "2.1-20210510";
+  rev = "v${version}";
+  isStable = true;
+  sha256 = "1h21w5axwka2j9jb86yc69qrprcavccyr2qihiw4b76r1zxzalvd";
+}
@@ -0,0 +1,27 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+}:
+
+stdenv.mkDerivation rec {
+  pname = "imath";
+  version = "3.0.5";
+
+  src = fetchFromGitHub {
+    owner = "AcademySoftwareFoundation";
+    repo = "imath";
+    rev = "v${version}";
+    sha256 = "0nwf8622j01p699nkkbal6xxs1snzzhz4cn6d76yppgvdhgyahsc";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  meta = with lib; {
+    description = "Imath is a C++ and python library of 2D and 3D vector, matrix, and math operations for computer graphics";
+    homepage = "https://github.com/AcademySoftwareFoundation/Imath";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ paperdigits ];
+    platforms = platforms.all;
+  };
+}
@@ -0,0 +1,32 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, zlib
+, cmake
+, imath
+}:
+
+stdenv.mkDerivation rec {
+  pname = "openexr";
+  version = "3.0.5";
+
+  outputs = [ "bin" "dev" "out" "doc" ];
+
+  src = fetchFromGitHub {
+    owner = "AcademySoftwareFoundation";
+    repo = "openexr";
+    rev = "v${version}";
+    sha256 = "0inmpby1syyxxzr0sazqvpb8j63vpj09vpkp4xi7m2qd4rxynkph";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  propagatedBuildInputs = [ imath zlib ];
+
+  meta = with lib; {
+    description = "A high dynamic-range (HDR) image file format";
+    homepage = "https://www.openexr.com/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ paperdigits ];
+    platforms = platforms.all;
+  };
+}
@@ -1 +1 @@
-Moved to [/doc/languages-frameworks/node.section.md](/doc/languages-frameworks/node.section.md)
+Moved to [/doc/languages-frameworks/javascript.section.md](/doc/languages-frameworks/javascript.section.md)
@@ -5,6 +5,7 @@
 , "@bitwarden/cli"
 , "@hyperspace/cli"
 , "@nestjs/cli"
+, "@squoosh/cli"
 , "@vue/cli"
 , "@webassemblyjs/cli"
 , "@webassemblyjs/repl"
@@ -10,7 +10,7 @@

 buildPythonPackage rec {
  pname = "aiorun";
-  version = "2020.12.1";
+  version = "2021.8.1";
  format = "flit";
  disabled = pythonOlder "3.5";

@@ -18,7 +18,7 @@ buildPythonPackage rec {
    owner = "cjrh";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-ktc2cmoPNYcsVyKCWs+ivhV5onywFIrdDRBiBKrdiF4=";
+    sha256 = "sha256-aehYPZ1+GEO+bNSsE5vVgjtVo4MRMH+vNurk+bJ1/Io=";
  };

  propagatedBuildInputs = [
@@ -1,4 +1,5 @@
 { lib
+, stdenv
 , aiohttp
 , async-timeout
 , buildPythonPackage
@@ -13,14 +14,14 @@

 buildPythonPackage rec {
  pname = "async-upnp-client";
-  version = "0.19.1";
+  version = "0.19.2";
  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "StevenLooman";
    repo = "async_upnp_client";
    rev = version;
-    sha256 = "sha256-qxEn9UrQuwRaP7sZlu3854gDI7Gqku055DF8KvsU6p4=";
+    sha256 = "1v8d2lvxihqasn7866zssys16s0lgxkk6ri2dp4rr7wr8g9ixvdr";
  };

  propagatedBuildInputs = [
@@ -52,6 +53,8 @@ buildPythonPackage rec {
    "test_subscribe_renew"
    "test_start_server"
    "test_init"
+  ] ++ lib.optionals stdenv.isDarwin [
+    "test_deferred_callback_url"
  ];

  pythonImportsCheck = [ "async_upnp_client" ];
@@ -0,0 +1,55 @@
+{ lib
+, boto3
+, botocore
+, buildPythonPackage
+, cached-property
+, click
+, click-option-group
+, fetchFromGitHub
+, jinja2
+, markdown
+, policy-sentry
+, pytestCheckHook
+, pythonOlder
+, pyyaml
+, schema
+}:
+
+buildPythonPackage rec {
+  pname = "cloudsplaining";
+  version = "0.4.5";
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "salesforce";
+    repo = pname;
+    rev = version;
+    sha256 = "0s446jji3c9x1gw0lsb03giir91cnv6dgh4nzxg9mc1rm9wy7gzw";
+  };
+
+  propagatedBuildInputs = [
+    boto3
+    botocore
+    cached-property
+    click
+    click-option-group
+    jinja2
+    markdown
+    policy-sentry
+    pyyaml
+    schema
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "cloudsplaining" ];
+
+  meta = with lib; {
+    description = "Python module for AWS IAM security assessment";
+    homepage = "https://github.com/salesforce/cloudsplaining";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ fab ];
+  };
+}
@@ -0,0 +1,33 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, jinja2
+, poetry-core
+}:
+
+buildPythonPackage rec {
+  pname = "jinja2-git";
+  version = "unstable-2021-07-20";
+  format = "pyproject";
+
+  src = fetchFromGitHub {
+    owner = "wemake-services";
+    repo = "jinja2-git";
+    # this is master, we can't patch because of poetry.lock :(
+    # luckily, there appear to have been zero API changes since then, only
+    # dependency upgrades
+    rev = "c6d19b207eb6ac07182dc8fea35251d286c82512";
+    sha256 = "0yw0318w57ksn8azmdyk3zmyzfhw0k281fddnxyf4115bx3aph0g";
+  };
+
+  nativeBuildInputs = [ poetry-core ];
+  propagatedBuildInputs = [ jinja2 ];
+  pythonImportsCheck = [ "jinja2_git" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/wemake-services/jinja2-git";
+    description = "Jinja2 extension to handle git-specific things";
+    license = licenses.mit;
+    maintainers = with maintainers; [ cpcloud ];
+  };
+}
@@ -6,11 +6,11 @@

 buildPythonPackage rec {
  pname = "pex";
-  version = "2.1.42";
+  version = "2.1.45";

  src = fetchPypi {
    inherit pname version;
-    sha256 = "2deb088a3943891d07f9871e47409407e6308fbff3ee9514a0238791dc8da99f";
+    sha256 = "e5b0de7b23e1f578f93559a08a01630481b0af3dc9fb3e130b14b99baa83491b";
  };

  nativeBuildInputs = [ setuptools ];
@@ -0,0 +1,45 @@
+{ lib
+, beautifulsoup4
+, buildPythonPackage
+, click
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, pyyaml
+, requests
+, schema
+}:
+
+buildPythonPackage rec {
+  pname = "policy-sentry";
+  version = "0.11.16";
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "salesforce";
+    repo = "policy_sentry";
+    rev = version;
+    sha256 = "0m3sr1mhnmm22xgd3h9dgkrq20pdghwx505xld4pahj686z4bva2";
+  };
+
+  propagatedBuildInputs = [
+    beautifulsoup4
+    click
+    requests
+    pyyaml
+    schema
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "policy_sentry" ];
+
+  meta = with lib; {
+    description = "Python module for generating IAM least privilege policies";
+    homepage = "https://github.com/salesforce/policy_sentry";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ fab ];
+  };
+}
@@ -8,14 +8,14 @@

 buildPythonPackage rec {
  pname = "pyfronius";
-  version = "0.6.0";
+  version = "0.6.2";
  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "nielstron";
    repo = pname;
    rev = "release-${version}";
-    sha256 = "sha256-z7sIDT6dxgLWcnpZ4NOp5Bz5C9xduwQJ3xmDfTyI+Gs=";
+    sha256 = "03szfgf2g0hs4r92p8jb8alzl7byzrirxsa25630zygmkadzgrz2";
  };

  propagatedBuildInputs = [
@@ -10,12 +10,12 @@

 buildPythonPackage rec {
  pname = "pymunk";
-  version = "6.0.0";
+  version = "6.1.0";

  src = fetchPypi {
    inherit pname version;
    extension = "zip";
-    sha256 = "04jqqd2y0wzzkqppbl08vyzgbcpl5qj946w8da2ilypqdx7j2akp";
+    sha256 = "1k1ncrssywvfrbmai7d20h2mg4lzhq16rhw3dkg4ad5nhik3k0sl";
  };

  propagatedBuildInputs = [ cffi ];
@@ -26,14 +26,14 @@

 buildPythonPackage rec {
  pname = "python-lsp-server";
-  version = "1.2.0";
+  version = "1.2.1";
  disabled = pythonOlder "3.6";

  src = fetchFromGitHub {
    owner = "python-lsp";
    repo = pname;
    rev = "v${version}";
-    sha256 = "09wnnbf7lqqni6xkpzzk7nmcqjm5bx49xqzmp5fkb9jk50ivcrdz";
+    sha256 = "sha256-TyXKlXeXMyq+bQq9ngDm0SuW+rAhDlOVlC3mDI1THwk=";
  };

  propagatedBuildInputs = [
@@ -14,13 +14,13 @@

 buildGoModule rec {
  pname = "buildah";
-  version = "1.22.2";
+  version = "1.22.3";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "buildah";
    rev = "v${version}";
-    sha256 = "sha256-hGw6qpCQZp/lRbagP0lap22oRzsEb+C6Vqn7R6Ckvhs=";
+    sha256 = "sha256-e4Y398VyvoDo5WYyLeZJUMmb0HgWNBWj+hCPxdUlZNY=";
  };

  outputs = [ "out" "man" ];
@@ -2,7 +2,7 @@
 # Do not edit!

 {
-  version = "2021.8.7";
+  version = "2021.8.8";
  components = {
    "abode" = ps: with ps; [ abodepy ];
    "accuweather" = ps: with ps; [ accuweather ];
@@ -134,7 +134,7 @@ let
  extraBuildInputs = extraPackages py.pkgs;

  # Don't forget to run parse-requirements.py after updating
-  hassVersion = "2021.8.7";
+  hassVersion = "2021.8.8";

 in with py.pkgs; buildPythonApplication rec {
  pname = "homeassistant";
@@ -151,7 +151,7 @@ in with py.pkgs; buildPythonApplication rec {
    owner = "home-assistant";
    repo = "core";
    rev = version;
-    sha256 = "0f69jcpxyr0kzziwl6bfj2jbn23hrj1796ml6jsk9mnpfkdsd9vi";
+    sha256 = "1fj16qva04d9qhpnfxxacsp82vqqfha5c2zg4f850kld4qhwrgky";
  };

  # leave this in, so users don't have to constantly update their downstream patch handling
@@ -1,93 +0,0 @@
-# This file was generated by https://github.com/kamilchm/go2nix v1.3.0
-[
-  {
-    goPackagePath = "github.com/123Haynes/go-http-digest-auth-client";
-    fetch = {
-      type = "git";
-      url = "https://github.com/123Haynes/go-http-digest-auth-client";
-      rev = "4c2ff1556cab0c8c14069d8d116c34db59c50c54";
-      sha256 = "0hpynnvwlxcdrrplvzibqk3179lzwkv8zlp03r6cd1vsd28b11ja";
-    };
-  }
-  {
-    goPackagePath = "github.com/beorn7/perks";
-    fetch = {
-      type = "git";
-      url = "https://github.com/beorn7/perks";
-      rev = "4b2b341e8d7715fae06375aa633dbb6e91b3fb46";
-      sha256 = "1i1nz1f6g55xi2y3aiaz5kqfgvknarbfl4f0sx4nyyb4s7xb1z9x";
-    };
-  }
-  {
-    goPackagePath = "github.com/golang/protobuf";
-    fetch = {
-      type = "git";
-      url = "https://github.com/golang/protobuf";
-      rev = "e91709a02e0e8ff8b86b7aa913fdc9ae9498e825";
-      sha256 = "16arbb7nwvs7lkpr7i9vrv8mk9h77zd3blzp3z9b0infqla4ddzc";
-    };
-  }
-  {
-    goPackagePath = "github.com/matttproud/golang_protobuf_extensions";
-    fetch = {
-      type = "git";
-      url = "https://github.com/matttproud/golang_protobuf_extensions";
-      rev = "c182affec369e30f25d3eb8cd8a478dee585ae7d";
-      sha256 = "1xqsf9vpcrd4hp95rl6kgmjvkv1df4aicfw4l5vfcxcwxknfx2xs";
-    };
-  }
-  {
-    goPackagePath = "github.com/mxschmitt/golang-env-struct";
-    fetch = {
-      type = "git";
-      url = "https://github.com/mxschmitt/golang-env-struct";
-      rev = "0c54aeca83972d1c7adf812b37dc53a6cbf58fb7";
-      sha256 = "19h840xhkglxwfbwx6w1qyndzg775b14kpz3xpq0lfrkfxdq0w9l";
-    };
-  }
-  {
-    goPackagePath = "github.com/pkg/errors";
-    fetch = {
-      type = "git";
-      url = "https://github.com/pkg/errors";
-      rev = "27936f6d90f9c8e1145f11ed52ffffbfdb9e0af7";
-      sha256 = "0yzmgi6g4ak4q8y7w6x0n5cbinlcn8yc3gwgzy4yck00qdn25d6y";
-    };
-  }
-  {
-    goPackagePath = "github.com/prometheus/client_golang";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/client_golang";
-      rev = "3f6cbd95606771ac9f7b1c9247d2ca186cb72cb9";
-      sha256 = "1d9qc9jwqsgh6r5x5qkf6c6pkfb5jfhxls431ilhawn05fbyyypq";
-    };
-  }
-  {
-    goPackagePath = "github.com/prometheus/client_model";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/client_model";
-      rev = "fd36f4220a901265f90734c3183c5f0c91daa0b8";
-      sha256 = "1bs5d72k361llflgl94c22n0w53j30rsfh84smgk8mbjbcmjsaa5";
-    };
-  }
-  {
-    goPackagePath = "github.com/prometheus/common";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/common";
-      rev = "c873fb1f9420b83ee703b4361c61183b4619f74d";
-      sha256 = "1fmigir3c35nxmsj4bqwfp69kaxy415qk0ssi4wplcyd1g656lbg";
-    };
-  }
-  {
-    goPackagePath = "github.com/prometheus/procfs";
-    fetch = {
-      type = "git";
-      url = "https://github.com/prometheus/procfs";
-      rev = "87a4384529e0652f5035fb5cc8095faf73ea9b0b";
-      sha256 = "1rjd7hf5nvsdw2jpqpapfw6nv3w3zphfhkrh5p7nryakal6kcgmh";
-    };
-  }
-]
@@ -1,28 +1,27 @@
-{ lib, buildGoPackage, fetchFromGitHub, nixosTests }:
+{ lib, buildGoModule, fetchFromGitHub, nixosTests }:

-buildGoPackage rec {
+buildGoModule rec {
  pname = "fritzbox-exporter";
-  version = "v1.0-32-g90fc0c5";
-  rev = "90fc0c572d3340803f7c2aafc4b097db7af1f871";
+  version = "unstable-2021-04-13";

  src = fetchFromGitHub {
-    inherit rev;
+    rev = "fd36539bd7db191b3734e17934b5f1e78e4e9829";
    owner = "mxschmitt";
    repo = "fritzbox_exporter";
-    sha256 = "08gcc60g187x1d14vh7n7s52zkqgj3fvg5v84i6dw55rmb6zzxri";
+    sha256 = "0w9gdcnfc61q6mzm95i7kphsf1rngn8rb6kz1b6knrh5d8w61p1n";
  };

-  goPackagePath = "github.com/mxschmitt/fritzbox_exporter";
+  subPackages = [ "cmd/exporter" ];

-  goDeps = ./fritzbox-exporter-deps.nix;
+  vendorSha256 = "0k6bd052pjfg5c1ba1yhni8msv3wl512vfzy2hrk49jibh8h052n";

  passthru.tests = { inherit (nixosTests.prometheus-exporters) fritzbox; };

  meta = with lib; {
    description = "Prometheus Exporter for FRITZ!Box (TR64 and UPnP)";
-    homepage = "https://github.com/ndecker/fritzbox_exporter";
+    homepage = "https://github.com/mxschmitt/fritzbox_exporter";
    license = licenses.asl20;
-    maintainers = with maintainers; [ bachp flokli ];
+    maintainers = with maintainers; [ bachp flokli sbruder ];
    platforms = platforms.unix;
  };
 }
@@ -1,5 +1,5 @@
 { lib
-, stdenv
+, multiStdenv
 , fetchFromGitHub
 , substituteAll
 , meson
@@ -8,6 +8,7 @@
 , wine
 , boost
 , libxcb
+, pkgsi686Linux
 }:

 let
@@ -55,16 +56,16 @@ let
      sha256 = "sha256-39pvfcg4fvf7DAbAPzEHA1ja1LFL6r88nEwNYwaDC8w=";
    };
  };
-in stdenv.mkDerivation rec {
+in multiStdenv.mkDerivation rec {
  pname = "yabridge";
-  version = "3.3.1";
+  version = "3.5.2";

  # NOTE: Also update yabridgectl's cargoHash when this is updated
  src = fetchFromGitHub {
    owner = "robbert-vdh";
    repo = pname;
    rev = version;
-    hash = "sha256-3B+6YuCWVJljqdyGpePjPf5JDwLSWFNgOCeLt8e4mO8=";
+    hash = "sha256-SLiksc8lQo2A5sefKbcaJyhi8vPdp2p2Jbc7bvM0sDw=";
  };

  # Unpack subproject sources
@@ -109,6 +110,7 @@ in stdenv.mkDerivation rec {

  mesonFlags = [
    "--cross-file" "cross-wine.conf"
+    "-Dwith-bitbridge=true"

    # Requires CMake and is unnecessary
    "-Dtomlplusplus:GENERATE_CMAKE_CONFIG=disabled"
@@ -118,11 +120,16 @@ in stdenv.mkDerivation rec {
    "-Dtomlplusplus:BUILD_TESTS=disabled"
  ];

+  preConfigure = ''
+    sed -i "214s|xcb.*|xcb_32bit_dep = winegcc.find_library('xcb', dirs: [ '${lib.getLib pkgsi686Linux.xorg.libxcb}/lib', ])|" meson.build
+    sed -i "192 i '${lib.getLib pkgsi686Linux.boost}/lib'," meson.build
+  '';
+
  installPhase = ''
    runHook preInstall
    mkdir -p "$out/bin" "$out/lib"
-    cp yabridge-group.exe{,.so} "$out/bin"
-    cp yabridge-host.exe{,.so} "$out/bin"
+    cp yabridge-group*.exe{,.so} "$out/bin"
+    cp yabridge-host*.exe{,.so} "$out/bin"
    cp libyabridge-vst2.so "$out/lib"
    cp libyabridge-vst3.so "$out/lib"
    runHook postInstall
@@ -1,13 +1,13 @@
 diff --git a/src/plugin/utils.cpp b/src/plugin/utils.cpp
-index 1ff05bc..0723456 100644
+index 7fb7d1b3..eb227101 100644
 --- a/src/plugin/utils.cpp
 +++ b/src/plugin/utils.cpp
-@@ -351,7 +351,7 @@ std::string get_wine_version() {
+@@ -105,5 +105,5 @@ std::string PluginInfo::wine_version() const {
         access(wineloader_path.c_str(), X_OK) == 0) {
         wine_path = wineloader_path;
     } else {
 -        wine_path = bp::search_path("wine").string();
 +        wine_path = "@wine@/bin/wine";
     }
- 
+
     bp::ipstream output;
@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {

  src = yabridge.src;
  sourceRoot = "source/tools/yabridgectl";
-  cargoHash = "sha256-f5k5OF+bEzH0b6M14Mdp8t4Qd5dP5Qj2fDsdiG1MkYk=";
+  cargoHash = "sha256-2x3qB0LbCBUZ4zqKIXPtYdWis+4QANTaJdFvoFbccGE=";

  patches = [
    # By default, yabridgectl locates libyabridge.so by using
@@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "pgmetrics";
-  version = "1.10.5";
+  version = "1.11.0";

  src = fetchFromGitHub {
    owner  = "rapidloop";
    repo   = pname;
    rev    = "v${version}";
-    sha256 = "sha256-rqaK94Rw0K1+r7+7jHI2bzBupCGTkokeC4heJ3Yu6pQ=";
+    sha256 = "sha256-8E4rciuoZrj8Oz2EXqtFgrPxvb8GJO3n1s2FpXrR0Q0=";
  };

-  vendorSha256 = "sha256-5f2hkOgAE4TrHNz7xx1RU9fozxjFZAl4HilhAqsbo5s=";
+  vendorSha256 = "sha256-scaaRjaDE/RG6Ei83CJBkfQCd1e5pH/Cs2vEbdl9Oyg=";

  doCheck = false;

@@ -2,13 +2,13 @@

 stdenv.mkDerivation rec {
  pname = "exploitdb";
-  version = "2021-08-19";
+  version = "2021-08-21";

  src = fetchFromGitHub {
    owner = "offensive-security";
    repo = pname;
    rev = version;
-    sha256 = "sha256-4GUjQ36FXgDZpLkGXSLy1GEx5+SYYumRpRR2Ucqzeuc=";
+    sha256 = "sha256-3XSk6a8gaCF8X1Plyfyi1Jtfp2sDLgbstv67hvlM3Gk=";
  };

  installPhase = ''
@@ -12670,7 +12670,7 @@ with pkgs;

  ### LUA interpreters
  luaInterpreters = callPackage ./../development/interpreters/lua-5 {};
-  inherit (luaInterpreters) lua5_1 lua5_2 lua5_2_compat lua5_3 lua5_3_compat lua5_4 lua5_4_compat luajit_2_1 luajit_2_0;
+  inherit (luaInterpreters) lua5_1 lua5_2 lua5_2_compat lua5_3 lua5_3_compat lua5_4 lua5_4_compat luajit_openresty luajit_2_1 luajit_2_0;

  lua5 = lua5_2_compat;
  lua = lua5;
@@ -18023,7 +18023,11 @@ with pkgs;

  opencv = opencv4;

-  openexr = callPackage ../development/libraries/openexr { };
+  imath = callPackage ../development/libraries/imath { };
+
+  openexr = openexr_2;
+  openexr_2 = callPackage ../development/libraries/openexr { };
+  openexr_3 = callPackage ../development/libraries/openexr/3.nix { };

  openexrid-unstable = callPackage ../development/libraries/openexrid-unstable { };

@@ -27983,31 +27987,11 @@ with pkgs;
  wrapNeovimUnstable = callPackage ../applications/editors/neovim/wrapper.nix { };
  wrapNeovim = neovim-unwrapped: lib.makeOverridable (neovimUtils.legacyWrapper neovim-unwrapped);
  neovim-unwrapped = callPackage ../applications/editors/neovim {
-    # neovim doesn't build with luajit on aarch64-darwin :
-    # ./luarocks init
-    # PANIC: unprotected error in call to Lua API (module 'luarocks.core.hardcoded' not found:
-    #         no field package.preload['luarocks.core.hardcoded']
-    #         no file '/private/tmp/nix-build-luarocks-3.2.1.drv-0/source/src/luarocks/core/hardcoded.lua'
-    #         no file './luarocks/core/hardcoded.lua'
-    #         no file '/nix/store/3s6c509q9vvq3db87rfi7qa38wzxwz8w-luajit-2.1.0-2021-05-29/share/luajit-2.1.0-beta3/luarocks/core/hardcoded.lua'
-    #         no file '/usr/local/share/lua/5.1/luarocks/core/hardcoded.lua'
-    #         no file '/usr/local/share/lua/5.1/luarocks/core/hardcoded/init.lua'
-    #         no file '/nix/store/3s6c509q9vvq3db87rfi7qa38wzxwz8w-luajit-2.1.0-2021-05-29/share/lua/5.1/luarocks/core/hardcoded.lua'
-    #         no file '/nix/store/3s6c509q9vvq3db87rfi7qa38wzxwz8w-luajit-2.1.0-2021-05-29/share/lua/5.1/luarocks/core/hardcoded/init.lua'
-    #         no file './luarocks/core/hardcoded.so'
-    #         no file '/usr/local/lib/lua/5.1/luarocks/core/hardcoded.so'
-    #         no file '/nix/store/3s6c509q9vvq3db87rfi7qa38wzxwz8w-luajit-2.1.0-2021-05-29/lib/lua/5.1/luarocks/core/hardcoded.so'
-    #         no file '/usr/local/lib/lua/5.1/loadall.so'
-    #         no file './luarocks.so'
-    #         no file '/usr/local/lib/lua/5.1/luarocks.so'
-    #         no file '/nix/store/3s6c509q9vvq3db87rfi7qa38wzxwz8w-luajit-2.1.0-2021-05-29/lib/lua/5.1/luarocks.so'
-    #         no file '/usr/local/lib/lua/5.1/loadall.so')
-    # make: *** [GNUmakefile:57: luarocks] Error 1
-    #
-    # See https://github.com/NixOS/nixpkgs/issues/129099
-    # Possibly related: https://github.com/neovim/neovim/issues/7879
+    # See:
+    #   - https://github.com/NixOS/nixpkgs/issues/129099
+    #   - https://github.com/NixOS/nixpkgs/issues/128959
    lua =
-      if (stdenv.isDarwin && stdenv.isAarch64) then lua5_1 else
+      if (stdenv.isDarwin && stdenv.isAarch64) then luajit_openresty else
      luajit;
  };

@@ -1539,6 +1539,8 @@ in {

  cloudsmith-api = callPackage ../development/python-modules/cloudsmith-api { };

+  cloudsplaining = callPackage ../development/python-modules/cloudsplaining { };
+
  clustershell = callPackage ../development/python-modules/clustershell { };

  clvm = callPackage ../development/python-modules/clvm { };
@@ -3734,6 +3736,8 @@ in {

  jinja2 = callPackage ../development/python-modules/jinja2 { };

+  jinja2-git = callPackage ../development/python-modules/jinja2-git { };
+
  jinja2_pluralize = callPackage ../development/python-modules/jinja2_pluralize { };

  jinja2_time = callPackage ../development/python-modules/jinja2_time { };
@@ -5542,6 +5546,8 @@ in {

  polib = callPackage ../development/python-modules/polib { };

+  policy-sentry = callPackage ../development/python-modules/policy-sentry { };
+
  policyuniverse = callPackage ../development/python-modules/policyuniverse { };

  polyline = callPackage ../development/python-modules/polyline { };